Privacy Policy

Version 26.9 — effective 30 September 2026

Maps United Ltd (“Maps United”, “we”, “us”) makes and runs Kompass BMS, a business management platform for surveying and geospatial firms. This policy explains what personal data we collect, why, and what your rights are.

We have written it in plain English. If anything is unclear, email privacy@kompassbms.com.

1. Who we are

Maps United Ltd is the data controller for the personal data we process for our own purposes, as explained in section 2.

• Company number: 07744712 (England and Wales)
• Registered office: Harrison House Sheep Walk, Langford Road, Biggleswade, Bedfordshire, SG18 9RB, United Kingdom
• Privacy contact: privacy@kompassbms.com
• ICO registration: ZB026454

2. Two roles: when we are the controller and when we are not

We handle personal data in two different roles. Which one applies depends on why the data is being processed, not on where it sits.

We are the controller for data about people we deal with directly for our own purposes: visitors to kompassbms.com, people who book a demo or contact us, newsletter subscribers, and the people at customer organisations who manage the account, receive invoices or raise support requests. This policy covers that data.

We are a processor for the data that customer organisations and their staff put into Kompass BMS: projects, timesheets, staff records, clients, proposals, invoices and so on. That data belongs to the customer, which decides how it is used. We process it only on the customer’s instructions, under the data protection terms in our Terms and Conditions and the Subprocessor List. The same applies when a customer sends us that kind of data outside the platform, for example a staff spreadsheet attached to a support ticket or a data file supplied for migration at onboarding. It remains the customer’s data and we handle it under their instructions, even though it arrives by email.

If you use Kompass BMS as an employee or contractor of a customer, or as one of a customer’s clients using the Client Portal, the customer organisation is the controller of your data. Questions about how your data is used inside Kompass BMS, and requests to access or correct it, should go to them. We will help them respond.

3. What we collect and why

What	Where it comes from	Why we use it	Legal basis
Name, work email, phone, company, job title	Demo bookings, contact forms, newsletter sign-up, emails and calls with us, professional networks	Responding to enquiries, running demos, sending information you asked for	Legitimate interests
Account holder, administrator and billing contact details	Customer Order Forms, onboarding	Setting up and running the customer account, invoicing, credit control, service notices	Legitimate interests (our contract is with your organisation); contract, where you are a sole trader contracting personally
Invoices and payment records	Our billing and accounting systems	Keeping the accounting and tax records the law requires	Legal obligation
Support requests: your correspondence with us and ticket records	Emails to support@kompassbms.com, calls to our support line	Resolving your issue, keeping a record of what was done	Legitimate interests
Voicemails and caller numbers on the support line	Our phone provider	Returning your call	Legitimate interests
Marketing preferences and email link clicks	Our CRM and email tools	Sending product news and updates to people in the sector we serve, understanding which topics are useful	Consent (newsletter sign-up); legitimate interests (contacts at corporate customers, with opt-out in every email). Sole traders and individuals: see the paragraph below this table
Website usage data (pages visited, referrer, country, device type, campaign source)	Our analytics tool	Understanding how the site is used and whether campaigns work	Legitimate interests
Server and security logs, including IP addresses	Our hosting and website providers	Keeping the site and platform secure, diagnosing faults	Legitimate interests
Meeting details and, where you agree, recordings	Video calls with us	Running demos and onboarding	Legitimate interests; consent (recordings)
Feature requests and feedback	Our feedback portal	Improving the product	Legitimate interests

Marketing to sole traders and individuals. If you are a sole trader, an individual, or a partner in a partnership that is not a corporate body, we send you marketing only where you have consented, or where you gave us your details during a sale or negotiations for Kompass BMS, the marketing is about our own similar products and services, and you were given a simple way to refuse both when we collected your details and in every message since. An opt-out is always respected.

Where we rely on legitimate interests, ours are running a B2B software business: answering enquiries, supporting customers, keeping our systems secure, and marketing to people who work in the sector we serve. We balance these against your interests and you can object at any time (see section 9).

