Privacy Policy

1. Who we are

HousingSurvey Pro™ is operated by ProSurvey Apps Limited ("we", "us", "our"), a company registered in England and Wales, company number 17118570.

For any privacy question, or to exercise your rights, use our contact form or email our support address (published on our website). Our registered office is Unit 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole, BH16 6FA. We are registered with the Information Commissioner's Office under registration reference ZC191906. We respond within one calendar month.

We have not designated a separate named Data Protection Officer: UK GDPR does not require one for a business of our size and processing profile. Privacy enquiries and data-subject requests should be directed to the contact channels above, which we treat as our data-protection contact point.

2. Our two roles — controller and processor

We act in two distinct capacities, and it matters which one applies to a given piece of data:

• Processor — for Tenant/property evidence data captured by our customers (housing associations, councils, and their contractors) and their Authorised Users. Here the customer organisation is the data controller and we are its processor, acting on its documented instructions under our Data Processing Agreement. If you are a resident, occupier or other individual whose data appears in a survey, the housing organisation is your controller — please direct requests to them first (see clause 9).
• Controller — for account, billing, support, marketing and website data — the data we need to run our business, provide the Service to our customers, communicate about our own products and operate our website.

3. What we process, why, and our lawful basis

3.1 As controller (account, billing, website)

Product follow-up and direct marketing

We may use the limited controller-side HousingSurvey Pro product, account, contact and subscription information described above to identify people or organisations who have expressed interest in, registered for or used the Service but have not started a paid subscription, or whose trial or subscription has ended. We may contact them to offer help, ask for feedback, or explain our own similar products and subscription options. We never use Tenant Personal Data, resident-triage answers, Evidence, survey photographs or survey notes for this purpose. RevenueCat subscription data from DampApp Pro or PropertySurvey Pro is governed by the separate mobile-products privacy policy at prosurvey.app/privacy, not this policy.

Simply installing an app or creating an account does not by itself amount to consent to electronic marketing. We send email, text, telephone or similar direct marketing only where permitted by applicable law — for example, with consent, under the limited PECR products-and-services "soft opt-in" where every requirement is met, or under the rules applicable to corporate subscribers and business contacts. Every marketing communication will identify us and provide a simple way to opt out. Before relying on legitimate interests for marketing processing, we assess and document whether our interests are overridden by the individual's rights; where consent is legally required, we rely on consent instead.

3.2 As processor (evidence / Tenant Personal Data)

We process the following on our customers' behalf, on their instructions, under the DPA. The customer is the controller and determines the lawful basis (typically a legal obligation or legitimate interests relating to housing standards):

Records are designed to describe properties, not people. Customers are contractually required (see the Terms and DPA) to minimise the personal data they enter, and not to enter special-category data anywhere except the fields built for it: the occupant-vulnerability record in a survey (with its detail field and the vulnerable-occupant notes in the excess-cold and HHSRS sections), and the optional resident-triage feature. Both are described in clause 4. They exist so that health and vulnerability information a customer needs to prioritise hazards and handle a case safely is recorded in a structured place rather than typed into general notes.

4. Photographs, location, and resident triage — special care

Photographs of homes, a precise GPS fix, the occupant-vulnerability record and (where enabled) resident vulnerability/safeguarding triage answers can be sensitive. Accordingly:

