Privacy policy.

1. PROTECTION OF PRIVACY & PERSONAL INFORMATION

1.1 Purpose: At CompassRock International, we’re committed to respecting and protecting your privacy and personal information. This Privacy Policy sets out how and for what purpose we will process personal information we collect from or about you, or which you provide to us. Please read this notice carefully to understand why data is being collected and what we do with that information.

1.2 Third Party Websites: Our website and services may contain links to independent websites that are not provided by us. Such independent sites are not under our control, and we are not responsible for and have not checked and approved their content or their privacy policies.

1.3 Legislation: We will, at all times, process your personal information in accordance with all applicable laws. For the purpose of the Data Protection Act 2018 and UK General Data Protection Regulation (UK-GDPR), the data controller is CompassRock Real Estate Ltd, a company registered in England & Wales under registration number 13506164, with a registered address at Flat 2, 25 Hyde Park Gardens, London, W2 2LZ.

1.4 ICO Registration: CompassRock has registered with the Information Commissioner’s Office (under number ZB255204). The details of our registration are as follows:

1.4.1 Date First Registered: 29/10/2021

1.4.2 Data Controller: CompassRock Real Estate Ltd

1.4.3 Address: Flat 2, 25 Hyde Park Gardens, London, W2 2LZ

2. WHAT INFORMATION WILL WE COLLECT FROM YOU?

2.1 Name & Contact Details: Full name and contact details (including phone number, email and postal address).

2.2 Identity Info: Information relating to your identity where we are required by law to collect this in order to comply with the Money Laundering Regulations 2017 and the Immigration Act.

2.3 Close Connections: Information on your close connections where we are required to conduct conflicts of interests under regulatory obligations.

2.4 Banking: Your banking details where required, such as where you are letting a property or, where renting, to return deposits and arrange for rental payments.

2.5 Accessibility: Information on any access requirements you have to enable us to find suitable properties for you, which may consist of special category personal data comprising details of any disability or other health information about you.

2.6 Marketing: Details about your areas of interest where we wish to send you marketing information about similar products and services.

2.7 Usage: Usage information about your visits to our website (which enable our website to remember information about you and your preferences) and use of our site. This may include information about your visit, such as:

2.7.1 The full Uniform Resource Locators (URL).

2.7.2 Clicks through to and from our site (including date and time).

2.7.3 Products you viewed or searched for.

2.7.4 Page response times.

2.7.5 Download errors.

2.7.6 Length of visits to certain pages.

2.7.7 Page interaction information (such as scrolling, clicks, and mouse-overs).

2.7.8 Methods used to browse away from the page.

2.7.9 Any phone number used to call our customer service number.

2.8 Technical Information: Other technical information, including:

2.8.1 What devices you use to connect to our App.

2.8.2 Device location data where this function is not disabled by you on your device.

2.8.3 The Internet protocol (IP) address used to connect your computer to the Internet.

2.8.4 Your login information.

2.8.5 Browser type and version.

2.8.6 Time zone setting.

2.8.7 Browser plug-in types and versions.

2.8.8 Operating system and platform.

2.9 Communications: Your communications with us, including a record of the email or telephone correspondence created when you contact us as part of a product or service query.

2.10 Legal Obligations: Where we need to collect personal data by law (for example to meet our obligations to prevent fraud and money laundering) or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

3. HOW MAY WE COLLECT YOUR PERSONAL INFORMATION?

3.1 Contact Us: By submitting a request via the ‘Contact’ facility on our website for us to contact you.

3.2 Correspondence: Corresponding with us by telephone, email, letter or other means.

3.3 Service Application: Applying for a service, e.g. registering with us to find a property, requesting a property viewing, entering into a tenancy agreement.

3.4 Marketing: Registering to receive our marketing information about our services and properties.

3.5 Job Application: When you submit a job application to us we will collect your contact details and any other information that you provide in the application.

3.6 Website: We may collect information about your equipment, browsing actions and pattern when visiting our website. We collect this information by using limited cookies, server logs and other similar technologies. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the website may become inaccessible or not function properly. Please note that our partners may also use cookies, over which we have no control.

3.7 Verbal Discussion: In discussion with one of our members of staff.

3.8 Feedback & Surveys: By participating in feedback surveys, providing a review of services, or by providing contact details offline.

