PRIVACY POLICY

Introduction

This privacy policy sets out how Compass Ltd uses and protects your personal data. It gives you information about how we collect and use your personal data through your use of this Website, including any data you may provide when you register with us.

Important information and who we are

Data Controller

Compass Ltd is the data controller and responsible for your personal data (collectively referred to as “Compass”, “we”, “us” or “our” in this privacy policy).

If you have any questions about this privacy policy, including any request to exercise your legal rights (paragraph 9), please contact us using the information set out in paragraph 10.

The types of personal data we collect about you

Personal data means any information about an individual from which that individual can be identified.

We may collect, use, store and transfer the following different types of personal data about you:

Identity Data – This includes your first name, last name, any previous names, username or similar identifier, marital status, title, date of birth and gender.
Contact Data – This may include your email address and telephone numbers.
Financial Data – This may include any bank account and payment card details.
Technical Data – This includes internet protocol (IP) address, your login data, browser type and version, operating system and platform, device ID and other information on the devices used to access our website.
Profile Data – Including your username and password, history of purchases or orders made by you, your interests, preferences, feedback and survey responses.
Usage Data – Including information autonomously collected regarding how you interact with and use our website, products and services.
Marketing and Communications Data – This includes your preferences in receiving marketing from us and our third parties and your communication preferences.

How is your personal data collected?

We use different methods to collect data from and about you including through:

Information you provide us: You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise.
Automatic website interactions and technologies: Automatic systems on our website collect Technical Data (see above) as you interact with our website. This personal data may be collected using cookies, server logs or other such technologies.

How we use your personal data

Legal basis

The legal bases for us collecting and using your personal data include one or more of the following as applicable:

Contract performance with you – To facilitate the performance of our contract with you.
Legitimate interests – To conduct our business and pursue legitimate interests such as the prevention of fraud or enhancing user experience.
Legal obligation – Where we are required to share personal data as relevant information for compliance with legal obligations such as with relevant authorities or regulatory bodies. In such cases, we will identify the relevant legal obligation to you.
Consent – This is relevant only where we have obtained your explicit consent for using the data for a specified purpose (e.g. your email address to subscribe for our newsletter or publications).

Purposes for which we will use your personal data

Information provided by you

This information will be used for the following purposes:

To facilitate provision of services to you and performance of any contracts we may enter into with you.
Where necessary for our legitimate interests, provided there is no conflict with your fundamental rights and interests.
Where we need to comply with a legal or regulatory obligation.
To resolve any issues that you have reported or flagged.

Information we collect from our website

This information will be used for the following purposes:

For administrative purposes in operating our Website, including development, bug fixing, troubleshooting and security.
For analytical data to improve the content published on our Website.
For ensuring the best possible user experience for our customers.

Third-party marketing

For third parties’ direct marketing purposes, your personal data will only be shared with third parties with your express consent.

Opting out of marketing

You can ask to stop sending you marketing communications at any time by contacting us as laid out below.

For more information about the cookies we use and how to change your cookie preferences, please see our Cookies Policy.

Disclosures of your personal data

We may share your personal data where necessary with the parties set out below for the purposes set out below:

We may need to share your personal data with relevant government agencies and authorities to facilitate any citizenship or residency services. We will only provide data that is strictly required to perform our contract with you.
We may share your personal data with local service suppliers or agents, where it is necessary for the facilitation of provision of the services you require.
We may share your data with other third parties in their capacity as data controllers (i.e. legal, tax, real estate, immigration advisors and consultants) or various other service providers such as banks and providers of additional goods or services as and when required. These third parties will process your data as data controllers themselves and their privacy policies would apply.

We require all third parties to treat your personal data secure in accordance with the law. Third party service providers will not be allowed to use your personal data for their own purposes. They will only be permitted to use your personal data for specified purposes on our instructions.

International transfer

We might transfer your personal data to third party service providers to facilitate the carrying out of certain functions on our behalf. This process may involve the transfer of your data outside the UK. However, to ensure the security of your data, we will transfer the personal data in accordance with standard contractual clauses, namely the ‘European Commission: Model contracts for the transfer of personal data to third countries’, also known as ‘SCC’.

Data security

Appropriate security measures have been put in place to ensure prevention of your personal data being accidentally lost, used or accessed in a unauthorised manner, or disclosed or altered. Additionally, where you personal data is used by our employees, agents, contractors or other third parties, we limit such access to those with a business need to know and ensure they are subject to a duty of confidentiality. They will only process your personal data on our instruction.

Lastly, in the event of any suspected personal data breach, we have implemented rigorous procedures to deal with such cases and will notify you as well as any applicable regulators where legally required to do so.

