Privacy Policy
Last updated: 22 July 2026
Comply Correct ("the platform") is operated by Correct Group Ltd ("we", "us"), a UK company. This policy explains what personal data the platform processes, why, and your rights. For most data on the platform we act as a processor on behalf of the client organisation that invited you; for platform accounts, enquiries and operations we act as controller.
What we process
- Account & sign-in data — your name, work email address and organisation, received from your organisation's Microsoft or Google identity provider when you sign in. We never see or store your password.
- Compliance content — the requirements, controls, documents, evidence, risks, incidents and related records your organisation manages on the platform. Documents themselves normally remain in your organisation's own storage (SharePoint / Google Drive); the platform stores references.
- Supplier questionnaire data — where a supplier completes an assessment, the answers, uploaded evidence and contact details provided, shared with the requesting client organisation as stated in the consent shown at submission.
- Usage & audit records — actions taken on the platform are logged (who did what, when) as part of the platform's own security and your organisation's audit trail.
- Enquiries — details submitted through the contact form are used solely to respond.
Where it lives
The platform is hosted on servers in the United Kingdom. Automated emails are sent via Microsoft 365. Backups are encrypted before leaving the server. Where a client organisation enables AI assistance, selected content is processed by the AI provider configured by that organisation (or by Correct Group's UK-hosted service where the organisation has opted in); AI providers are not permitted to train on this data.
Retention
Compliance content is retained while the client organisation's workspace remains active, and deleted or returned on termination in line with our agreement with that organisation. Enquiry details are kept only as long as needed to handle the enquiry.
Your rights
Under UK GDPR you may request access, rectification, erasure, restriction or portability of your personal data, and you may complain to the Information Commissioner's Office. Where we are processor, we will refer requests to the controller (the organisation that invited you) and assist them. Contact: info@correct-group.co.uk.
Cookies
The platform uses only strictly necessary cookies: a session cookie for signed-in users and, on the enquiry form, Cloudflare Turnstile's bot-protection cookie. No advertising or cross-site tracking cookies are used.