Privacy Policy
This policy explains how Crimson Compass Advisory Limited ("we", "us", "our") collects and uses personal data. It covers:
(a)visitors to siteassure.app and crimson-compass.com;
(b)people who request a SiteAssure demo or contact us;
(c)users of the SiteAssure platform;
(d)clients of our advisory, strategy and coaching services; and
(e)business contacts we approach about our services.
We comply with the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations 2003.
1. Who we are
| Controller | Crimson Compass Advisory Limited |
|---|---|
| Company number | 16935590 (registered in England and Wales) |
| Registered office | Silverstream House, 45 Fitzroy Street, London W1T 6EB |
| ICO registration | ZC206036 |
| info@crimson-compass.com | |
| Phone | 01256 410642 |
We are not required to appoint a Data Protection Officer. Please send any privacy questions to info@crimson-compass.com.
2. SiteAssure: who controls the data in the platform
When an organisation subscribes to SiteAssure, it decides which information about its staff and sites goes into the platform. That organisation is the controller of that information, and we process it on its behalf under our Data Processing Agreement.
If you use SiteAssure through your employer and want to access, correct or delete information held about you in the platform, please contact your employer first. We will help them respond. This policy covers the personal data we decide how to use ourselves, such as account administration, support and billing.
3. Personal data we collect
When you visit our websites
(a)siteassure.app uses Vercel Web Analytics, which records aggregated, anonymised visit data (pages viewed, referring site, country and device type) without cookies and without identifying you.
(b)Our hosting provider keeps technical logs, including IP addresses and browser details, to keep the websites secure and working.
(c)Some of our letters contain a QR code linking to a page such as siteassure.app/l/b7. This tells us which batch of letters a visit came from. It does not identify you unless you go on to submit the demo request form.
When you request a demo or contact us
(a)Your name, company, job role, number of sites, work email address and, if you give it, phone number.
(b)If you arrived through a letter QR code, the batch reference.
(c)If you use the contact form on crimson-compass.com: your name, email address, company (if you give it), the topic you choose and your message.
(d)The content of any emails, calls or messages you send us.
When you use SiteAssure
(a)Account details: name, work email address, role and site assignments.
(b)Activity records: sign-ins, evidence uploaded, actions raised or closed, and verifications.
(c)Records of reminder and escalation emails sent to you.
(d)Support requests you send us.
When you are a client of our advisory, strategy or coaching services
(a)Contact details, your role and information about your organisation.
(b)Notes, documents and correspondence from the engagement.
(c)Billing details for invoicing.
(d)Coaching conversations can sometimes involve sensitive information, such as information about your health or wellbeing. We only record that kind of information with your explicit consent.
When we approach you about our services
(a)Your name, job title, business address and business contact details, taken from public sources such as Companies House, company websites and professional directories.
4. How we use personal data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to demo requests and enquiries, and sending you a confirmation email | Legitimate interests, or steps taken at your request before entering into a contract |
| Providing SiteAssure accounts, sign-in, reminder emails and support | Contract with your employer; legitimate interests in running the service |
| Delivering advisory, strategy and coaching services | Contract |
| Recording sensitive information shared in coaching | Explicit consent |
| Invoicing and keeping accounting records | Contract; legal obligation |
| Contacting business contacts about our services by post or email | Legitimate interests |
| Website analytics and security | Legitimate interests |
| Meeting legal obligations and defending legal claims | Legal obligation; legitimate interests |
4.1Where we rely on legitimate interests, we have balanced our interests against yours. You can object at any time (see section 8).
4.2We only send marketing emails to people at companies and other corporate bodies, never to sole traders or private individuals without their consent. Every message identifies us and lets you opt out. If you ask us to stop, we will, and we keep a minimal record so we do not contact you again.
4.3You can withdraw consent for sensitive coaching information at any time by telling your coach or emailing us.
5. Who we share personal data with
We do not sell personal data. We use these service providers, who process personal data for us under contract:
| Provider | What they do | Where |
|---|---|---|
| Vercel Inc. | Hosting for our websites and the SiteAssure app; anonymised web analytics | United States and global edge network |
| Supabase Inc. | SiteAssure database, sign-in and file storage | Central EU (Frankfurt) |
| Resend Inc. | Delivering contact form and demo request messages, demo confirmations, sign-in emails and SiteAssure notifications | Ireland (EU) |
| HubSpot, Inc. | Managing enquiries, client relationships and business contacts | EU and United States |
We also use business email and office software providers, and may share information with our accountants and legal advisers, with regulators or law enforcement where the law requires it, and with a buyer if our business is sold.
siteassure.app loads an icon font from the jsDelivr content delivery network, which receives your IP address in order to deliver the file.
6. International transfers
6.1Transfers to the European Economic Area are covered by UK adequacy regulations.
6.2Where personal data goes to the United States or another country without UK adequacy, we rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the International Data Transfer Agreement or Addendum issued by the Information Commissioner.
6.3You can ask for details of these safeguards at info@crimson-compass.com.
7. How long we keep personal data
| Data | How long |
|---|---|
| Demo requests and enquiries | 12 months from last contact, unless you become a client |
| Business contacts we approach | 12 months from last contact; on opt-out we keep only what is needed to avoid contacting you again |
| SiteAssure account and platform data | For the subscription, then a 30-day export window, then deleted within 90 days |
| Advisory and coaching engagement records | 6 years after the engagement ends |
| Coaching session notes | 12 months after the coaching engagement ends, or sooner if you ask |
| Invoices and accounting records | 6 years from the end of the financial year they relate to |
We may keep data for longer where the law requires it or where it is needed to deal with a legal claim.
8. Your rights
| Right | What it means |
|---|---|
| Access | Get a copy of the personal data we hold about you |
| Rectification | Have inaccurate or incomplete data corrected |
| Erasure | Have your data deleted where we no longer have a reason to keep it |
| Restriction | Ask us to limit how we use your data |
| Portability | Receive data you gave us in a machine-readable format |
| Objection | Object to processing based on legitimate interests, and stop direct marketing at any time |
| Withdraw consent | Where we rely on consent, withdraw it at any time |
To use any of these rights, email info@crimson-compass.com with "Data request" in the subject line. We will respond within one month, and there is normally no charge. We may need to confirm your identity first.
9. Automated decisions
We do not make decisions about people based solely on automated processing that have legal or similarly significant effects. SiteAssure calculates compliance statuses such as due soon and overdue, but these describe tasks, not people, and decisions remain with the organisation using SiteAssure.
10. Cookies
10.1siteassure.app and crimson-compass.com do not use cookies. Our web analytics works without them.
10.2The SiteAssure app at app.siteassure.app uses cookies that are strictly necessary to keep you signed in securely. They cannot be switched off without breaking sign-in, so no consent is needed for them.
10.3We do not use advertising or tracking cookies. If that changes, we will ask for your consent first.
11. Security
We protect personal data with encryption in transit and at rest, role-based access controls in SiteAssure, access limited to people who need it, and procedures for detecting and responding to data breaches. If a breach is likely to put your rights at risk, we will notify the ICO within 72 hours and tell you where the law requires it.
12. Children
Our services are for businesses and adults. We do not knowingly collect personal data from anyone under 18, and we will delete it promptly if we find we have.
13. Complaints
If you are unhappy with how we have handled your personal data, please email info@crimson-compass.com with "Privacy complaint" in the subject line. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.
If you are still not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
14. Changes to this policy
We will update this policy when our services or the law change. The date at the top shows the latest version. We will email SiteAssure account holders about significant changes. The current version is always available at siteassure.app/privacy and crimson-compass.com/privacy.