Compliance

Compass IoT operates in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). The APPs govern how we collect, use, disclose, store, and provide access to personal information.

Connected vehicle data processed by Compass IoT is anonymised at the point of ingestion — individual drivers are not identified, and we do not hold data in a form that would allow re-identification under standard conditions. Where personal information is collected directly (such as contact details from platform users), it is handled in accordance with our Privacy Policy.

Compass IoT's UK operations are aligned with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The UK GDPR applies to the processing of personal data relating to individuals in the United Kingdom.

Where Compass IoT processes personal data of UK residents, we do so on a lawful basis as defined under UK GDPR Article 6. Data processed in connection with UK customers is stored in UK or EU-equivalent regions and is not transferred outside of the UK without appropriate safeguards.

Compass IoT's operations are aligned with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). The CCPA grants California residents rights over their personal information held by businesses operating in or serving residents of California.

Compass IoT does not sell personal information. We do not share personal information for cross-context behavioural advertising. California residents may exercise their rights by contacting us at the address below.

Compass IoT uses a limited number of third-party subprocessors to deliver the platform. A subprocessor is any third party that processes personal data on our behalf. We conduct due diligence on all subprocessors before engagement and contractually require them to maintain appropriate data protection standards.

We do not sell personal data to any third party. Data shared with subprocessors is limited to what is necessary to provide the service.

Compass IoT receives camera-derived data from third-party vehicle data sources. Where that data contains potentially identifying information — including facial geometry, driver images, or licence plate data — it is anonymised by Compass IoT before it enters our platform. We do not store, process, or transmit raw biometric identifiers. This anonymisation-first approach is the foundation of our compliance posture on biometric data law across all jurisdictions.

Biometric data laws vary significantly across the jurisdictions we operate in. The following reflects our current position across each relevant framework.

The following documents are available depending on your access tier. Email-verified documents require a business email address. On-request documents are available to qualified customers and prospects.