Privacy Policy

1. Who we are

Compass Works is an independent sustainability and data consultancy based in the United Kingdom.

For the purposes of the UK GDPR and the Data Protection Act 2018, Compass Works is the data controller for personal information collected through this website and through enquiries or submissions made directly to us.

For privacy-related questions or requests, contact:

Email: hello@compass-works.com

2. Information we collect

Depending on how you interact with Compass Works, we may collect:

• your name;
• organisation;
• email address;
• telephone number where provided;
• information included in enquiries or messages;
• information provided when requesting or discussing our services;
• files or documents that you choose to provide to us;
• technical information associated with use of the website, such as basic website analytics and security information.

We only collect information that is reasonably necessary for the relevant purpose.

3. How we use your information

We may use personal information to:

• respond to enquiries;
• discuss or provide requested services;
• manage prospective or existing client relationships;
• provide requested research, screening or analysis;
• administer submissions made through Compass Works tools or solution pages;
• send confirmations or other communications relating to a submission;
• maintain appropriate business and administrative records;
• protect the website and our services from misuse or abuse; and
• understand, at an aggregated level, how the website is being used.

We do not sell personal information.

4. Our lawful basis for processing

Under the UK GDPR, we must have a lawful basis for processing personal information.

The lawful basis we rely on depends on the circumstances and may include:

• Legitimate interests — where processing is necessary for operating Compass Works, responding to business enquiries, managing professional relationships, providing requested preliminary analysis or protecting our website and systems.
• Contract — where processing is necessary to take steps at your request before entering into a contract or to perform an agreed service.
• Legal obligation — where we need to retain or use information to comply with applicable law.
• Consent — where we specifically ask for consent and consent is the appropriate lawful basis.

Where we rely on legitimate interests, we consider whether those interests are proportionate and whether they could unfairly affect your rights and freedoms.

5. Contact and enquiry forms

If you contact Compass Works through a website form, email or other communication, we use the information you provide to respond to your enquiry and, where appropriate, discuss potential work.

We may retain business correspondence for a reasonable period where it is relevant to an ongoing or prospective professional relationship or to our business records.

6. GRESB Results Lab submissions

If you use the Compass Works GRESB Lab to share a GRESB Benchmark Report, we collect the contact information entered on the submission form together with the report or reports you choose to provide.

We use this information for the purpose of undertaking the requested preliminary GRESB results screening, communicating with you about the submission and administering the review.

Uploaded reports are treated as confidential information.

Reports are stored privately and are not made publicly accessible. They are not included as attachments in routine submission-notification emails.

Access is limited to authorised Compass Works personnel who require access for the purpose of undertaking or administering the requested review.

Where you provide a report, you are responsible for ensuring that you are authorised to share that information with Compass Works.

Submitting a report for preliminary screening does not itself establish a formal advisory or client engagement.

Retention of uploaded reports

Uploaded GRESB reports will normally be retained for 60 days following completion of the requested screening, unless:

• a longer period is agreed with you;
• the information becomes part of a subsequent client engagement; or
• retention is reasonably required for legal or administrative purposes.

Reports may be deleted earlier on request where there is no overriding reason for us to retain them.

To request deletion of a submitted report, contact hello@compass-works.com and quote your submission reference where available.

Associated submission records may be retained for longer where reasonably necessary for business administration, security, audit or legal purposes.

7. Service providers

We use selected third-party service providers to operate the website and related services.

These may include:

• Cloudflare for website hosting, security and private file storage;
• Resend for transactional email delivery; and
• other professional or technical service providers where reasonably necessary.

These providers may process information on our behalf only where required to provide their services and subject to their own contractual and data-protection obligations.

We do not provide uploaded reports to third parties for independent marketing or unrelated commercial use.

8. International transfers

Some technology providers used by Compass Works may process information in, or make it accessible from, countries outside the United Kingdom.

Where personal information is transferred outside the UK, we seek to ensure that appropriate safeguards are in place in accordance with the UK GDPR and other applicable UK data-protection requirements.

9. Website analytics

We may use privacy-focused website analytics to understand general website usage, such as page visits, traffic sources, device types and broad geographic information.

We use this information to understand how the website is performing and to improve its content and usability.

We do not use website analytics to build detailed profiles of individual visitors.

10. Cookies and similar technologies

The website may use cookies or similar technologies where necessary for operation, security or functionality.

Where non-essential cookies or technologies requiring consent are introduced, appropriate information and consent controls will be provided.

11. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including relevant legal, accounting, security and business-record requirements.

Different types of information may therefore have different retention periods.

Where a specific retention period applies, such as for uploaded GRESB reports, it is described in this policy or alongside the relevant collection form.

12. Your rights

Under the UK GDPR, you may have rights in relation to your personal information, depending on the circumstances and the lawful basis for processing.

These may include:

• the right to access personal information we hold about you;
• the right to have inaccurate information corrected;
• the right to request deletion of your information;
• the right to request restriction of processing;
• the right to object to certain processing;
• the right to data portability in applicable circumstances; and
• the right to withdraw consent where processing is based on consent.

These rights are not absolute and may depend on the circumstances.

To exercise a privacy right, contact hello@compass-works.com.

You also have the right to raise a concern with the Information Commissioner’s Office (ICO) if you are unhappy with how your personal information has been handled.

13. Security

We take reasonable technical and organisational measures to protect information from unauthorised access, loss, misuse or disclosure.

However, no internet-based system can be guaranteed to be completely secure.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology or legal requirements.

The latest version will be published on this page together with the date it was last updated.

15. Contact

For questions about this Privacy Policy or how Compass Works handles personal information, contact:

Compass Works
Email: hello@compass-works.com