System Use & Data Processing
Sign off once. The record stands.
Before a client organisation runs a Compass system on its own people — candidates, executives, participants — this is what each side commits to. Print it for signature, or record the acknowledgment here and Compass can produce the record on request.
This document is Compass's standard operating position, not legal advice. Compass is not your counsel. Have your own legal and IT functions review it before execution, and where an executed master agreement exists, that agreement controls.
Version 1.0.0, effective 19 August 2026. Reads with the Personal Data Notice and the IT Security Policy, both of which form part of this agreement.
Systems this covers
- Compass Talent Acquisition System™ (CTAS™)Requisition setup, posting, pre-screen, application intake, candidate review and rating, interview evaluation, offer and onboarding.
- Compass 360° diagnostics (Eight-Area, Five Marks™, Enterprise Leadership 360)Nominate raters, collect ratings and comments, and release governed reports to the client through a Compass Administrator.
- Meeting Desk and HyNote summariesTurn a session recording or pasted transcript into Compass minutes, decisions, owners and actions, then file the artifact and its shareable link.
- Project, portfolio and value-stream boardsRun charter, stage-gate, risk, action and cadence records for a transformation program.
Terms
1. What is being adopted
Compass grants the client organisation a non-exclusive, non-transferable right to use the named Compass system for the client's internal business purposes during the engagement. The system, its structure, its question banks, its templates and its documentation remain the property of Compass Performance. The client's own records placed in the system remain the client's property.
2. Roles
For personal data placed in the system by or for the client, the client is the controller and Compass is the processor. Compass processes that data only to deliver the engagement, only on the client's documented instructions, and for no purpose of its own.
3. Confidentiality
Each party keeps the other's confidential information confidential, uses it only for the engagement, and limits access to people who need it and are bound by equivalent obligations. Compass does not use one client's data to inform another client's work.
4. Security
Compass maintains the controls stated in the Compass IT Security Policy as it stands at the date of signature, including encryption of data in transit and at rest, named-account access with server-side role enforcement, and an audit record of access and report release. Controls marked in that policy as being formalised are commitments in progress and are not represented as existing controls.
5. Recording, transcription and AI tool use
Recording and transcription happen only with advance notice to participants. Compass uses AI tools to draft, summarise and structure, never to make or automate a decision about a person, and every AI-assisted artifact is verified by a named person before use. Content submitted to an AI provider is not used by Compass to train models. The operating detail is IT Security Policy Section 4.5, which forms part of this agreement.
6. Client responsibilities
The client gives its own employees, candidates and participants the notices and, where required, obtains the consents its law requires; keeps its nominated owner and access list current; instructs Compass in writing on retention and deletion; and does not place medical, biometric, financial-account or government-identifier data in the system unless the parties have agreed in writing how it will be handled.
7. Decisions remain the client's
Compass systems record, structure and evidence decisions. They do not make them. Every selection, rating, disposition, offer, promotion, discipline and separation decision is made by named client decision-makers who are responsible for it and for its compliance with the law that applies to them.
8. No legal advice; no warranty of legal sufficiency
Compass is not the client's counsel. Templates, handbook documents, posting notices, question banks and reports are starting points to be reviewed by the client's counsel. Compass does not warrant that any of them satisfies the requirements of a particular jurisdiction, and makes no certification, audit-outcome or regulatory-compliance claim.
9. Subcontractors
Compass may engage the service providers listed in the Personal Data Notice, each under written processing terms, and remains responsible for their performance. Compass notifies the client system owner before a new provider holds client-confidential material, and the client may object on reasonable data-protection grounds.
10. Retention, return and deletion
Retention is client-directed, with a default of 24 months from the close of the stage that produced the record. On the client's written instruction, Compass returns or deletes the identified records within 30 days and confirms completion in writing, naming any record it must keep to meet a legal obligation. On termination, the same process applies to the whole engagement record.
11. Incidents
On confirming that client data has been or may have been compromised, Compass notifies the client system owner without undue delay and no later than 72 hours after that confirmation, states what is known and unknown, and supports the client's own notification obligations with the facts in its possession.
12. Audit and IT review
Compass answers the client's IT and security review questionnaires directly, provides its policy documents and, on request, an extract of the audit record relating to that client. Compass will state where an answer is not yet formalised rather than overstate a control.
13. Term, suspension and termination
This agreement runs for the engagement. Either party may terminate for material breach not cured within 30 days of written notice. Compass may suspend access immediately where continued access presents a security or confidentiality risk, and will say why in writing.
14. Liability
Neither party limits liability for its own wilful misconduct, fraud, or breach of confidentiality. Otherwise each party's aggregate liability arising from this agreement is limited to the fees paid or payable under the engagement in the twelve months preceding the claim, and neither party is liable for indirect or consequential loss, including loss of profit, arising from decisions the other party makes.
15. Order of precedence and governing law
Where an executed master or engagement agreement exists between the parties, that agreement controls and this document supplements it. Otherwise the order is: this agreement, then the IT Security Policy, then the Personal Data Notice. This agreement is governed by the laws of the State of Wisconsin, United States, and the parties submit to the courts of that jurisdiction.
Stated limits
- Compass does not provide legal advice. Nothing in a Compass system, template, handbook, posting notice, pre-screen question bank or report is legal advice, and the client's counsel remains responsible for compliance with the law that applies to it.
- Employment decisions are the client's. Compass systems record, structure and evidence a decision; they do not make one. Selection, rating, disposition, offer, promotion, discipline and separation decisions are made by named client decision-makers.
- Compass makes no automated decision about any individual, and no Compass system profiles a person to produce a decision without human judgement.
- Compass does not warrant that a template, handbook document, job posting or notice satisfies the requirements of any particular jurisdiction. Templates are starting points to be reviewed by client counsel.
- Compass does not claim a certification, an external audit outcome, or compliance with any particular framework in these documents.
- Assessment and diagnostic outputs are inputs to judgement, not measures of a person's worth, and are not to be used as the sole basis for an employment decision.
Control status at signature
What an IT reviewer should read as fact today. The full register, with detail, is in the IT Security Policy.
- Encryption — Data encrypted in transit and at rest (In place)
- Access control — Named accounts, server-side roles, two-step administrator sign-in (Being formalised)
- Logging — Audit record of access, refusals, report release, export and print (Being formalised)
- Retention — Client-directed retention with a documented default (Being formalised)
- AI use — Draft-only AI use with recorded human verification (Being formalised)
- Incident response — 72-hour notification to the client system owner (Being formalised)
- Subcontractors — Written processing terms with each provider; notice before a new one is used (Being formalised)
- Business continuity — Provider backup plus an independent document record of truth (Being formalised)
Signatures
Record the acknowledgment
Recording this creates a dated, unalterable entry Compass can produce on request. It does not replace an executed engagement agreement.
Every affirmation must be ticked before the acknowledgment can be recorded.
Questions from your legal or IT function: skopecky@compassperformanceinc.com, 224.307.0912.
Not sure where to start?
Three questions, and we point you to the right instrument.
Under a minute. From this page, most leaders begin with The organization.