Privacy Notice — Compass

1. Controller and contact details

Compass is provided by Yozu Limited, a company registered in England & Wales under number 08452790, whose registered office is at Cunard Two Suite, The Cotton Exchange, Bixteth Street, Liverpool, L3 9LQ (“we”, “us”). We are the controller of the personal data described in this notice. Enquiries about this notice, and requests to exercise the rights set out in section 8, should be sent to [email protected] or to the registered office address above.

2. Personal data we process

We process the following categories of personal data:

(a) Session content — the text you submit during a Discovery session and, where you use the voice feature, an audio recording of your speech and the transcript produced from it.
(b) Contact data — where you choose to submit your session to us, your name, email address and organisation.
(c) Account data — for client users, the name, email address and permissions associated with your account.
(d) Technical data — IP address, browser user agent, time zone and event timestamps.

A public Discovery session does not require an account, and we do not request contact data until the end of a session. We do not request payment card data, and we do not ask you to provide special category data as defined in Article 9 of the UK GDPR.

3. Purposes and lawful bases

We process personal data for the following purposes, relying on the lawful bases stated:

(a) To operate a Discovery session and produce your requirements document, and to respond to you where you submit it — Article 6(1)(b), steps taken at your request prior to entering into a contract; or, where no contract is contemplated, Article 6(1)(f), our legitimate interest in responding to enquiries about our services.
(b) To administer accounts and provide the service to client organisations — Article 6(1)(b), performance of a contract.
(c) To maintain the security, availability and integrity of the service, including the prevention and investigation of misuse — Article 6(1)(f), our legitimate interest in protecting the service and its users.
(d) To comply with our legal obligations and to establish, exercise or defend legal claims — Article 6(1)(c) and Article 6(1)(f).

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights. You may object to such processing as described in section 8.

4. Automated processing

Compass uses artificial intelligence to conduct the conversation and to generate your requirements document. That processing produces a document for your use; it does not constitute a decision producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 of the UK GDPR. Under our agreements with our AI providers, material submitted through Compass is not used to train their models, and we do not use it to train models of our own.

5. Recipients

Personal data is accessible to authorised Yozu personnel for the purposes in section 3. We also engage processors who act only on our documented instructions under written terms compliant with Article 28 of the UK GDPR, in the following categories: hosting and infrastructure; artificial intelligence processing; speech transcription; email delivery; and error monitoring. We do not sell personal data, and we do not disclose session content to other clients or prospects. We may disclose personal data where required by law or by a competent authority.

6. International transfers

Compass is hosted within the European Economic Area. Certain processors are established outside the United Kingdom. Where personal data is transferred outside the UK, we rely on adequacy regulations made under the Data Protection Act 2018 or, where no such regulations apply, on the International Data Transfer Agreement or Addendum issued by the Information Commissioner, together with any supplementary measures required.

7. Retention

(a) Audio recordings are deleted 90 days after the session to which they relate is completed. The transcript is retained as session content.
(b) Sessions that are started but in which no content is submitted are deleted after 7 days.
(c) Technical diagnostic records are retained for 30 days.
(d) Session content, requirements documents and contact data are retained for the duration of our engagement with you and thereafter for so long as is necessary for our legitimate business purposes, including the establishment, exercise or defence of legal claims, after which they are deleted. You may request erasure at any time as described in section 8.

8. Your rights

Subject to the conditions and exemptions in UK data protection law, you have the right to:

(a) request access to your personal data;
(b) request rectification of inaccurate or incomplete data;
(c) request erasure;
(d) request restriction of processing;
(e) object to processing carried out on the basis of legitimate interests;
(f) request portability of data you have provided to us; and
(g) withdraw consent, where we rely on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact [email protected]. We will respond within one month of receipt, which may be extended by a further two months where a request is complex. We may request information reasonably necessary to confirm your identity.

9. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, as required by Article 32 of the UK GDPR. Those measures include encryption of session content, contact data and account data in transit and at rest, and restriction of access to authorised personnel. Further information is set out on our security page.

10. Cookies

Compass sets only cookies that are strictly necessary for the service to function: a cookie identifying your session so that a conversation can be resumed on the same device, a cookie recording your display preference, and a cookie set by our provider of automated-traffic protection. Compass does not use advertising, analytics or tracking cookies.

11. Complaints

If you are dissatisfied with how we have processed your personal data, we ask that you contact us first so that we may address the matter. You are also entitled to lodge a complaint with the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (ico.org.uk).

12. Changes to this notice

We may amend this notice from time to time. The version number and date at the head of this page indicate when it was last revised. Processing of personal data collected through the wider Yozu website is described at yozu.co.uk/privacy-policy.