• Photographs are captured to evidence property condition and are content- hashed and sealed with the Evidence Record. They should show building fabric/conditions, not identifiable individuals; customers instruct their surveyors accordingly.
• Location is captured when a surveyor deliberately captures a GPS fix during an inspection, to geo-stamp the record at the point of capture, and when a surveyor or operative chooses to check in on site. There is no background tracking, no movement history, and no advertising use.
• Occupant vulnerability record. Every survey has an occupant-vulnerability step, whether or not the office triage feature below is switched on. The surveyor can record which of a fixed list of factors apply to the household (pregnancy; a respiratory, heart or other long-term health condition; weakened immunity; medication affecting tolerance of cold or heat; a mental-health condition; dependency on medical equipment; a mobility or sensory impairment; someone aged 65 or over; children under 5 or under 14; spending most of the day indoors), or that the household was asked and declared none, with optional detail and the name of whoever recorded it. The health factors are special-category data under Art. 9 UK GDPR. The customer organisation, as controller, is responsible for its lawful basis for recording them, typically to assess and prioritise hazards such as damp and mould or excess cold under the Housing Health and Safety Rating System and Awaab's Law. This record is part of the survey: it is sealed into the tamper-evident Evidence Record at finalisation, appears in the survey report by default (including a report the customer sends to the resident), and is included in evidence bundles and the organisation's data export. Anyone in the organisation who can read the survey can read it. It is never sent to an AI provider. Free-text vulnerable-occupant notes in the excess-cold section are, however, included when the customer asks its own AI provider for a draft executive summary (clause 6.1).
• Resident vulnerability/safeguarding triage is a separate, OPTIONAL office feature a customer organisation switches on for itself (off leaves it entirely unavailable). Where enabled, it lets office staff and surveyors record — with the resident's or a household member's input, or a surveyor's own observation, always noting who answered — whether anyone in the household has a respiratory/cardiac condition, is immunocompromised, whether there are children under 5, elderly/mobility needs, and any safeguarding concern the customer's own safeguarding process should be aware of. Every question is optional and "prefer not to say" is always a complete, first-class answer — nobody is required to disclose anything. This is special-category data under Art. 9 UK GDPR; the customer organisation is the controller and is responsible for its own lawful basis for enabling and using the feature (our understanding, not legal advice, is summarised in the DPA, Annex 1). We restrict who can see these answers within the customer's own organisation — only manager-level- or-above staff and the specific surveyor/operative assigned to that case, never an organisation-wide viewer or coordinator role — enforced server-side and independently tested, excluded from bulk data exports and API access unless the requester holds that same access level, and never written to our own operational logs. The answers may, honestly, SUGGEST that a case be treated as more urgent (for example, a reported respiratory condition alongside a damp/mould hazard) — this is always a suggestion shown with its reasoning for a manager to review and confirm, never an automatic decision.

As processor, we hold this data for the controlling organisation; requests about it should go to that organisation (clause 9).

5. Where your data lives — UK residency

Our database (Firestore), file storage (Cloud Storage), server functions (Cloud Functions) and reporting warehouse (BigQuery) are in the Google Cloud London region (europe-west2). The database and storage locations were fixed when our Google Cloud project was created, and our server functions are configured in code to run in London. Some Google services we rely on are global rather than regional and may process data outside the UK: Firebase Authentication (sign-in), Firebase Cloud Messaging (push notifications, which can include a property address), Analytics, Performance Monitoring and Crashlytics. Website and portal static assets are code, not customer data, and are served via CDN.

International transfers are limited to what our subprocessors and the other services in clause 6 necessarily involve; where any transfer outside the UK occurs, it is made under an appropriate safeguard (for example, the UK IDTA/Addendum to the EU Standard Contractual Clauses, or an adequacy decision), as set out per subprocessor on the subprocessors page.

Marketing/advertising cookies, analytics and diagnostics specifically (clause 10, Cookie Notice): Meta Pixel (Meta Platforms Ireland Ltd / Meta Platforms, Inc., both US-headquartered), LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company / LinkedIn Corporation, US-headquartered), Firebase Analytics / Google Analytics 4, Firebase Performance Monitoring and Firebase Crashlytics (each Google Ireland Limited / Google LLC, US-headquartered) each involve a transfer of the relevant data outside the UK when set. The website trackers (Meta Pixel, LinkedIn Insight Tag, Firebase Analytics, Firebase Performance Monitoring) and the portal's analytics and performance monitoring load only if you accept the relevant cookie banner. The mobile apps' analytics, technical-error reporting and Crashlytics crash reporting are automatic (legitimate interests — see clauses 3.1 and 10; anonymised usage/diagnostic data only, never your Evidence or organisation data). Each provider relies on its own standard contractual clauses (or equivalent transfer mechanism) as data importer.

