Privacy Policy — Padlife

Version privacy-2026-09-23b · Effective [[date]] · Applies to the Padlife app (residents, owners, security officers), the Padlife Manager dashboard, Padlife Admin and the Padlife website.

Padlife is part of the Svello ecosystem. Svello builds software for the whole life of a home — finding it, buying or renting it, and living in it — and Padlife is the part for living in it: an app for the residents, owners, security teams and managers of residential buildings. Padlife is provided by Svello ([[Svello legal entity name]], registered in England and Wales, company no. [[ ]]) and, in each country where Padlife operates, by the local Svello operating company ([[Svello Qatar entity]] · [[Svello UAE entity]]) — together "Svello", "we", "us".

This policy explains what personal data Padlife collects, why, who sees it, how long we keep it, and your rights. It is written to meet the UK GDPR and Data Protection Act 2018, the Qatar Personal Data Privacy Protection Law (Law No. 13 of 2016), and the UAE Personal Data Protection Law (Federal Decree-Law 45 of 2021). Annex A covers Qatar and Annex B the UAE. [[An Arabic version is available at …]]

Who is responsible for your data

• Your building's management company (or owners' association, developer or landlord that runs your building) decides why building data is used — who lives where, requests and tickets, visitors, door-unlock events, patrols, incidents, community posts, rent and service-charge status. It is the controller of that data; Svello processes it on its instructions. Its contact details are shown in the app under My building → Privacy.
• Svello is the controller for your Padlife account, the security of the platform, our own payment records and our legal obligations. Registered office: [[UK address]]. Qatar: [[entity / commercial registration]]. UAE: [[entity / licence]]. UK ICO registration: [[number]].

How to reach us: [[privacy@svello.co.uk]] · [[postal address]] · Data Protection Lead / DPO: [[name or provider]].

---

1. What we collect and why

We do not sell personal data, use advertising SDKs, or track you across other companies' apps. Padlife does not use AI to profile residents, and your building data is not used for Svello's property-search services.

---

2. Who we share it with

• Your building's management company, its managers and its security staff — as the controller of building data, and only as their role needs (see §10).
• Other residents of your building — what you post to the community, and your name and unit if you choose to show them.
• Service providers that host and run Padlife under contract with Svello: database and hosting (Supabase on AWS, London; Render; Cloudflare), file storage ([[provider, region]]), email and SMS delivery ([[email provider]], Twilio), push notifications (Google Firebase / Apple), app build and update tooling (Expo), error monitoring ([[Sentry]]), payment processing (Stripe; in Qatar and the UAE [[licensed payment provider]]; Mollak for Dubai service charges).
• Other Svello companies, which run Padlife in each country and share staff and systems, under an intra-group agreement — never for advertising or for Svello's property-search services without your separate choice.
• Regulators, courts and law enforcement where the law requires or allows (for example a valid court order, the ICO, Qatar's National Cyber Security Agency, the UAE Data Office, or police investigating a crime).
• A buyer of our business, if we are acquired, under the same protections.

Each provider is bound by a written contract that limits what it may do with the data (UK GDPR Article 28; Qatar PDPPL; UAE PDPL Article 7).

---

3. International transfers

Padlife's main systems are in the United Kingdom. Some providers process data in the United States (Google/Firebase, Twilio, Stripe, Expo) and, for local payments, in Qatar or the UAE.

• UK users: transfers outside the UK rely on the UK–US Data Bridge (for certified providers), the UK International Data Transfer Agreement / Addendum, or another lawful mechanism, with a transfer risk assessment on file.
• Qatar and UAE users: your data is transferred to the UK (and to the providers above) under contractual protections — see Annex A and Annex B. You can ask us for the list of countries and safeguards at any time.

---

4. How long we keep it (summary)

Your management company may keep building records longer where its own legal duties require. Backups are overwritten within 35 days. The full schedule is available on request.

---

5. Your rights

You can, free of charge:

• See and download your data — in the app: Settings → Privacy & legal → Download my data. The download includes a record of who at Svello or your building read your sensitive records (such as your building's access log), when and why;
• Correct it; delete your account — Settings → Privacy & legal → Delete my account, or at https://[[padlife domain]]/account/delete without the app;
• Object to processing based on legitimate interests — we will stop unless we have compelling grounds;
• Withdraw consent at any time (marketing, the Good Neighbour board, notification types) — Settings → Notifications, Settings → Privacy & legal and the Good Neighbour screen;
• Restrict processing while a dispute is resolved; ask for portability of data you gave us;
• Not be subject to solely automated decisions with legal or similarly significant effects — Padlife makes none;
• Complain: first to us at [[privacy@svello.co.uk]] — we acknowledge within 30 days and tell you the outcome; then to the ICO (ico.org.uk, 0303 123 1113), Qatar's National Cyber Security Agency ([[contact]]) or the UAE Data Office ([[contact]]).

