Legal
Privacy Policy
Last updated: 9 March 2026
Your Privacy Matters: Suddeco Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website (www.suddeco.com) and our AI construction management platform (my.suddeco.com). We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data Controller
The data controller responsible for your personal data is Suddeco Ltd, a company registered in England and Wales, with its registered office at 662 High Road, London N12 0NL, United Kingdom.
For any questions about this Privacy Policy or our data practices, please contact our Data Protection team at [email protected] or by post at the address above.
2. Personal Data We Collect
We collect and process the following categories of personal data, depending on how you interact with our services:
2.1. Information You Provide Directly
| Category | Data Elements | When Collected |
|---|---|---|
| Identity Data | First name, last name, job title, company name | Account registration, contact form |
| Contact Data | Email address, phone number, postal address | Account registration, contact form, billing |
| Account Data | Username, password (encrypted), account preferences, role | Account creation and management |
| Financial Data | Payment card details (processed by our payment provider), billing address, transaction history | Subscription purchase, token purchase |
| Project Data | Construction drawings, project documents, scope of works, cost estimates, project notes | Platform usage |
| Communication Data | Messages sent through contact forms, support tickets, chat messages within the platform | Customer support, platform chat features |
2.2. Information Collected Automatically
| Category | Data Elements | Purpose |
|---|---|---|
| Technical Data | IP address, browser type and version, operating system, device type, screen resolution | Security, compatibility, analytics |
| Usage Data | Pages visited, features used, time spent, click patterns, search queries within the platform | Service improvement, personalisation |
| Token Usage Data | Token consumption records, AI feature usage frequency, processing timestamps | Billing, service optimisation |
3. Lawful Basis for Processing
Under the UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases depending on the processing activity:
| Processing Activity | Lawful Basis |
|---|---|
| Providing the Platform and Services | Performance of a contract (Article 6(1)(b)) |
| Processing payments and billing | Performance of a contract (Article 6(1)(b)) |
| Responding to contact form enquiries | Legitimate interests (Article 6(1)(f)) |
| Sending service-related communications | Performance of a contract (Article 6(1)(b)) |
| Sending marketing communications | Consent (Article 6(1)(a)) |
| Analytics and service improvement | Legitimate interests (Article 6(1)(f)) |
| Security and fraud prevention | Legitimate interests (Article 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Article 6(1)(c)) |
4. How We Use Your Personal Data
4.1. Service Delivery. We use your personal data to create and manage your account, provide access to the Platform, process your construction drawings through our AI systems, generate scope of works and cost estimates, facilitate team collaboration, and deliver the features included in your Subscription.
4.2. AI Processing. When you upload construction drawings and documents, our AI systems process this data to extract information, generate analyses, and produce outputs. This processing is essential to the Services we provide. We do not use your Customer Data to train our AI models for other customers' benefit without your explicit consent.
4.3. Communication. We use your contact information to send you service-related notifications (such as account confirmations, billing receipts, security alerts, and feature updates). With your consent, we may also send marketing communications about new features, promotions, or industry insights. You can opt out of marketing communications at any time.
4.4. Analytics and Improvement. We analyse aggregated and anonymised usage data to understand how our Platform is used, identify areas for improvement, and develop new features. This analysis does not identify individual users.
4.5. Legal and Security. We may process your data to comply with legal obligations, enforce our Terms of Service, protect against fraud and security threats, and defend our legal rights.
5. Data Sharing and Third Parties
5.1. We do not sell your personal data to third parties. We share your data only in the following circumstances:
5.2. Service Providers. We engage trusted third-party service providers who process data on our behalf to support our operations. These providers are bound by data processing agreements that require them to protect your data to the same standard we apply. Our key service providers include cloud hosting providers, payment processors, email delivery services, and analytics platforms.
5.3. Legal Requirements. We may disclose your personal data if required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
5.4. Business Transfers. In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such transfer and any choices you may have regarding your data.
5.5. With Your Consent. We may share your data with third parties where you have given us explicit consent to do so.
6. International Data Transfers
6.1. Your personal data may be transferred to, stored, and processed in countries outside the United Kingdom. Where we transfer data internationally, we ensure that appropriate safeguards are in place to protect your data in accordance with UK GDPR requirements.
6.2. These safeguards may include: transfers to countries that have been deemed to provide an adequate level of data protection by the UK Secretary of State; the use of International Data Transfer Agreements (IDTAs) or UK Addenda to EU Standard Contractual Clauses; or other legally recognised transfer mechanisms.
6.3. You may request further details about the safeguards we use for international transfers by contacting us at [email protected].
7. Data Retention
7.1. We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.
7.2. Our standard retention periods are as follows:
| Data Category | Retention Period |
|---|---|
| Account data | Duration of account plus 30 days after deletion request |
| Project data and Customer Data | Duration of account plus 30 days after account termination |
| Financial and billing records | 7 years (as required by UK tax and accounting law) |
| Contact form submissions | 2 years from submission date |
| Analytics data | 26 months (anonymised and aggregated) |
| Security logs | 12 months |
7.3. When personal data is no longer required, we will securely delete or anonymise it. Anonymised data (from which you can no longer be identified) may be retained indefinitely for statistical and analytical purposes.
8. Your Data Protection Rights
Under the UK GDPR, you have the following rights in relation to your personal data. You may exercise these rights at any time by contacting us at [email protected].
Right of Access
You have the right to request a copy of the personal data we hold about you. We will respond to your request within one month and provide the data in a commonly used electronic format.
Right to Rectification
You have the right to request that we correct any inaccurate or incomplete personal data we hold about you. You can also update most of your information directly through your account settings.
Right to Erasure
You have the right to request that we delete your personal data where there is no compelling reason for its continued processing. This right is not absolute and may be subject to legal retention requirements.
Right to Restrict Processing
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance.
Right to Object
You have the right to object to the processing of your personal data where we are relying on legitimate interests as our lawful basis, including for direct marketing purposes.
Rights Related to Automated Decision-Making
You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significantly affects you. Our AI processing is designed to assist, not replace, human decision-making.
Right to Withdraw Consent
Where we rely on consent as the lawful basis for processing, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
We will respond to all legitimate requests within one month. In exceptional circumstances, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it. We do not charge a fee for exercising your rights unless the request is manifestly unfounded or excessive.
9. Data Security
9.1. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, regular security assessments, and employee training on data protection.
9.2. While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security but will notify you and the relevant supervisory authority of any data breach in accordance with our legal obligations.
9.3. You are responsible for maintaining the security of your account credentials and for any activity that occurs under your account. Please use a strong, unique password and do not share your login details with others.
11. Children's Privacy
The Platform is designed for use by construction professionals and businesses and is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete that information promptly.
12. Changes to This Privacy Policy
12.1. We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by email or through a prominent notice on our website or Platform at least thirty (30) days before the changes take effect.
12.2. We encourage you to review this Privacy Policy periodically. The "Last updated" date at the top of this page indicates when the policy was last revised.
13. Complaints
13.1. If you are not satisfied with how we handle your personal data or wish to raise a concern, please contact us first at [email protected]. We will investigate your concern and respond within a reasonable timeframe.
13.2. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk or by telephone on 0303 123 1113.
14. Contact Information
For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Suddeco Ltd — Data Protection
662 High Road
London N12 0NL
United Kingdom
Email: [email protected]
Phone: +44 20 3633 8086