6. Service providers and subprocessors

We use the following providers. Some process Customer Data as our subprocessors; others process only the controller-side business data described in clause 3.1. AI providers used for survey-content assistance are the customer's own — see clause 6.1.

We do not sell personal data. A contracted specialist receives only the minimum controller-side information needed for the assigned work, must act only on our instructions, and may not use it for their own purposes. We remain responsible for this processing.

6.1 Customer-keyed AI providers

If a customer enables advisory AI assistance, that processing runs on the customer's own AI provider account and API key (for example, Anthropic, Azure OpenAI, OpenAI, Google, or a compatible endpoint the customer configures). The customer's relationship with that AI provider — including the data-processing agreement — is the customer's own. We store the customer's key server-side only, scope its use strictly to that customer, and fail closed when no key is configured. What is sent depends on the feature:

• Photo analysis, executive summaries, text polish and room-note structuring work on draft surveys only and are refused once a survey is finalised. They send the photo or text being worked on; an executive summary also sends the property address, the landlord's name and the findings.
• Statutory summaries and investigation-complete notices are drafted from a finalised survey, which they read but never change. They send the property address, room observations and readings, HHSRS findings, planned works, statutory dates, the landlord's name and the tenant's name and contact line.
• Survey-scheduled and works-scheduled notices send the property address, appointment details, scope text, any planned works and the tenant's name.
• Repair-code (SOR) suggestions send a photo from a survey linked to the work order, which can be a finalised survey.
• Scope-of-survey drafts send the issue description, the reason for inspection and property details.

AI output is advisory and never enters the sealed evidential record automatically. The occupant-vulnerability record (clause 4) is never sent to AI. Our separate public demo environment, which holds demonstration data only, uses our own AI key; no customer organisation's data is processed with it.

We give notice of material subprocessor changes as set out in the Data Processing Agreement. The current, up-to-date list is also published on the subprocessors page.

7. Retention

• Finalized Evidence Records are intentionally tamper-evident: no client or API path can edit or delete them, and any change to a sealed record by any means breaks its cryptographic hash chain and is detected automatically. They are retained for the period the controlling organisation sets (default reflects housing-disrepair limitation periods, commonly six years or longer). We do not claim a finalized record can never be altered at the infrastructure layer; we claim any such change cannot be made undetectably (see the Terms of Service, clause 2.4).
• Draft records can be soft-deleted with an audit trail. Soft-deleted drafts leave an audit tombstone; their heavy payload and photos are purged by an automated janitor after a retention window (currently 90 days), while the tombstone/audit record is kept.
• Deleted organisations are purged by an automated sweep after their deletion window (self-service organisation deletion: a 90-day cancellable window; superadmin-initiated deletion: a shorter documented cool-down), subject to records we must legally keep.
• Audit logs are retained with the evidence they protect.
• Account personal data is deleted within 90 days of account closure.
• Accounting/billing records are retained for six years to meet UK accounting-retention requirements, after which they are removed.
• Marketing/follow-up working lists held by a contractor are limited to the relevant campaign or contract and must be securely deleted or returned when no longer required. We periodically review our own follow-up records and keep them only while relevant and lawful. If someone opts out or objects, we may retain a minimal suppression record for as long as needed to ensure we do not contact them again for direct marketing.
• EDI files are deleted after 90 days. Full-organisation exports and evidence bundles that your staff generate are kept in our storage until the organisation is deleted, when they are purged with everything else; the download link for each one expires after 15 minutes.
• Case-intake data and resident-triage answers (where enabled) live on the operational case record, not inside any tamper-evident Evidence Record — they are editable and deletable at any time by the controlling organisation's authorised staff (a dedicated delete action exists for triage answers specifically), and are removed automatically when the organisation or the underlying case is deleted. They are included in the organisation's self-service data export (clause 9) whenever the exporting administrator holds the same manager-or-above access the answers themselves require.
• The occupant-vulnerability record in a survey (clause 4) is different: once the survey is finalised it is part of the sealed Evidence Record and is kept for the Evidence Record's retention period above.

