1. About this policy
Sused (“we”, “us”) runs the Sused app, the Sused web app and this website. This policy explains what personal data we handle, why, who can see it, where it's kept and for how long, and the rights you have under the UK GDPR and the Data Protection Act 2018.
Questions about this policy or your data: email privacy@sused.co. We haven't appointed a data protection officer; that address reaches the people responsible for privacy at Sused.
2. Who is in charge of your data
Your building's company is in charge of your building's data. That's the residents' management company (RMC) or right to manage (RTM) company that uses Sused for your building. It is the controller of the data about your building and the people in it: your flat and tenancy, reports, comments, photos, videos, news, documents, consultations, responses and decisions.
Sused is its processor. We handle that data only on the company's instructions, under a written contract that meets Article 28 of the UK GDPR. Where a managing agent runs the building for the company, it acts for the company, and it may also be a controller of its own business records.
Sused is the controller of your account (your email address, sign-in and devices), our security logs, marketing (only if you opt in), the pilot form on this website, and messages you send us.
For a request about your building's data, you can contact the building company or the managing agent. If you contact us instead, we'll help them answer it.
3. What we collect
- Your account: your name, email address, and, if you give them, a display name, phone number and job title.
- Your place in the building: your site, block and flat, and how you're connected to it: owner who lives there, leaseholder who lets the flat out, renter, or someone else who lives there. For people who run the building, their role, such as director, managing agent or site team.
- Reports: what you write, the category and urgency, the place in the building you choose, photos, videos, comments and updates. Reports can mention other people, for example about noise or antisocial behaviour.
- Consultations and decisions: your responses, and for directors, votes and comments.
- Your devices: a notification token, the type of device and the app version, so we can send you notifications.
- Security and audit records: sign-in events, IP addresses in security logs, and a record of who did what in the building, and when.
- The pilot form: your name, email address, building and role.
Sused doesn't track where you are. The location on a report is the place in the building you choose. We don't ask for health information or other special category data, so please leave it out of reports unless it's needed to fix a problem.
4. How we use it, and our lawful bases
| What for | Lawful basis |
|---|---|
| Running Sused for your building: reports, news, documents, consultations and decisions | Your building company's instructions, as its processor. The company relies on its own lawful basis, usually its legitimate interest in managing the building and its duties under your lease and company law. |
| Your account, sign-in and the notifications you ask for | Contract: our terms of use. |
| Keeping Sused secure, preventing misuse and keeping an audit log | Legitimate interests. |
| Replying to the pilot form and to messages you send us | Legitimate interests. |
| Marketing emails and partner offers | Your consent, which you can withdraw at any time. |
| Disclosures the law requires | Legal obligation. |
5. Who can see what in your building
- Reports are seen only by the people the reporter chooses, and every report reaches the managing agent or the directors, or both. Anyone left out doesn't learn the report exists.
- News and documents are seen only by the people they're sent to, for example leaseholders in certain blocks.
- Contact details are shown only to the managing agent and directors whose role allows it. Site team roles can never see residents' contact details or who answered a consultation.
- The residents' directory is off unless you choose to appear in it.
The register of members
If your building company keeps its register of members in Sused, the Companies Act 2006 (section 116) lets members and other people ask the company to inspect or copy it, for a proper purpose. That is the company's decision as controller, not ours, and the company can ask a court to stop a request that isn't for a proper purpose.
6. Anonymous reporting
If your building allows it, you can report a problem anonymously. Other people who can see the report see “Anonymous resident” instead of your name and flat.
- Anonymous means anonymous to other users. Sused still stores who made the report, so that you can follow it, get updates and delete your account.
- Someone who can see the report can ask to know who you are. Only you decide. If you agree, it can't be undone.
- Sused staff don't look at who made an anonymous report. In the rare case it's needed, access requires a recorded reason and is written to an audit log.
- We may disclose who made a report where the law requires it, for example under a court order or a lawful request from the police.
- If your building turns anonymous reporting off, existing reports stay anonymous.
Consultations can allow anonymous responses too. An anonymous response hides your name and flat from everyone, including the directors and the managing agent, but still counts.
7. Photos, video and CCTV
- The app uses your camera only when you choose to take a photo or video. You can turn camera access off at any time in your phone's settings.
- Photos are re-saved on your phone before they're uploaded, which removes hidden details such as the location they were taken.
- Video may contain location data and is shared only with staff: the managing agent, directors or site team who can see the report, and you. Other residents never see videos. Videos are limited to 60 seconds.
- Photos and videos are stored encrypted and opened through links that expire after 15 minutes, issued only to people who can see the report.
