Privacy notice
This notice explains how COMPLY FM LTD uses personal information in connection with Comply.FM.
Who we are
COMPLY FM LTD, company number 17552569, registered office: Studio 9 50-54 St. Pauls Square, Birmingham, England, B3 1QS. Contact support@comply.fm for privacy enquiries. We determine how business-contact, service-administration and security information is used. For customer-uploaded compliance records, we generally process information on the customer organisation’s instructions; that organisation determines the purposes of its records and should provide its own privacy information.
Information we handle
Account and contact details may include your name, work email, optional job title, organisation, role and authorised locations. Sign-in, security and audit records can include account identifiers, IP addresses, times and actions. Customer records may include inspection findings, actions, documents, photographs and the names of people responsible for or completing work. We also handle information you provide when contacting support. Information comes from you, your organisation and its authorised users, service activity and, if you choose it, Google sign-in.
Why we use it
We use information to provide and administer the service, respond to enquiries, authenticate users, enforce permissions, protect accounts and maintain reliable records. For business-contact, service-administration and security information that we control, our legitimate interests are operating a secure business service, supporting approved users and managing business relationships. We consider whether those interests are outweighed by your rights. Where you personally enter a contract with us, we may use information necessary to perform it; we also process information where necessary to meet an applicable legal obligation. Customer-controlled compliance records are processed on the customer organisation’s documented instructions.
Google sign-in
If you choose Google sign-in, Google supplies a verified account identifier, email address and basic profile information; a Workspace domain claim may be used to enforce your organisation’s policy. We use this information for authentication and account linking. Our sign-in integration does not request access to your Gmail messages, Drive documents or contacts. Google handles its own account authentication under its privacy terms.
Who can receive information
Authorised colleagues and service providers can access records within permissions set for the customer. Our infrastructure providers include IONOS for application hosting and AWS for private document storage, encrypted recovery backups and transactional email. Cloudflare provides DNS, security and routing for central launcher and website traffic. Google is used when you choose Google sign-in. We may also disclose information where required by law or for a legitimate legal claim.
Where information is processed
The core hosted portal uses UK infrastructure, including London-region AWS storage and email services. Google sign-in and infrastructure-provider support or security operations can involve processing outside the UK. Overseas processing is subject to the relevant provider arrangements and the UK transfer rules. Applicable safeguards can include UK adequacy regulations or approved contractual safeguards. Contact support@comply.fm for the arrangements and a copy of the safeguards relevant to your information.
How long information is kept
We determine retention by the record’s purpose, whether the account or customer relationship remains active, the organisation’s instructions, the need to investigate security incidents or resolve claims, and applicable legal requirements. Account disabling does not automatically erase compliance records or audit history. Information should be deleted or anonymised when no longer needed for those purposes, subject to a lawful retention requirement or legal hold. Encrypted recovery backups may contain earlier copies until securely removed; erasure requests must also consider backup retention and subsequent restoration. Contact us or the relevant customer organisation about a particular record.
Your rights and choices
Depending on the circumstances, you may have rights to access, correct or erase personal information, restrict processing, receive portable information or withdraw consent where consent is relied on. You can object to processing based on legitimate interests; please contact support@comply.fm. Some rights have exceptions. For customer-controlled records, we will assist or direct your request to the relevant organisation. You can complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.
Cookies and storage
The portal uses essential authentication and security cookies and stores your appearance preference. These support sign-in, secure sessions, protection against fraudulent requests and the appearance you choose. Comply.FM does not use these portal cookies to provide advertising or behavioural tracking. Google and other sites that you visit have their own notices.
Changes and contact
We may update this notice to reflect changes to the service or processing arrangements. The current notice date is shown on this page. Contact support@comply.fm with questions.
Updated 7 November 2026