Where UK GDPR erasure rights are engaged for personal data inside Evidence Records, we work with the controller, noting the Article 17(3)(e) exemption (retention for the establishment, exercise or defence of legal claims).

8. Security

TLS in transit and encryption at rest throughout; default-deny access rules with per-organisation isolation; server-authoritative finalization with cryptographic hash chains and append-only audit logs; app attestation (App Check); two-factor authentication (TOTP or passkey); passwords held by our identity platform, and API keys and SCIM tokens stored only as SHA-256 digests. We describe our full posture, honestly, on our website's security page.

We do not currently hold SOC 2, ISO/IEC 27001 or Cyber Essentials certification; we operate to those control frameworks and are working towards certification. We make no certification claim unless and until certified.

9. Your rights

Under UK GDPR and the Data Protection Act 2018 you may request access, rectification, erasure, restriction, portability, or object to processing.

Your right to object to use of your personal data for direct marketing is absolute. Use the unsubscribe or opt-out method in the communication, tell the person contacting you, use our contact form, or email support. We will stop using your information for direct marketing and place only the minimum details on our suppression list. Where we rely on consent, you may also withdraw that consent at any time.

• For evidence/tenant data (where we are processor): contact the housing organisation that holds the record — it is your controller. We support that organisation with real, self-service tools: an org-administrator can export all of an organisation's data (as a signed ZIP) and can request full organisation deletion, both without needing a support ticket.
• For account, billing and website data (where we are controller): contact us using the details in clause 1. Any user can delete their own account self-service in the portal (Settings, then My account), and deletion is immediate: your sign-in account and personal profile (including push-notification tokens and passkeys) are deleted, and your name and email on membership records are replaced with "Deleted user". Evidence Records you created survive (Art. 17(3)(e)) and, because they are sealed, still show the surveyor name recorded at the time.

You have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. We would appreciate the chance to resolve your concern first.

10. Cookies and similar technologies

We set no advertising or analytics cookies without your consent. Our website uses a cookie-consent banner: strictly-necessary storage — for example authentication/session storage in the portal and app, App Check attestation tokens, and Cloudflare Turnstile for bot protection on forms — is always on, but marketing/advertising and analytics cookies load only if you accept, and you can withdraw that consent at any time via "Manage cookies" in the website footer. The website is configured to set four technologies on consent: Meta Pixel, LinkedIn Insight Tag (advertising and campaign measurement; neither is currently switched on), Firebase Analytics / Google Analytics 4 (website usage analytics plus a structured technical-error signal — unhandled page/script errors, no personal data — when enabled) and Firebase Performance Monitoring (website loading-speed and technical-performance measurement, when enabled) — see clause 6 and the international transfer note in clause 5.

Our portal has its own cookie banner. Firebase Analytics / Google Analytics 4 (portal usage plus the same structured technical-error signal) and Firebase Performance Monitoring (loading speed) load there only if you accept, and you can change your choice at any time from Cookie settings in the portal. Our mobile apps use Firebase Analytics automatically to understand product usage — anonymised screen views and key actions only, plus the technical-error signal; none of it ever collects your Evidence or organisation data. The mobile apps also use Firebase Crashlytics automatically for native crash reporting — stack trace, device/OS information and app version when the app crashes, not linked to your account identity (we make no setUserId call). Crashlytics exists only in the mobile apps; it has no web equivalent, which is why the website and portal use the performance-monitoring and error-signal tools above instead. We rely on legitimate interests (Art. 6(1)(f)) as the lawful basis for this automatic analytics, error and crash reporting in the mobile apps. If you would prefer we not process this diagnostic/analytics data about your organisation's use of the app, contact support and we will consider a technical opt-out.

The Cookie Notice is the authoritative, up-to-date detail for this clause and will be updated first if any of this changes.

11. Children

The Service is a B2B tool for housing professionals and is not directed at children. We do not knowingly collect personal data about children through our own controller-side processing.

12. Changes

We post changes here with a new version number and effective date. Material changes affecting organisations are notified to organisation administrators.

ProSurvey Apps Limited · registered in England and Wales, company number 17118570 · HousingSurvey Pro™.