Privacy Policy

Privacy Policy

1. Data Controller Stichting COMPASS ("COMPASS"), a foundation established under the laws of the Netherlands, is the data controller for personal data collected and processed through this website.

  • Legal Entity: Stichting COMPASS

  • Registration: Dutch Chamber of Commerce (Kamer van Koophandel / KVK)

  • Contact Email: directors@compass-investigations.org

  • Platform Provider: This website is hosted and powered by Squarespace Ireland Ltd. (Le Pole House, Ship Street Great, Dublin 8, Ireland).

2. Personal Data Collected via Squarespace

  • Form Submissions: Contact forms, intake questionnaires, and newsletter sign-ups collect names, organizational affiliations, email addresses, and message contents. These submissions are routed through Squarespace servers and delivered directly to COMPASS.

  • Log and Technical Files: Squarespace automatically records server log data when you load the site, including IP addresses, browser specifications, device identifiers, network requests, and timestamps.

  • Usage Data: Aggregated information detailing navigation pathways, external referrers, search keywords, and page view metrics.

3. Purposes and Legal Bases for Processing Pursuant to Article 6 of the General Data Protection Regulation (GDPR):

  • Communications & Pre-Contractual Measures (Art. 6(1)(b)): Processing form submissions to coordinate advisory services, research initiatives, and institutional collaborations.

  • Legitimate Interests (Art. 6(1)(f)): Ensuring server stability, defending against DDoS attacks, and analyzing high-level traffic via Squarespace infrastructure.

  • Statutory Compliance (Art. 6(1)(c)): Retaining relevant correspondence and records required under Dutch foundation governance and fiscal rules.

4. Data Processors and International Transfers

  • Squarespace Infrastructure: Squarespace processes data on behalf of COMPASS as a data processor under a GDPR-compliant Data Processing Addendum (DPA).

  • Transfers Outside the EEA: Where Squarespace transfers personal data outside the European Economic Area (e.g., to its parent company, Squarespace, Inc. in the United States), such transfers are governed by the EU-U.S. Data Privacy Framework or European Commission Standard Contractual Clauses (SCCs).

5. Retention Periods

  • Inquiry data received through Squarespace forms is retained for up to two years following the close of communications, unless an ongoing engagement or statutory compliance rule dictates longer retention.

  • Technical logs generated by Squarespace are purged or anonymized in accordance with Squarespace’s standard retention schedules.

6. Individual Rights Under the GDPR, individuals have the right to request access to, rectification of, or erasure of their personal data held by COMPASS. You may also object to processing, request restriction of processing, or lodge a formal complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).