To set up a customer account we need at least one named administrator and a billing contact; without these we cannot provide the service. To answer an enquiry or support request we need a way to reply to you. Beyond that, what you share with us is up to you.

We do not sell personal data and do not make automated decisions with legal or similarly significant effects. We do not ask for special category data (such as health information) and ask you not to send it to us. If a message to us contains sensitive information we do not need, we will delete it. If we genuinely need it to deal with your request, we will ask for your explicit consent before using it. Sensitive information a customer holds about its own staff inside Kompass BMS is the customer’s data, and section 2 applies.

4. Cookies, analytics and email tracking

Website. kompassbms.com uses only strictly necessary cookies, which are needed for the site to function and do not require consent. We do not use advertising cookies, tracking pixels or third-party ad networks on the website.

For analytics we use Plausible, a privacy-focused tool made by an EU company and hosted in the EU. It uses no cookies, does not track you across sites and does not build a profile of you. It records aggregate statistics: pages viewed, referring site, which campaign brought visitors to the site, approximate country and browser type. Your IP address is not stored and we cannot identify you from it. We rely on the exception in UK law for low-risk statistical analytics. If you would prefer not to be counted, use the analytics opt-out at the bottom of this page. It excludes the browser you are using from the next page load onwards; repeat it on each browser or device, and note that clearing your browser’s site data removes the exclusion.

Email. Marketing emails from us contain tracked links, so we can see which link you clicked. We do not track whether you open our emails. System and transactional emails from Kompass BMS are not tracked.

5. Who we share data with

We use a small number of service providers to run our business. Most process personal data on our behalf, under contracts that require them to protect it and use it only for our purposes. A few act as independent controllers under their own privacy policies; these are marked.

Provider	What for
Google Cloud (Google Cloud EMEA Ltd)	Hosting for our website and platform
Cloudflare	DNS for kompassbms.com
HubSpot	CRM and marketing email
Help Scout	Support tickets
Calendly	Demo and meeting booking
Canny	Feature requests and feedback
Twilio	Support phone line and voicemail
Microsoft 365 (UK tenant)	Email, documents and internal communication
Mailgun	Transactional email (account and system notifications)
Xero	Accounting and invoicing
Mailchimp	Service notices to customer account contacts
Plausible	Website analytics (EU-hosted, cookieless)
Stripe, GoCardless	Card and direct debit payments — independent controllers for payment data
Google Maps Platform	Map display and address lookup inside Kompass BMS, loaded in your browser. Your browser sends the map request, any address you look up and your IP address directly to Google, which acts as an independent controller for those requests

AI tools. We use AI assistants for internal drafting, analysis and code review: Anthropic’s Claude and OpenAI’s ChatGPT, both on business plans with data processing agreements under which our data is not used for model training. From 14 October 2026 we will also use Claude, at the customer’s request, to clean and structure data during customer onboarding; this use is covered in our Subprocessor List. Customer personal data, whether from inside Kompass BMS or received from customers during support and onboarding, is not submitted to ChatGPT. Personal data is never submitted to AI tools on consumer plans.

The providers that process customer data inside Kompass BMS, or that receive it during support and onboarding, are listed with their locations and safeguards in our Subprocessor List.

We will also share personal data where the law requires it, with our professional advisers where necessary, and with a buyer or successor if the business is sold or restructured.

6. Where data is stored and international transfers

Each customer’s primary Kompass BMS database and file storage is held in one Google Cloud region, chosen at onboarding, from the UK, EU, USA and Canada. It is not replicated to other regions. Encrypted backups are held in the EU. Some ancillary processing (support tickets, error monitoring, transactional email, document conversion, AI-assisted onboarding) takes place in the locations given in the Subprocessor List, which may include the USA.

Our own business data (CRM, support, email, accounting) is held with providers in the UK, EU and USA.

Where personal data is transferred outside the UK or EEA, we rely on one of these safeguards:

• an adequacy decision or regulation (for example, transfers between the UK and the EEA);
• the UK–US Data Bridge or EU–US Data Privacy Framework, where the provider is certified;
• the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, included in the provider’s data processing agreement.