Data retention

How long will you retain my personal data?

We shall retain your personal data only for as long as reasonably necessary to fulfil the purpose for which it was collected. This may include for the purposes of meeting any legal, tax, accounting, regulatory or reporting requirements. In any case, we will not retain your personal data for any period exceeding 10 years from the date of completion/termination of services to you.

In determining the retention period appropriate for your personal data, the factors we consider include the nature and sensitivity of the data, the amount, potential risk of harm in the event of unauthorised use or disclosure, whether the purpose for which the data was collected has been fulfilled and whether those purposes can be fulfilled through other means.

For tax purposes, we are required by law to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers.

In some circumstances, we may anonymise your personal data (so that it can no longer identify you individually) for statistical or research purposes. In such cases, we may continue to use this information indefinitely and without further notice.

Your legal rights

You have a number of rights under data protection laws in relation to your personal data.

Right to Request Access – You can check that we are lawfully processing your data as well and receive a copy of all the data we hold about you.
Right to Request Correction – You may have any incomplete or inaccurate data we hold about you corrected. However, we may require you to verify the accuracy of the amended information.
Right to Erasure – In certain circumstances, this allows you to request the deletion or erasure of your personal data if there is no good reason for us to continue retaining it. Such circumstances include:
- if you have successfully exercised your right to object (see below).
- If we have processed your information unlawfully.
- If we are required to erase your personal data in compliance with laws and regulations.

Please note that in certain situations we may not be able to comply with a request for erasure for specific legal reasons. In such instances, we will notify you of the reasons at the time of the request.

Right to Object – You may object to us processing your personal data where we are relying on the legal basis of a legitimate interest to do so (or those of a third party). However, in some cases we may demonstrate sufficiently compelling grounds to process your information which may overrule the right to object.
Right to Request Transfer – You also have the right to request the transferring of your personal data to you or a third party. In this case, we will provide to you, or the specified third party, your personal data in an electronic commonly used machine-readable format. Please note that this right only applies to personal data collected through automated means which you provided consent for us to use, or where the personal data was used to perform a contract with you.
Right to Restriction of Processing – This would enable you to ask us to suspend processing of your data in the following scenarios:
- For the purposes of you asking us to establish the accuracy of the data;
- If our processing and use of your data is unlawful, but you do not want to exercise your right of erasure;
- If you need us to continue retaining the data longer than we require it, for example if the information is necessary for you to establish or defend legal claims; or
- If you have exercised your right to object, but we need to verify whether we have an overriding legitimate grounds to continue its use.
Right to Withdraw Consent – Where we are relying on your active consent to process your personal data as the legal basis, you may withdraw such consent at any time. However, please note that doing so will not render unlawful any processing of your data carried out before consent was withdrawn. Additionally, such withdrawal of consent may mean we are unable to provide certain services or products to you, in which case we will advise you as such at the time of the withdrawal.
You also have the absolute right to object any time to the processing of your personal data for direct marketing purposes.

If you wish to exercise any of the rights set out above, please contact us through the means laid out in paragraph 10.

No fee usually required to access personal data

To access your personal data (or exercise any of your other rights) you do not usually have to pay a fee. However, a reasonable fee may be imposed if your request is clearly unfounded, repetitive or excessive. Alternatively, we may decide to refuse compliance with your request in such circumstances.

Steps you may be required to take

We may require specific information from you in order to comply with your request. We may need to verify your identity and ensure your right to access the personal data (or exercise any of your other rights.

To ensure the swiftest response, we may also need to contact you to ask you for further information in certain circumstances.

How long will it take us to respond

We will aim to respond to all legitimate requests within one month. However, it may occasionally take us longer where your request is particularly complex or numerous. In any case, we will keep you updated.

Contact details

If you need to contact us in relation to any part of the privacy policy, to exercise your privacy rights or you have any questions regarding this privacy policy, please contact us using:

Email address: [email protected]
Telephone number: +44 7440 624 362

Complaints

If you have a complaint, we would appreciate the chance to deal with your concerns directly. However, you have the right to file a complaint at any time with the UK regulator for data protection issues, the Information Commissioner’s Office (ICO).

Changes to our Privacy Policy and your duty to inform us of changes

We keep our privacy policy under review. This version was updated on 15 September 2024.

To ensure the personal data we hold about you is accurate, please let us know if your personal data changes while your relationship with us still exists.

Links to external third-party websites

Our website may include links to external third-party websites, applications or plug-ins. We do not control these third-party websites and are not responsible for their privacy policies, statements or procedures. Using these links may allow third parties access to your personal data, so please read the privacy policies of other websites you visit as well.