UMA Compass
Privacy notice
What UMA Compass is
UMA Compass is an internal portal of UMA Group for raising, approving and processing payment requests. It is used only by people an administrator has enrolled in UMA IM, the group's identity and access register. It is not offered to the public.
Signing in with Google
Compass uses Google Sign-In only to confirm that you own the email address you sign in with. It asks Google for your email address, your name and the identifier of your Google account, and nothing else. It does not ask for, and cannot reach, your Gmail, your Google Drive, your calendar or any other Google data.
A sign-in succeeds only when that email address is already enrolled in UMA IM by an administrator. Any other Google account is refused and nothing about it is kept, apart from an entry in the sign-in log noting that access was refused.
What we store about you
- Your email address, your name and your Google account identifier, so that only you can sign in as you.
- When you last signed in, and the roles an administrator has granted you.
- The payment requests you raise, the decisions you take on others' requests, and any comments you add.
- An audit trail of actions taken in the portal, with the name of the person who took each one.
- Documents you attach to a request. These are stored in UMA Group's own Google Shared Drive, which the group controls, and are shown only to people who may see that request.
Who can see it
Enrolled people see what their role allows: a request is visible to the person who raised it, the approvers it is routed to, the payment and accounts teams once it reaches them, and the portal's administrators. Nothing is shared with anyone outside UMA Group, and nothing is sold or used for advertising.
Cookies and your browser
Compass sets one cookie, which keeps you signed in and expires on its own. Your browser may also keep a few preferences on your device, such as the colour theme and which notices you have read. There are no tracking or advertising cookies.
Where it is kept
The portal and its database run on Google Cloud in the Singapore region. Documents are kept in Google Drive under UMA Group's Workspace.
How long, and your choices
Payment requests and their audit trail are business records and are kept for as long as the group needs them. Your sign-in details are kept while your account is active; an administrator can deactivate it at any time, after which you can no longer sign in. To ask what is held about you, or to have an account removed, write to admin@uma.inc.