Email privacy@kompassbms.com for a copy of the safeguard that applies to a particular provider.

7. How long we keep data

Data	Retention
Enquiry and demo contacts who do not become customers	24 months after last contact
Marketing contacts	Until you unsubscribe or object; we then keep your email address on a suppression list so we do not market to you again
Customer account, contract and billing records	For the contract term, then 6 years (statutory accounting and tax record-keeping, and the limitation period for contract claims)
Support tickets, including their text, screenshots and attachments	24 months after the ticket closes; all of a customer’s tickets are deleted within 30 days of their contract ending, or sooner if the customer asks
Email and Teams correspondence with customers about support and onboarding	24 months after the support or onboarding matter closes; all of a customer’s correspondence is deleted within 30 days of their contract ending, or sooner if the customer asks
Customer data files sent to us for onboarding (exports, migration files, AI-assisted cleansing inputs and outputs)	Deleted from our systems within 30 days of the onboarding task closing, and in any case within 30 days of the contract ending, or sooner if the customer asks. Our AI provider then completes deletion on its side within its standard 30-day period, subject to the exceptions in its published retention policy (legal requirements, abuse prevention)
Voicemails	90 days
Website analytics	Aggregate only, indefinitely
Server and security logs, error monitoring	90 days
Meeting invitations and attendance records	12 months
Meeting recordings	12 months; recordings that show customer data, 30 days from the recording date
Feature requests and feedback	While the request is open, then 24 months

Customer data inside Kompass BMS is retained and deleted in accordance with the customer’s contract (clauses 10.4 and 16 of our Terms and Conditions).

Deletion from our active systems happens on the timetable above. Encrypted backups are separate: they are isolated from normal use, restorable only for disaster recovery, and expire on a fixed schedule (every backup kept for 7 days, one daily backup for 30 days), so deleted data leaves the last backup within 30 days of deletion. If a backup is ever restored, deletions made since it was taken are reapplied.

8. Security

Kompass BMS runs on Google Cloud with encryption in transit and at rest. Multi-factor authentication is enforced for our staff on our cloud infrastructure and business systems and on their access to customer environments. Staff access is role-based and limited to named administrators, and their administrative access to production systems is logged. Backups are encrypted by us before they leave our environment and stored off-site. Kompass BMS is independently penetration tested; the most recent test was completed in May 2026. We notify customers of any confirmed personal data breach affecting their data without undue delay, as set out in our Terms and Conditions.

No system is perfectly secure, and you are responsible for keeping your login credentials safe.

9. Your rights

Under UK GDPR (and EU GDPR where it applies to you) you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct it if it is wrong;
• delete it, where we no longer need it;
• restrict how we use it;
• give it to you in a portable format;
• stop using it for marketing, at any time;
• stop using it where we rely on legitimate interests, unless we have compelling grounds to continue.

Where we rely on consent, you can withdraw it at any time without affecting what was done before.

Email privacy@kompassbms.com. We will respond within one month. We may ask you to confirm your identity first.

Complaints. If you are unhappy with how we have handled your data, email privacy@kompassbms.com (putting “Complaint” in the subject line helps us spot it). We will acknowledge your complaint within 30 days, investigate without undue delay, keep you informed, and tell you the outcome and what we have done about it. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113) at any time, or, if you are in the EU, to your local data protection authority.

10. Children

Kompass BMS and kompassbms.com are business services and are not directed at children, and we do not knowingly collect personal data from anyone under 18 for our own purposes. Customer organisations may record apprentices or trainees under 18 as staff inside Kompass BMS; that data is the customer’s, and section 2 applies.

11. Changes to this policy

We will post any changes here with a new version number and effective date. If a change materially affects how we use your data, we will tell existing customers by email.

Change log

Version	Date	Change
26.9	30 September 2026	Full rewrite. Replaces the previous template policy. Adds controller/processor explanation, purpose and legal-basis table, provider list, transfer safeguards, retention schedule, complaints process, AI tool statement. Removes Google Analytics and advertising sections.

---