Privacy Policy

Sudanna ("we", "us") is a community platform for Sudanese people in the UK, bringing sports, social events, market place, services, jobs, news, a forum and a directory of Sudanese bodies together in one place, on the website and in our iPhone and Android apps. This policy explains what data we collect from you, why we collect it, and your rights over it.

What we collect

• Account data: your name (and optional Arabic name), email address, and a hashed password.
• Content you create: Market Place listings, Services Hub listings, job postings, events, News submissions, forum questions, initiatives, posts and comments, photos you add to them, messages, and reviews.
• Drafts: while you write something in the app or on the website, we save an unsent draft of it on our servers so you do not lose it. Drafts are private to you, never shown to anyone else, and can be deleted from My drafts; they are deleted automatically when you send the item or delete your account. Photos are not saved in drafts.
• Sudanese body applications: the details you enter (names, description, address, public contact email and phone, website, registration number and a link to its public record, year founded), the logo and cover photo, the proof document you upload, the consent you accepted (when, and which wording) and the messages between you and our review team, with any document you attach. The proof document is kept on private storage and opened only by our review team, and the registration number is seen only by our team. Once a body is recognised, its public details, logo, cover photo, announcements and public events are shown on its public page. If you ask to join a body, your name and the note you write are seen by that body’s committee; a body’s member list is private to its committee, and the public sees only a count, if the body chooses to show one.
• Sports clubs and players: a captain enters a club’s details and photos and, for each player, a name (and Arabic name), shirt number, position, photo, date of birth, nationality and a short bio, together with the club’s honours and news. These are shown on the public club and player pages. The captain is responsible for having each player’s permission; to have your details corrected or removed, email [email protected].
• Reservations and waiting lists: the name and email address you give, the number of places and a reservation code. The event’s organiser sees them; for guests without an account they are erased 180 days after the event ends, as with tickets.
• Link previews: when a page is shared, we make and keep a resized copy of its cover, logo or photo (which is already public) so that WhatsApp, Facebook and similar apps can show it. It holds nothing the page does not already show.
• CV files: if you use the Jobs section as a Job Seeker, your CV is stored on private storage — accessible only to you and the employers you've actually applied to.
• Payment data: when you buy a paid listing or a ticket, payment is handled entirely by Stripe. We never see or store your card details.
• Payout bank details (organisers): if you run a paid event, the UK bank account you ask us to pay your ticket money into (the name on the account, sort code and account number). It is stored encrypted, used only to pay you, shown back to you only as its last four digits, and seen by our finance administrators only when a payout is made. You can edit or delete it at any time.
• Your choices (optional): the city and the sections you say you care about (events, sports, jobs and so on), so we can show what is nearest and most relevant first. They are kept on your device and, if you have an account, on your account. You can change or clear them any time, and they are removed if you delete your account. We never use your phone’s location for this.
• Supporter profile (if you support Sudanna): the name you choose, and optionally a photo, a website, a one-line description and up to six services, and whether you say you are a Sudanese business. These are shown publicly on the Supporters page (your website only if you are in the top three, and the “Sudanese business” badge only after our team has checked it). The total you have given is shown beside your name and decides your place. You can choose to appear as “Anonymous supporter”: your name, photo, description, services and links are then hidden everywhere, and your gift still counts. We keep records of gifts (amount, date and payment reference) as financial records.
• Staff accounts: staff sign in with a one-time code from an authenticator app (its secret is stored encrypted), and what staff do (approving, rejecting, suspending and so on) is logged with the date, the person, the phone model and the app version, for security and accountability. The staff area in the app can be locked with Face ID, Touch ID or the phone’s passcode; that check is done by your phone, and we never receive or store biometric data.
• Technical data: IP address and server logs for security and abuse prevention, and your preferred language (English/Arabic), saved via a cookie.

Why we use your data

We use your data to run the platform itself: displaying your listings, enabling communication between users, processing payments, sending relevant notifications (email verification, a new message, a job application status change, and so on), and preventing abuse and fraud. Our legal basis is performance of our contract with you (the Terms of Service) and our legitimate interest in keeping the platform safe.

Who sees your data

Your public listings (Market Place, Services Hub, Jobs, Events, published News) are visible to any visitor. Private messages are only visible to the other party in the conversation, and the messages between a body’s submitter and our review team only to them and the team. We don't sell your data. We share the minimum necessary with Stripe (to process payments) and our email provider (to send notifications). Only if you choose Accept on the cookie banner, Google (Google Ads) also receives your IP address and information about the pages you visit so we can measure our advertising; that does not happen if you reject.

Data retention

We keep your data for as long as your account is active. When you delete your account, your personal data is permanently removed, except where we're required to retain records for accounting or legal purposes (e.g. transaction records).

If you buy event tickets as a guest (without an account), the name and email you give at checkout are kept only as long as they're needed to run the event, handle refunds and reconcile the organiser's payout — and in any case no longer than 180 days after the event ends, after which they're erased from our ticket and order records automatically.

Your rights

Under UK GDPR, you have the right to access, correct, delete, and port your data. You can download a copy of your data at any time from your "My Profile" page on the website or from Account → Download my data in the apps, and delete your account entirely from the same place. For any other privacy query, email us at [email protected].

Cookies

See our Cookie Notice for full details.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page will always reflect the latest version.

Contact us

For any question about this policy or your data, email us at [email protected].