Kompass L.L.C-FZ ("Kompass", "we", "us") is a compliance advisory firm licensed in the Meydan Free Zone, Dubai, United Arab Emirates (licence no. 2653831.01). This notice explains what personal data we collect through this website, why we collect it, who we share it with and the rights you have. It applies to www.kompasslimited.com and to the free tools published on it. Personal data we process for clients under an engagement letter is covered by that engagement, not by this notice.
We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations. Where visitors are located in another jurisdiction, we aim to meet the requirements of that jurisdiction's data protection law as well.
What we collect, and why
Enquiries. When you use the enquiry form on our contact page we collect your name, organization, work email address, the topic you choose and your message. We use these details to reply to you and, where relevant, to tell you about services connected to your enquiry. The legal basis is your consent, which you give by ticking the box on the form, and our legitimate interest in responding to people who contact us.
Free tools. Several tools on this site, including the Bearing digital readiness reviews, the starter kits, the cost calculators, the AI Register, the Remediation Tracker, the Almanac and the risk and control library, ask for your name, job title, company, work email address, country and sector before you use them or receive a result. For Bearing reviews we also receive your scores and the summary results. We use these details to send you what you asked for, to understand who is using our tools, and to contact you about the tool and related services. The legal basis is your consent, given by ticking the box, which you can withdraw at any time.
Your answers stay on your device. The individual answers you give in a Bearing review, the entries you make in the AI Register, the Remediation Tracker, the Almanac and the risk and control library, and the figures you enter in the calculators are stored in your own browser and are not sent to us. The cookie policy explains how that storage works and how to turn it off.
Email updates. If you subscribe to our email updates we collect your work email address and, if you give it, your name, and we record the page you subscribed from. We use these to send you an email when we publish new insights or explainers, and to understand which organizations read our work. The legal basis is your consent, given by ticking the box. You can unsubscribe at any time by writing to us through the contact page, and every email we send will tell you how.
Technical data. Like every website, our hosting provider records the IP address, browser type, pages requested and time of each request in server logs, which are used to deliver the site, keep it secure and diagnose faults. We also use Vercel Web Analytics to count page views and see which pages, referring sites, countries and device types bring visitors. It sets no cookies, stores nothing on your device, and does not identify you. The legal basis for both is our legitimate interest in running a secure, reliable website and understanding which content is useful. We do not use advertising cookies and we do not track you across other websites.
Correspondence and meetings. If you email us, call us or meet us, we keep the correspondence and notes needed to manage the relationship, on the basis of our legitimate interest in running our business and, where we go on to work together, the steps needed to enter into a contract.
Who we share it with
We do not sell personal data and we do not share it with third parties for their own marketing. We use a small number of service providers who process data on our instructions:
- Microsoft (Microsoft 365, OneDrive and Power Automate), which receives enquiries and tool registrations and stores them in our records. Depending on the region of our Microsoft 365 tenant, this data may be stored outside the United Arab Emirates.
- Kompass CRM, our own client relationship system, hosted on Microsoft Azure, where enquiries and registrations are recorded so that a partner can follow up.
- Vercel, which hosts this website and holds the server logs described above. Vercel operates globally, including in the United States.
- Google Fonts, which supplies the typefaces used on this site. When a page loads, your browser requests the font files from Google, which receives your IP address in the process. Google does not set cookies through this service.
We may also disclose personal data where the law requires it, to our professional advisers under a duty of confidentiality, and, if Kompass is sold or restructured, to the successor business on the same terms as this notice.
International transfers
Some of the providers above store or process data outside the United Arab Emirates. Where that happens, we rely on the provider's contractual commitments to protect personal data to a standard consistent with the PDPL, including standard contractual terms where the destination has not been recognised as providing adequate protection. You can ask us for more detail about the safeguards that apply to a particular transfer.
How long we keep it
- Email update subscriptions: until you unsubscribe or we stop the updates.
- Enquiries and tool registrations: for as long as we are in contact with you about them and for up to 24 months after our last contact, unless you become a client, in which case the records form part of the client file.
- Server logs: for a short period set by our hosting provider.
- Data stored in your own browser by the free tools: until you clear it, or until you decline functional storage through the cookie settings, after which it is not kept between visits.
Your rights
Under the PDPL you have the right to ask us for access to the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive a copy in a portable format, and to withdraw a consent you have given. Withdrawing consent does not affect processing that took place before you withdrew it. We will respond to a request within one month and will not charge for it unless the request is clearly unfounded or excessive.
To exercise any of these rights, write to us through the contact page, stating what you would like us to do. We may ask you to confirm your identity before we act. If you are not satisfied with our response, you may complain to the UAE Data Office, the federal data protection authority, or to the supervisory authority in your own country.
Security
Personal data is held in access-controlled systems, and submissions from this website are sent over encrypted connections. We do not ask for, and ask you not to send, confidential or client-identifying information through the website.
Children
This website is intended for professionals and is not directed at children. We do not knowingly collect personal data from anyone under 18.
Changes to this notice
We will update this notice when our practices change and will show the date of the current version below. Significant changes will be highlighted on this page.