Exercise My Rights — Trust Centre — Compass IoT
Trust Centre

Trust Centre

Exercise my rights

Your rights in relation to your personal data under the UK General Data Protection Regulation (UK GDPR) and EU General Data Protection Regulation (EU GDPR), Chapter 3 — Rights of the data subject.

Based on UK & EU GDPR Chapter 3 · Articles 15–22

Who these rights apply to. These rights apply to individuals whose personal data is processed by Compass IoT — including platform users, contacts of customer organisations, and anyone who has provided personal data to us directly. Not all rights apply in all circumstances. Where an exemption or limitation applies, we will explain this when responding to your request.
Art. 15 Right of access

You have the right to obtain confirmation of whether Compass IoT processes personal data about you, and if so, to receive a copy of that data. You can also request information about the purposes of processing, the categories of data held, who it has been shared with, and how long it will be retained.

Applies under: UK GDPR · EU GDPR

Art. 16 Right to rectification

You have the right to have inaccurate personal data about you corrected without undue delay. You also have the right to have incomplete personal data completed — including by means of providing a supplementary statement.

Applies under: UK GDPR · EU GDPR

Art. 17 Right to erasure

You have the right to request that we delete your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent and there is no other legal basis for processing, where you have objected to processing and there are no overriding legitimate grounds, or where processing is unlawful. This right is also known as the "right to be forgotten."

Applies under: UK GDPR · EU GDPR

Art. 18 Right to restriction of processing

You have the right to request that we restrict how we use your personal data in certain circumstances — for example, while the accuracy of the data is being contested, where processing is unlawful but you prefer restriction to erasure, or where you have objected to processing and we are assessing whether our legitimate grounds override your interests.

Applies under: UK GDPR · EU GDPR

Art. 20 Right to data portability

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may also request that we transmit that data directly to another controller where technically feasible.

Applies under: UK GDPR · EU GDPR

Art. 21 Right to object

You have the right to object at any time to processing of your personal data based on legitimate interests or the performance of a task in the public interest. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless processing is necessary for the establishment, exercise, or defence of legal claims. You have an absolute right to object to processing for direct marketing purposes.

Applies under: UK GDPR · EU GDPR

Art. 22 Rights related to automated decision-making

You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects or similarly significant effects concerning you. Where such processing occurs, you have the right to request human intervention, to express your point of view, and to contest the decision.

Applies under: UK GDPR · EU GDPR

Making a request

How to exercise your rights

To exercise any of the rights listed on this page, contact our privacy team at trust@compassiot.com. Please include enough detail to allow us to identify you and understand the nature of your request.

We will respond within 30 days of receiving a verified request. In complex cases, this period may be extended by a further two months — we will notify you if this is necessary and explain why.

  • Requests are free of charge. We may charge a reasonable fee or decline to act on requests that are manifestly unfounded or excessive.
  • We may need to verify your identity before processing your request. We will ask for the minimum information necessary to do this.
  • Where a right is subject to an exemption or limitation under applicable law, we will explain this clearly in our response.
  • If you made your request on behalf of another individual, we will require evidence of your authority to act on their behalf.

Article 77

Right to lodge a complaint

If you are not satisfied with how we have handled your personal data or responded to a rights request, you have the right to lodge a complaint with the relevant supervisory authority.

United Kingdom — the supervisory authority is the Information Commissioner's Office (ICO). You can report a concern at ico.org.uk or by calling 0303 123 1113.

European Union — the supervisory authority is the data protection authority in the EU member state where you reside, work, or where the alleged infringement took place. A directory of EU supervisory authorities is available from the European Data Protection Board.

Australia — the supervisory authority is the Office of the Australian Information Commissioner (OAIC). Under the Privacy Act 1988, individuals may lodge a complaint at oaic.gov.au.

California, United States — the supervisory authority is the California Privacy Protection Agency (CPPA). California residents who believe their privacy rights under the CCPA have been violated may submit a complaint via the CPPA's online complaint form at cppa.ca.gov. The CPPA enforces the CCPA on behalf of Californians but does not represent individual consumers. You can also contact the CPPA by phone on 916-572-2900.

We encourage you to contact us directly in the first instance — we aim to resolve all concerns promptly and to your satisfaction.

Exercise a right

Privacy team

Submit a data subject request or ask a question about your rights.