Privacy Notice

Compass is a grant application service operated by Funky Monkey Barry Ltd (trading as "Compass"), based in the United Kingdom. Funky Monkey Barry Ltd is the data controller for personal data processed through the Compass portal and decides how and why that data is used.

For any privacy question or to exercise your rights, contact us through the contact form or by replying to any Compass email.

• Account data (name, email address, login credentials, role) — to create and secure your account and provide the portal. Legal basis: performance of our contract with you.
• Charity and contact data (charity name and number, contact name, email, phone, address, financial figures, uploaded documents such as accounts and redacted bank statements) — to match you to funders and prepare and submit applications on your behalf. Legal basis: performance of our contract.
• Correspondence (messages, support and enquiry form submissions) — to answer you and keep a record of the service provided. Legal basis: contract and legitimate interests.
• Billing and subscription data (plan, status, renewal dates, subscription and customer identifiers received from our payment processor) — to manage your subscription. Legal basis: contract and legal obligation. Card details are never collected or stored by us; they are handled directly by Stripe, our payment processor.
• Technical and usage data (IP address, device and browser information, log and error data) — for security, fraud prevention, and improving reliability. Legal basis: legitimate interests.
• Marketing communications where you have opted in. Legal basis: consent, which you may withdraw at any time.

• Stripe Payments Europe, Ltd., our payment processor, for payment processing, subscription management, tax calculation, invoicing and refunds.
• Service providers and sub-processors — hosting, database, email and error monitoring providers who process data on our instructions.
• Funders — only the information needed to submit an application you have approved.
• Professional advisers (legal, accounting) and authorities where we are required to disclose by law.

We never sell your personal data.

Some providers may process data outside the UK or EEA. Where that happens we rely on an adequacy decision or on UK/EU Standard Contractual Clauses together with appropriate additional safeguards.

Account, charity and application records are kept for the life of your subscription and for up to six years afterwards, to meet legal, tax and funder audit obligations. Enquiry messages are kept for up to two years. Technical logs are kept for up to twelve months. Data is deleted or anonymised once it is no longer needed.

Subject to UK GDPR, you have the right to access your data; to have inaccurate data corrected; to request erasure; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent. Contact us and we will respond within one month. You may also complain to the UK Information Commissioner's Office (ico.org.uk).

We apply appropriate technical and organisational measures, including encryption in transit, access controls, row-level database security so each charity can only see its own records, and private document storage with time-limited access links.

We use strictly necessary cookies and local storage to keep you signed in and to keep the portal secure. These are required for the service to function. We do not use advertising cookies. Any analytics we add will be limited to aggregated usage measurement, and you can control cookies through your browser settings.

We may update this notice from time to time. The date at the top shows when it was last revised.