3.9 Credit Reference Agencies: Information we receive from other sources, such as information from companies we use to verify your identity and/or prevent fraud, such as credit reference agencies (please note such companies may record the details of the search), electoral register and credit information, in accordance with our legal obligations.

3.10 HMRC: We may also receive information from third parties who contact us, such as Her Majesty’s Revenue and Customs (HMRC), The Department for Work and Pensions (DW) or the police or other government agencies.

3.11 Publicly Available Sources: We may also collect personal information about you from publicly available sources, such as LinkedIn or other social media and Companies House.

3.12 Customer Service: Please note calls may be recorded in order to monitor the quality of customer service or for training purposes.

4. ON WHAT BASIS CAN WE PROCESS YOUR PERSONAL INFORMATION?

The legal grounds under data protection legislation for processing your personal data are as follows:

4.1 Contract Fulfilment: It is necessary for the performance of a contract to which you are a party, or to take steps prior to entering into a contract with you for us to provide you with our products and services. For example, when you rent a home with us we will process your information to administer your tenancy agreement.

4.2 Explicit Consent: You have given us explicit consent to the processing of your personal data for one or more specific purposes, namely 1) where you have given us consent to receive electronic marketing by us, and/or 2)

to process your Special Category Personal Data described above. You do not need to provide us with marketing consent in order to receive our services.

4.3 Legitimate Interests: It is necessary for the purposes of our legitimate interests, except where our interests are overridden by the interests, rights or freedoms of affected individuals (such as you). To determine this we shall consider a number of factors, such as what you were told at the time you provided your data, what your expectations are about the processing of the data, the nature of the data, and the impact of the processing on you. Our legitimate interests include processing necessary information to improve and to promote our services and products, to better understand our customers’ interests and knowledge of the property market, and to administer the technical aspects of our service and products.

4.4 Legal Obligation: Where we need to comply with a legal obligation. For example, we are required by law to carry out Right to Rent checks.

4.5 Protection: In rare circumstances where we need to protect your interests (or someone else’s interests); and/or where it is needed in the public interest or for official purposes.

5. HOW WILL YOUR PERSONAL INFORMATION BE USED?

5.1 Fulfilment of Obligations: To fulfil our obligations to you when providing you with our property services, such as determining your requirements and eligibility for the properties available, to schedule a viewing, to enter into a tenancy agreement and carry out our contractual obligations.

5.2 Third Party Services: To share your information with others where necessary to fulfil our property services for you or where acting as agent for a third party on your behalf.

5.3 Compliance: To comply with our statutory and regulatory obligations, including verifying your identity, prevention of fraud and money laundering and to assess your credit worthiness.

5.4 Communication: To communicate with you during the course of providing our services, for example with your enquiries and requests.

5.5 Strategic Planning: For statistical purposes so we can analyse performance to help us manage our business and plan strategically for the future.

5.6 Marketing: To provide you, or to enable third parties to provide you, with information about goods, services or events we feel may interest you, where you have provided permission for us to do so or, if you are an existing customer only, where we choose to contact you by electronic means (including e-mail or SMS) with information about our own goods and services similar to those which you have already obtained from us or negotiated to obtain from us. For those marketing messages you can unsubscribe at any time.

5.7 Customer Service Improvement: To track and analyse customer interactions and to improve our website, services, marketing, customer relationship and experiences.

5.8 Notifications: To notify you about important changes or developments to our products and services.

5.9 Presentation: To ensure that content on our site is presented in the most effective manner for you and for your computer/device(s).

6. HOW DO WE ENSURE THE SECURITY OF YOUR PERSONAL INFORMATION?

6.1 Security Measures: We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to use your data. They will only process your personal data on our instructions and are subject to a duty of confidentiality.

6.2 Data Storage: Your data will be held on secure servers within the UK and the European Economic Area (‘EEA’) through RealPage, a property management software supplier, with all reasonable technological and operation measures put in place to safeguard it from unauthorised access. Where possible any identifiable information will be encrypted or minimised.

6.3 Security Breaches: We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

6.4 Staff Training: As part of our data security measures we ensure that our employees receive appropriate training, and we have data protection policies and procedures in place to support our compliance.

7. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION FOR?

7.1 Customers: We will keep your personal data for as long as you are a customer of ours. Thereafter, we may keep your data for up to seven years after termination or expiry of your tenancy agreement to enable us to respond to any questions or complaints and to maintain records where we are legally required to do so. We may keep your data for longer than seven years if we cannot delete it for legal, regulatory or technical reasons.

