Privacy policy
What we collect, why we collect it, who else can see it, and what we will never do with it.
Last updated: 22 September 2026
1. Who this policy applies to
This policy covers two different things, and it is worth separating them.
This website. Anyone who visits it, reads a guide, or sends us an enquiry.
The service. Organisations that use BuildingSetup to manage buildings, and the people whose details those organisations record in it — residents, owners, tenants, staff, contractors and visitors.
For the service, the division of responsibility matters. You decide what information goes in, why, and for how long. We hold and process it on your instructions so that the service works. Where privacy law uses the words controller and processor, you are the controller of the records in your account and we are the processor.
If you are a resident or an owner and you want to know what is held about you, ask the organisation that manages your building first — they hold the record and they can change it. We will help them answer you.
2. Self-hosted and offline installations
BuildingSetup can be installed on a server you control, or entirely offline on one office computer. In those editions your building and resident information stays where you put it and is never transmitted to us. We hold only what you choose to send us separately — an enquiry, a support message, or a file you attach to one.
3. What we collect through this website
Details you give us. When you complete the demonstration or contact form we receive what you typed: your name, company, email address, telephone number, the number of buildings and units you manage, your preferred deployment, and your message. We use those details to reply to you and to arrange a demonstration, and for nothing else.
Information your browser sends. Like every website, ours records ordinary technical information when a page is requested: the network address you came from, the browser and device type, the page requested, the page that referred you, and the date and time. We use it to keep the site working, to understand which pages are useful, and to investigate abuse.
We do not ask for, and you should not send us, payment card details, national identity numbers or sensitive personal information through a form on a website.
4. Cookies and measurement
This site uses Google Analytics to count visits and see which pages people read. It sets cookies in your browser and reports usage information, including a shortened form of your network address, to Google, who process it on our instructions as our supplier. We use it to improve the site.
We do not run advertising cookies, we do not build advertising profiles, and we do not follow you around other websites. You can block or delete cookies in your browser settings, or install Google’s own opt-out extension; the site works normally either way. Google’s handling of that information is governed by their own privacy terms.
5. What we collect through the service
To give you an account we need the ordinary commercial details: the name of your organisation, the buildings you manage, the people you authorise to sign in, their names, email addresses and roles, and the billing details needed to invoice you.
Everything else in your account is information you chose to record, which typically includes resident and owner names and contact details, lease and ownership records, charges and payments, complaints and work orders, vehicles and parking bays, staff and attendance records, and documents you upload.
We also keep the records the service generates automatically so that questions can be answered later: who signed in, and who changed what and when.
6. Why we use information, and on what basis
We use personal information only for these purposes:
- to answer your enquiry and arrange a demonstration;
- to provide, operate, support, secure and back up the service;
- to detect, investigate and prevent fraud, abuse and unauthorised access;
- to invoice you and keep the accounting records the law requires us to keep;
- to tell you about changes to the service, about security matters and about renewals;
- to comply with a legal obligation or a lawful request from an authority.
Where the law that applies to you requires a lawful basis for each use, ours are: your consent (an enquiry you chose to send), the performance of a contract (running the service you bought), a legal obligation (tax and accounting records), and our legitimate interests in keeping the service secure and improving it — weighed so that they do not override your rights.
We do not sell personal information. We do not share it with anyone for their own advertising. We do not use the records in your account to market anything to your residents, and we do not use your information to train artificial intelligence models.
7. Who else can see it
Only the following, and only as far as necessary:
- Our own people, where they need access to support you, investigate a fault or keep the service secure. Access is limited to those who need it and is subject to confidentiality obligations.
- Suppliers who help us run the service — the data centre that hosts it, the service that sends its email, the service that stores uploaded documents, and the measurement provider named above. They act on our instructions and may not use the information for their own purposes.
- Professional advisers, such as our accountants or lawyers, where they need it in that capacity.
- An authority, court or regulator, where we are legally required to disclose. Where we are permitted to tell you first, we will.
- A buyer, if the business or part of it is ever sold or reorganised, under obligations no weaker than those in this policy.
8. Where information is held
For the cloud edition, information is held on servers operated by established hosting providers, which may be in a country other than yours. Where information moves between countries we take reasonable steps to see that it remains protected to the standard described in this policy, including contractual protections with our suppliers.
For self-hosted and offline editions, you choose where it is held, and it stays there.
9. How long we keep it
- Enquiries — for up to twenty-four months from your last contact with us, then deleted, unless you became a customer.
- Account and building records — for as long as you are a customer. When you leave we will provide an export on request and then delete the information within ninety days, except anything we must keep by law.
- Website and security records — for a short period, normally measured in months, then discarded or reduced so that individuals are no longer identifiable.
- Invoices and accounting records — for the period the applicable tax law requires.
Backups are cycled, so deleted information may persist in a backup for a short further period before it is overwritten.
10. Security — and an honest caveat
We take reasonable technical and organisational measures to protect information: traffic to the service is encrypted in transit, access is restricted by role and by account, administrative access is limited and recorded, and backups are taken regularly.
The caveat matters, and we would rather state it than let silence imply otherwise. No website, network or system can be guaranteed completely secure. We cannot and do not warrant that information will never be lost, disclosed or altered by an event outside our reasonable control, and you send information to us over the internet at your own risk. Keeping your own passwords and access confidential is your responsibility.
If you believe an account has been compromised, or you have found a security weakness, write to info@buildingsetup.com and we will take it seriously.
11. Your rights
Subject to the law that applies to you, you may ask us to:
- tell you what personal information we hold about you and why;
- give you a copy of it;
- correct it if it is wrong or incomplete;
- delete it, where we have no continuing legal or contractual reason to keep it;
- restrict or stop a particular use of it;
- withdraw a consent you previously gave, at any time.
Write to info@buildingsetup.com. We will respond within a reasonable period, normally thirty days. We may need to confirm who you are before we act, and we may decline a request that is unlawful, that would reveal somebody else’s information, or that is repeated to the point of being abusive. If we decline, we will say why. You may also complain to the data protection authority in your own country.
Where the record belongs to a building managed by one of our customers, the request goes to that customer and we assist them with it.
12. Children
This website and the service are for businesses and are not directed at children. We do not knowingly collect personal information from a child through this website. A resident record kept by one of our customers may include a family member who is a minor; that record is the customer’s responsibility and is held on their instructions.
13. Other websites
Where we link to another website, that site has its own privacy practices and we are not responsible for them. Read their policy before giving them anything.
14. Changes to this policy
We may update this policy as the service changes or as the law does. The version on this page is the current one and carries the date it was last updated. If a change materially affects how we handle information for customers, we will tell them directly rather than rely on a quiet edit.
15. Contact
Questions about this policy, or about information we hold: info@buildingsetup.com. A person will read it and reply.