Privacy Policy
How SurveyDock handles personal data. The short version: we hold as little as the software needs, we store it in the EU, we do not track you, and we never sell or share it. The detail below matters most if you are assessing us for a firm-wide rollout.
Last updated 19 August 2026
1. Who we are
SurveyDock provides the service described in this policy. For the personal data described in clause 3 we are the data controller.
Data protection questions and requests go to support@surveydock.co.uk.
2. The distinction that shapes this policy
SurveyDock holds two quite different kinds of personal data, and we stand in a different legal position to each. Getting this straight makes the rest of the policy easier to read.
| Who decides how it is used | Our role | |
|---|---|---|
| Our own data | Us. Your account details, our correspondence with you, and enquiries submitted through this website. | Controller — this policy governs it. |
| Your survey content | You. The client, landlord, tenant and property records you enter, and the photography you upload. | Processor — we act on your instructions under the Data Processing Agreement. |
So: if you are a surveyor whose details appear in a report, or a landlord recorded in a practice’s account, the practice — not SurveyDock — decides how that information is used. We would refer your request to them.
3. What we hold, and why
Account and user data. When someone is given a SurveyDock login we hold their name, email address and password (stored only as a cryptographic hash, never in readable form). Where the practice supplies them we also hold job title, RICS membership number and professional qualifications, because reports quote them. Lawful basis: performance of our contract with your practice, and our legitimate interest in running a secure service.
Enquiries. If you use the contact form on this website we hold the name, email, phone number and company you give us, plus anything you tell us about team size and when to call, so we can respond. Lawful basis: your consent in submitting the form, and our legitimate interest in responding to a business enquiry.
Usage and security records. We keep an audit trail of edits, approvals and exports within each account, recording who did what and when — it is a feature of the product, and it is what makes the service accountable. Our hosting providers keep standard technical logs including IP addresses. Lawful basis: legitimate interest in security, accountability and diagnosing faults.
Survey content.Practices record their clients, landlords, tenants, contacts and properties, and upload site photography which may incidentally show people or the inside of premises. We hold this as processor, on the practice’s instructions. See clause 2.
4. What we do not do
There is no tracking on this site or in the application.
No analytics, no advertising pixels, no third-party trackers, no session recording, no fingerprinting. The only cookies and local storage we use are the ones that keep you signed in; there is nothing to consent to, which is why you have not been shown a cookie banner.
5. Where it is stored
All survey data, photography and account records are stored and processed in the European Union, in Amazon Web Services’ Ireland region (eu-west-1), through our database provider.
Where a transfer of personal data leaves the UK or the EEA — for example if a provider’s support staff are located elsewhere — it is covered by UK and EU adequacy decisions or by Standard Contractual Clauses with the relevant UK addendum. We do not transfer survey content outside the EU in the ordinary course of running the service.
6. Who else is involved
We keep the list of third parties deliberately short. Each is bound by a written contract restricting them to processing on our instructions.
| Provider | What they do | Where |
|---|---|---|
| Convex, Inc. | Application database, file storage for photography, and backend compute. | European Union (AWS eu-west-1, Ireland) |
| Vercel, Inc. | Hosting and content delivery for the web application. | European Union, with a global edge network for static assets |
We may also disclose personal data to professional advisers, or where the law requires it. If we are ever compelled to hand over a practice’s data, we will tell them unless we are legally prohibited from doing so. The current list, and how we give notice of changes, is in the Data Processing Agreement.
7. How long we keep it
Survey content and account data is kept while the subscription is live. When it ends, the account stays reachable for 30 days so an administrator can export it, then it is permanently deleted from live systems. Backups containing it are overwritten within a further 30 days.
Enquiries are kept for up to 24 months from our last contact, then deleted. Ask us sooner and we will delete them sooner.
Records we must keep — invoices and accounting records — are retained for six years, as UK tax law requires.
Technical logs are kept for up to 90 days.
8. How we protect it
No system is perfectly secure. If a breach affecting personal data occurs we will act on it promptly, notify the affected practice, and notify the ICO where the law requires it.
9. Your rights
Under UK data protection law you have the right to:
Write to support@surveydock.co.uk. We respond within one month and we do not charge. If your request concerns survey content held by a practice, we are the processor and will pass it to them — see clause 2.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you raised it with us first so we can put it right.
10. Changes to this policy
We update this policy when what we do changes. The date at the top always reflects the current version, and where a change materially affects you we will tell account administrators by email rather than relying on you to notice.
Related documents