Privacy Policy

1. Data Controller

The entity responsible for the processing of your personal data (the data controller) is:

Syncrent Technologies Limited
Piazzale Biancamano 8
Milano MI 20121
Italy

Email: legal@syncrent.io
Registration number: 16876112 (England and Wales)
ICO Registration: ZC068780

2. Data Protection Officers

Syncrent has appointed Data Protection Officers (DPOs) for the EU and for England and Wales to ensure that personal data is handled in compliance with applicable law. You may contact our DPOs directly for any data protection concerns.

EU Data Protection Officer

DP-Dock DPO Services GmbH
Grüffkamp 10
24159 Kiel
Germany

Email: syncrent@dp-officer.com
Phone: +49 (0)40 9999 93430

UK Data Protection Officer

Bulletproof Cyber Ltd
Unit H, Gateway 1000
Whittle Way, Stevenage
Herts SG1 2FP
United Kingdom

Email: dposupport@worknest.com

3. Our Approach to Privacy

Syncrent is deeply committed to privacy, security, and compliance. Where feasible, we use self-hosted infrastructure or EU-based processors rather than large US-based cloud providers. We apply a data minimisation approach throughout our operations: we collect only what we need, retain it only for as long as necessary, and share it only with processors who provide adequate safeguards.

4. Data We Collect and Why

This section describes the categories of personal data we process, the purposes for which we process them, and the legal bases we rely on.

4.1 Website Visitors

When you visit our website, our infrastructure providers process technical data such as your IP address, browser type, operating system, referring URL, and the pages you visit. This data is used to ensure the technical availability and security of our website and is not used to create personal profiles.

Legal basis: Legitimate interests under Article 6(1)(f) GDPR and UK GDPR (ensuring website security and functionality) / Article 31(1) revDSG (legitimate interests).

4.2 Analytics

We use Pirsch Analytics to understand how visitors use our website. Pirsch Analytics is cookieless by design and does not track users across websites or create individual user profiles. It processes aggregated statistical data such as page views, referrer sources, and device types. No personal data is linked to individual users in our analytics.

Legal basis: Legitimate interests under Article 6(1)(f) GDPR and UK GDPR (understanding website usage in order to improve our services and user experience) / Article 31(1) revDSG.

4.3 Contact and Inquiries

When you contact us via our contact form, by email, or through forms hosted on Heyflow or OnePage, we process your name, email address, and the content of your message. We use this data to respond to your inquiry and, where applicable, to manage an emerging or existing business relationship with you.

Legal basis: Performance of a contract or pre-contractual steps under Article 6(1)(b) GDPR and UK GDPR (where the inquiry relates to our services) as well as legitimate interests under Article 6(1)(f) GDPR and UK GDPR (responding to inquiries and managing relationships) / Article 31(1) revDSG.

4.4 Newsletter and Marketing Emails

If you subscribe to our newsletter, we process your email address and, where provided, your name. We use Pipedrive and Lettermint to manage our newsletter and transactional email distribution. You may unsubscribe at any time by clicking the unsubscribe link at the bottom of any marketing email or by contacting us directly.

Legal basis: Consent under Article 6(1)(a) GDPR and UK GDPR / Article 31(1) revDSG. You may withdraw your consent at any time without affecting the lawfulness of any processing that took place before withdrawal.

4.5 CRM and Sales Activity

If you engage with us in a business context (for example, by requesting a demo, attending a sales call, or as a prospective or existing customer), we store relevant contact details and communication history in our CRM system (Pipedrive). This data is used to manage our commercial relationship with you and to follow up on opportunities or requests.

Legal basis: Performance of a contract or pre-contractual steps under Article 6(1)(b) GDPR and UK GDPR as well as legitimate interests under Article 6(1)(f) GDPR and UK GDPR (managing business relationships) / Article 31(1) revDSG.

4.6 Electronic Contracts and Signatures

When you enter into a contract with us, we may use Paperless to manage contract execution and collect electronic signatures. In this context, we process your name, email address, and electronic signature.

Legal basis: Performance of a contract under Article 6(1)(b) GDPR and UK GDPR / Article 31(1) revDSG.

4.7 Payments

When you make a payment to us, we use Mollie and/or Stripe as our payment service providers. These providers process your payment details directly and securely. We receive only the minimum information necessary to confirm and record the transaction (such as your name, the amount, and an invoice reference). We do not store full payment card data on our systems.

Legal basis: Performance of a contract under Article 6(1)(b) GDPR and UK GDPR as well as compliance with legal obligations (tax and accounting law) under Article 6(1)(c) GDPR and UK GDPR / Article 31(1) revDSG.

4.8 Identity Verification

For certain services or as required by applicable regulations, we may need to verify your identity. We use Veriff as our identity verification provider. Veriff may process government-issued identity documents and biometric data (such as a live selfie) on our behalf. This processing is also subject to Veriff's own privacy notice, which is available on their website.

