Privacy Policy

SusDevOS Ltd (“SusDevOS”, “we”, “us”) is committed to protecting your personal data. This policy explains what personal data we collect, why we collect it, how long we keep it, and what rights you have over it. It applies to susdevos.com and the SusDevOS application.

SusDevOS Ltd is registered in England and Wales. We are registered with the Information Commissioner's Office (ICO) as a data controller and data processor. Our Data Protection Officer can be reached at dpo@susdevos.com.

1. Data we collect and why

Account and user data

When you create an account, we collect your name, work email address, and password (stored as an Argon2id hash — we never store your plaintext password). We use this data to provide the service you signed up for. The legal basis is contract (Article 6(1)(b) UK GDPR).

Usage and authentication data

We log authentication events (login, logout, token refresh) including IP address, user agent, and timestamp. We also maintain an immutable audit log of all actions taken within the platform. The legal basis is legitimate interest (Article 6(1)(f)) — security, fraud prevention, and the integrity of verified GHG inventories.

Emissions and sustainability data

The GHG emissions figures, activity data, land parcel geometry, and project data you enter are business operational data. This is not personal data in most cases. Where it does contain personal data (e.g. named employee travel records), you are the data controller and we are your data processor. See the Data Processing Agreement for details.

Marketing and lead data

If you contact us, apply to the Founding 10 programme, subscribe to our newsletter, or use the carbon estimator tool, we collect your contact details, organisation, role and any project or use-case information you provide. We use this to assess applications, respond to enquiries and, where you have opted in, to send product updates. The legal basis is consent (Article 6(1)(a)) for newsletter subscriptions, and legitimate interest (Article 6(1)(f)) for follow-up to existing customer enquiries.

Payment data

Payment processing is handled by Stripe. We store only your Stripe customer ID and invoice references — we never see or store your card number. Stripe's privacy policy governs their handling of payment data.

2. Data retention

3. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of all personal data we hold about you. Submit via Account Settings or email dpo@susdevos.com. We will respond within 30 days and provide a machine-readable export.
• Right to erasure — request deletion of your account and personal data. We anonymise rather than hard-delete (to preserve audit log integrity for verified inventories). Your name is replaced with [Deleted User] and your email with a hashed placeholder.
• Right to rectification — update your name, email, and other account details at any time via Account Settings.
• Right to data portability — receive your data in a structured, machine-readable format (JSON) via the data export endpoint.
• Right to object — opt out of marketing emails via the unsubscribe link in any email, or contact us at dpo@susdevos.com.
• Right to restrict processing — in limited circumstances, request that we restrict how we process your data. Contact dpo@susdevos.com.

To exercise any of these rights, email dpo@susdevos.com. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk if you believe we have not handled your data correctly.

4. Sub-processors

We use the following third-party services that process personal data on our behalf:

External data providers (DEFRA, Climatiq, GBIF, ECB, Companies House, Verra) receive only non-personal query data (activity types, species names, company registration numbers). They are not sub-processors for personal data.

We will notify you 30 days before adding a new sub-processor. The current sub-processor list is also available at susdevos.com/security.

5. International transfers

Our primary infrastructure is hosted in AWS UK/EU regions. Where data is transferred outside the UK/EEA (e.g. Sentry in the US), we rely on Standard Contractual Clauses (SCCs) or the UK's International Data Transfer Agreement (IDTA) as the transfer mechanism.

6. Cookies

The SusDevOS application uses one HttpOnly session cookie for authentication (your refresh token). This cookie is strictly necessary for the service to function and does not require consent under PECR. We do not use advertising or tracking cookies. Analytics, if used, are privacy-preserving and do not transmit personal data to third parties.

7. California residents (CCPA)

We do not sell or share your personal information with third parties for their own marketing purposes. California residents have additional rights under CCPA/CPRA. Contact dpo@susdevos.com to exercise these rights.

8. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email to registered users at least 14 days before they take effect. The latest version is always available at susdevos.com/legal/privacy.

9. Contact

For any privacy-related enquiries, contact our Data Protection Officer at dpo@susdevos.com or write to:

Data Protection Officer
SusDevOS Ltd
United Kingdom
dpo@susdevos.com