Privacy Policy
Last updated: 14 September 2026 (draft, pending legal review)
Who we are
[Compass Response Ltd], company number [COMPANY NUMBER], registered in England and Wales at [REGISTERED ADDRESS], is the data controller for the personal data described in this policy unless stated otherwise. Our ICO registration reference is [ICO REGISTRATION NUMBER].
You can contact us about this policy or your data at hello@compassresponse.co.uk.
What data we collect
Depending on how you interact with us, we may collect:
- Contact details you give us: name, business name, email address, phone number
- Details you submit through our audit request form or send by email, including your contact details, business information and answers about your enquiry process. No chatbot is embedded on this website.
- Technical data: IP address, browser type, device information, and pages visited on our site
- Communications between us, including emails and call notes from an audit or consultation
We do not intentionally collect special category data (such as health information) through our own website. If you're a healthcare or aesthetics client, a separate data processing agreement governs how we handle your customers' data on your behalf. See "If you're a client" below.
Why we collect it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry or audit request | Legitimate interests / steps to enter a contract |
| Delivering a service you've engaged us for | Performance of a contract |
| Sending relevant marketing to businesses | The applicable lawful basis is assessed for the recipient and channel; an audit request is not consent to unrelated marketing. |
| Improving our website and services | Legitimate interests |
| Meeting our legal and accounting obligations | Legal obligation |
Electronic marketing to sole traders and certain partnerships generally requires consent or a valid soft opt-in. Business contact details are not treated as blanket permission to send marketing. Opt-outs must be respected.
How long we keep it
We keep enquiry and lead data for [12 months] from your last contact with us, unless you become a client, in which case we retain records for the duration of our engagement plus [6 years] to meet our accounting and legal obligations.
Who we share it with
We use a small number of third-party services to run our business and deliver client work. These may include:
- Booking and scheduling tools (e.g. Calendly)
- Email services (Google Workspace) and, for separately agreed messaging services, Twilio
- Website hosting and form collection (Netlify), with audit requests stored in Netlify Forms and email notifications sent to our business inbox; and, for separately agreed client services, automation and database providers (n8n and Supabase)
- For separately agreed AI services, Anthropic and Voyage AI
The provider locations and any required international-transfer arrangements must be confirmed before a client service begins. This draft does not assert that all future provider contracts or safeguards are already in place.
If you're a client
Where we process your customers' data on your behalf (for example, running a lead-automation or chatbot service for your business), we act as a data processor and you remain the data controller. This relationship is governed by a separate Data Processing Agreement, not by this policy.
Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Ask us to correct inaccurate data
- Ask us to delete your data, in certain circumstances
- Object to or restrict how we use your data
- Request a copy of your data in a portable format
- Withdraw consent, where we rely on it
To exercise any of these rights, contact us at hello@compassresponse.co.uk. If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Cookies
Our website uses cookies. Details of what we use and why are set out in our Cookie Policy.
Terms of service
Using this website, or engaging our services, is also governed by our Terms of Service.
Changes to this policy
We may update this policy from time to time. Material changes will be reflected in the "last updated" date above.