7.2 Non-Identifiable: In some circumstances we may anonymise or pseudonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

8. WHO WILL YOUR PERSONAL INFORMATION BE SHARED WITH?

8.1 Third Party Service Providers: We will pass your details to the following organisations (our ‘data processors’) who carry out certain activities on our behalf as part of our providing our services: payment service providers, property management agents, credit reference and fraud prevention agencies, cloud computing host providers, technical support service providers, local authorities, insurance providers, third party contractors, solicitors, credit reference agencies, utility providers, HMRC, email marketing services, third party survey companies etc.

8.2 Other Third-Party Organisations: We will also disclose your personal information to third parties:

8.2.1 In the event that we sell or buy any business or assets, we will disclose your personal data to the prospective seller or buyer of such business or assets.

8.2.2 If our company or substantially all of our assets are acquired by a third party, in which case personal data held by us about our customers will be one of the transferred assets.

8.2.3 If we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation, or to protect the rights, property, or safety of our company, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

8.3 Consent: We will not share your information with third parties for marketing purposes without first obtaining your prior consent.

9. YOUR RIGHTS

9.1 The Right to Be Informed: You have the right to be provided with clear, transparent and easily understandable information about how we use your personal information and your rights. This is why we’re providing you with the information in this Privacy Policy.

9.2 The Right of Access: You have a right to request a copy of the personal information we hold about you, known as a data subject access request. We ask that such requests are made in writing.

9.3 The Right to Erasure: You can ask us to delete or remove personal data where there is no compelling reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where you have withdrawn consent for us to process it (as explained below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

9.4 The Right to Rectification: You’re entitled to have your information corrected if it’s inaccurate or incomplete.

9.5 The Right to Withdraw Your Consent: You have the right at any time to withdraw any consent you have given us to process your personal data. Please note that if you withdraw your consent it will not affect the lawfulness of any processing of your personal data that we have carried out before you withdrew your consent.

9.6 The Right to Restrict or Object to Processing: You can ask us to suspend the way in which we are using your information in certain scenarios, or object to our processing your data where we are relying on a legitimate interest ground (or those of a third party) and you feel it impacts on your fundamental rights and freedoms, or where we are processing your personal data for direct marketing purposes. In some cases where you object, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. Please note that if you want us to restrict or stop processing your data this may impact on our ability to provide our services. Depending on the extent of your request we may be unable to continue providing you with our service.

9.7 The Right to Data Portability: In the event that we process your data by automated means where you have either provided us with consent for us to use your information or where we used the information to perform a contract with you, you have the right to request that we send to you, or to another organisation, a copy of the personal data we hold about you, for example when you are dealing with a different service provider. If you would like us to move, copy, or transfer your information please let us know by email. We will respond to you within one month after assessing whether or not this is possible, taking into account the technical compatibility with the other organisation in question.

10. ACCESS TO YOUR PERSONAL INFORMATION, CORRECTION & UNSUBSCRIBING

10.1 If you would like to communicate with us about any of the rights mentioned above, or if you have any other questions about the matters mentioned in this Privacy Policy, please contact us using one of the following options:

• Website: https://www.compassrock.com/contact

• Email: info@compassrock.com

• Post: FAO Data Protection Officer, CompassRock International, 83 Baker Street, London, W1U 8AG.

10.2 It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

11. COMPLAINTS ABOUT THE USE OF YOUR PERSONAL INFORMATION

11.1 If you wish to raise a complaint on how we have handled your personal data, you can contact us to request that the matter is investigated by writing to the Data Protection Officer, CompassRock International, 83 Baker Street, London, W1U 8AG.

11.2 If you are not satisfied with our response or believe we that we are not processing your personal information in accordance with the law, you can make a complaint to the UK data protection regulator, the Information Commissioner’s Office. Further details can be found at www.ico.org.uk or 0303 123 1113.

12. CHANGE OF PURPOSE

12.1 We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

12.2 If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

12.3 Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

13. CHANGES TO THIS PRIVACY STATEMENT

13.1 We reserve the right to amend this privacy statement at any time. You should therefore revisit this Privacy Policy on a regular basis to ensure you are familiar with its terms and any changes that are made.