We answer requests within one month (extendable by two for complex requests; we may pause the clock while we ask you to clarify). Requests about building data are passed to your management company within 5 days and we help it respond.

---

6. Automated decisions

Padlife does not make automated decisions about you and does not profile residents. Good Neighbour points are private to you and only count help another neighbour confirms — a favour they mark as done, a thank-you they send, an event whose host checks you in. The monthly building board shows your first name, initial and points only if you switch it on, and you can switch it off at any time. Points have no cash value and never affect your tenancy, access or payments. Security officers and building staff are never scored or ranked.

7. Children

Padlife accounts are for adults (18+). Children who live in a building may be mentioned in content adults create (for example a visitor pass or an incident report); we do not knowingly create accounts for under-18s, and if we learn we have, we delete them. Contact us if you believe a child has an account.

8. Security

Encryption in transit and at rest, role-based access with a separate approval for sensitive records, multi-factor authentication for staff and company administrators, a tamper-evident log of administrative actions, regular testing and a tested incident-response plan. No system is perfectly secure; if a breach is likely to affect you, we will tell you and the regulator as the law requires.

9. Changes

We will notify you in the app and by email of material changes at least 14 days before they take effect, and ask you to accept new terms where required. Previous versions are available on request.

---

10. Your building and Padlife

Building data, controlled by your management company: your name, unit, tenancy or ownership status, requests and tickets, amenity bookings, visitor passes you create (including the visitor's name and arrival and departure times), parcels logged for you, door-unlock events, community posts, chat, incident reports and SOS alerts, rent and service-charge status. The management company uses it to run the building; Svello processes it for them and to keep the platform secure.

Who sees what

• Residents see what is posted to their building's community, their own records, and — only their own — access and visitor history. Never another resident's.
• Security officers see visitor passes and parcels for their building, the name and unit needed to reach a resident for a visitor, incidents and SOS alerts. Not resident contact details beyond that, tickets or payments.
• Managers see their buildings' residents, tickets, bookings, rent status, visitors and incidents. They can read a building's door-access log only with a reason and a case reference, approved by a company administrator, for 60 minutes — every read is logged and shown in your data download.
• Svello staff see only what their role needs; reading a sensitive record needs a case reference and a second person's approval, and is logged. Support staff may temporarily access a manager's dashboard to help them; each access needs a case reference, lasts 30 minutes, is logged, and the manager is told.

Security officers: your shifts, clock-in/out and patrol checkpoint scans are recorded for your employer (the management or security company) to prove patrols and manage rosters.

Visitors (people who are not users): the host resident gives us your name and optionally phone; we record entry and exit so the building knows who is inside; kept 12 months; you may ask the management company or us to see or delete it.

Payments: rent and service charges are processed by our payment provider; owners' payout details are held by the provider, not by us. In Dubai, service charges are paid through the Mollak system into RERA-supervised accounts.

Community: what you post is visible to residents of your building and its managers. The Good Neighbour board is opt-in; your building's manager sees building totals only, never your points. You can report any post or message and block other residents; our Trust & Safety team and your building's manager review reports.

Incident reports may describe events involving other people; we restrict who can see them, keep them for 6 years for safety and legal reasons, and share them with police only on a lawful request.

Notifications: pushes about visitors, safety, messages, money and your account show a short generic line on your lock screen; the detail is only inside the app. You choose which kinds you receive and your quiet hours in Settings → Notifications; safety and security alerts always come through.

---

Annex A — Qatar

For users in Qatar: the Personal Data Privacy Protection Law (Law No. 13 of 2016) applies, supervised by the National Cyber Security Agency. You have the rights in section 5, including to withdraw consent, to object, to have your data corrected or erased, and to be told how your data is processed. Your data is stored in the United Kingdom and with the providers in section 3; Svello does not restrict or impede the protection of your data when it is transferred, and transfers are made under contractual safeguards. We do not process data of a special nature (for example health or criminal records) except incident and SOS records needed for safety, handled under the permissions the law requires. If our Qatar entity is established in the Qatar Financial Centre, the QFC Data Protection Regulations 2021 apply to it instead and the QFC Data Protection Office is the supervisory authority. [[Confirm entity with Qatari counsel and delete the inapplicable sentence.]]

Annex B — UAE

For users in the UAE: the UAE Personal Data Protection Law applies. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Your data is stored in the United Kingdom and with the providers in section 3, under contractual safeguards; by creating an account you consent to these transfers as described. You have the rights in section 5, including to object to automated processing and to complain to the UAE Data Office. If our UAE entity is established in the DIFC or ADGM, the DIFC Data Protection Law 2020 / ADGM Data Protection Regulations 2021 apply to it instead, and the relevant Commissioner is the supervisory authority. [[Confirm entity and delete the inapplicable sentence.]]