- Please avoid filming people. If a problem involves someone, for example antisocial behaviour, film only what's needed to show it. Videos for anonymous reports, and for antisocial behaviour and complaints, must be filmed in the app.
- Sused doesn't run CCTV. If your building has cameras, they belong to the building company or the managing agent; ask them about footage.
8. Where your data is stored, and who helps us
Your data is stored and processed in the EU (AWS Ireland). Our websites are served by Cloudflare. We use these sub-processors:
- Amazon Web Services (AWS) (Ireland (eu-west-1)): Hosting, databases, file storage for photos, videos and documents, sign-in, sending email, and passing notifications to Apple and Google. Everything the service stores is stored here.
- Cloudflare (Its global network, nearest to you): Domain names (DNS) and hosting for the Sused website and web app. It handles your IP address and the pages you request as they pass through; it does not store your building data.
- Apple (Apple Push Notification service) (United States): Delivering notifications to iPhones and iPads. Apple receives your device's notification token and a notification that carries no content, at most your building's name.
- Google (Firebase Cloud Messaging) (United States): Delivering notifications to Android phones. Google receives your device's notification token and a notification that carries no content, at most your building's name.
Ireland is covered by the UK's adequacy regulations. Where Cloudflare, Apple or Google handle data outside the UK and EU, the transfer is covered by UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework, where the provider is certified) or by the ICO's international data transfer agreement or addendum.
Notifications carry no content: they say something like “New update at your building”, and the app fetches the detail from us when you open it.
We don't sell or rent personal data, we don't show adverts, and our websites don't use analytics or tracking cookies (see our cookie policy).
9. Emails, notifications and marketing
Service messages, such as sign-in codes, invitations and updates on reports you follow, are part of the service. You can choose which notifications you get in the app.
Marketing, including offers from partners, is separate. We send it only if you opt in, we record which version of the wording you agreed to, and you can unsubscribe at any time from the email or in the app. Marketing is sent separately from service messages, so opting out never stops your sign-in codes. Nothing about you goes to a partner unless you explicitly agree.
10. How long we keep things
These are the standard periods. Your building company can choose different ones.
| Data | How long |
|---|---|
| Your account | While you use Sused. When you delete your account, we delete your sign-in, devices, consents and notifications straight away. |
| Reports, comments and updates | Kept as your building company's records. If you delete your account, your name on them is replaced with an anonymous marker. |
| Photos and videos on reports | Two years after the report is closed. |
| Your flat, tenancy and roles after they end | Six years, so questions about past service charges can still be answered. |
| Consultation responses | Six years. |
| Directors' decisions, votes and handover records | Six years after they close, as the company's board records. |
| Audit log (who did what, and when) | Six years. |
| Invitations | 14 days, unless accepted. |
| The pilot interest form on this website | One year. |
| Server logs | 14 days. |
| Backups | Up to 35 days, then overwritten. |
11. Your rights
You have the right to:
- get a copy of the personal data held about you (a subject access request);
- have inaccurate data corrected;
- have your data deleted. You can delete your account yourself in the app, under Me. The building's records, such as reports and consultation results, stay with the building company with your name removed;
- restrict or object to how your data is used;
- receive your data in a format you can take elsewhere;
- withdraw consent, for example to marketing, at any time.
Sused doesn't make decisions about you by automated means alone. To use your rights, email privacy@sused.co. We reply within one month. For your building's data we work with the building company, which is in charge of it.
12. Complaints about how we use your data
Please tell us first, so we can put it right. Email privacy@sused.co with “Data complaint” in the subject, or see our complaints page. Under the Data (Use and Access) Act 2025, from 19 June 2026:
- we acknowledge your complaint within 30 days;
- we look into it without undue delay, and may ask you for more detail;
- we tell you what we found and what we've done about it.
If you're not happy with our answer, you can complain to the Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; ico.org.uk.
13. Sused is not an emergency service
Sused isn't monitored around the clock. For danger to life, call 999. For an urgent problem in the building, also call your managing agent's emergency number.
14. Age
You must be 16 or older to use Sused. If you think someone younger has an account, email privacy@sused.co and we'll remove it.
15. Keeping data safe
Data is encrypted in transit and at rest. Sign-in uses one-time codes and passkeys rather than passwords. Every screen and every request checks who is allowed to see what, and we keep an audit log of changes. Access by our own staff is limited to what's needed to run and support the service.
16. Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use your data, we tell you in the app or by email first, and ask you to agree again where the law requires it.
17. Contact us
Privacy questions and requests: privacy@sused.co. Anything else: hello@sused.co.