Legal basis: Compliance with legal obligations under Article 6(1)(c) GDPR and UK GDPR as well as performance of a contract under Article 6(1)(b) GDPR and UK GDPR. Where biometric data is processed, explicit consent under Article 9(2)(a) GDPR and UK GDPR will be obtained / Article 31(1) revDSG.

4.9 Help Desk and Customer Support

When you contact our support team, we process your name, email address, and the details of your support request. We retain support tickets to resolve your issue and to maintain a record for quality assurance and audit purposes.

Legal basis: Performance of a contract under Article 6(1)(b) GDPR and UK GDPR as well as legitimate interests under Article 6(1)(f) GDPR and UK GDPR (resolving support requests and improving service quality) / Article 31(1) revDSG.

4.10 Trust Center

Our Trust Center at trust.syncrent.io is hosted by Wolfia. It provides information about our security and compliance posture and allows you to request our Data Processing Agreements (DPAs). If you submit a request through the Trust Center, we process your name and email address in order to fulfil your request.

Legal basis: Performance of a contract or pre-contractual steps under Article 6(1)(b) GDPR and UK GDPR (for DPA requests) as well as legitimate interests under Article 6(1)(f) GDPR and UK GDPR / Article 31(1) revDSG.

4.11 Status Page and Incident Notifications

We use Statuspal to operate our public status page and communicate planned maintenance and incidents. If you voluntarily subscribe to status notifications, we process your email address for that purpose.

Legal basis: Consent under Article 6(1)(a) GDPR and UK GDPR / Article 31(1) revDSG.

4.12 Captchas and Bot protection

We use FriendlyCaptcha on certain forms to verify that submissions originate from humans rather than automated bots. FriendlyCaptcha operates without tracking cookies and is designed with privacy in mind. It processes limited technical data (such as a puzzle challenge response) and does not build user profiles.

Legal basis: Legitimate interests under Article 6(1)(f) GDPR and UK GDPR (protecting our systems from abuse and spam) / Article 31(1) revDSG.

4.13 Internal AI Tooling

We use Langdock as an internal platform for accessing and working with Large Language Models (LLMs). Langdock processes data only on our instructions and within EU-based infrastructure. We have implemented internal policies to ensure that personal data is not unnecessarily introduced into LLM prompts.

Legal basis: Legitimate interests under Article 6(1)(f) GDPR and UK GDPR (improving internal operational efficiency) / Article 31(1) revDSG.

4.14 System Backups

We use Proton AG to store encrypted cold backups of our systems. Backup data is encrypted before transmission and Proton AG has no access to the contents of these backups.

Legal basis: Legitimate interests under Article 6(1)(f) GDPR and UK GDPR (ensuring data resilience and business continuity) / Article 31(1) revDSG.

5. Cookies and Local Storage

We are committed to a minimal cookie footprint. We do not use any advertising or tracking cookies.

Session Cookies (strictly necessary)

We use session cookies that are strictly necessary to operate certain functions of our website. These cookies are temporary and are automatically deleted when you close your browser. They do not collect any personal data that is stored after your session ends and are not used for tracking or profiling.

Local Storage

Some features of our website use local storage (a browser storage mechanism) to remember preferences such as display settings. Data stored in local storage is not transmitted to third parties and is stored only in your browser.

Live Chat Cookies

Our live chat widget may set cookies when you actively engage with it. These cookies are used solely to maintain the continuity of your chat session. The live chat is operated entirely on our own infrastructure and no data is transmitted to any third party. The cookies are set only when you interact with the live chat and are deleted when your session ends.

Analytics (Cookieless)

Our website analytics provider, Pirsch Analytics, does not use cookies and does not track users across websites. It processes only aggregated, anonymised data.

Because we use only strictly necessary session cookies and do not deploy non-essential cookies (except for live chat cookies activated by your own interaction), we do not display a cookie consent banner for most uses of our website. You may delete or block cookies through your browser settings at any time.

6. Data Processors

We share personal data with the following third-party service providers who act as data processors on our behalf. All processors are bound by Data Processing Agreements (DPAs) and are required to process personal data only on our instructions and to maintain appropriate technical and organisational security measures. Our DPAs are available for download from our Trust Center .

7. International Data Transfers

Our core infrastructure is located in the EU or Switzerland. However, some of our service providers are based in or may transfer data to countries outside the European Economic Area (EEA), the United Kingdom, or Switzerland (for example, the United States). The United States is not currently subject to an adequacy decision under the UK GDPR.

Where personal data is transferred to third countries, we ensure that appropriate safeguards are in place, including one or more of the following:

• Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) GDPR
• UK International Data Transfer Agreements (IDTAs) or UK Addenda to SCCs, where the transfer originates from the UK
• Adequacy decisions where the recipient country has been deemed to provide an adequate level of data protection
• Other appropriate safeguards under Article 46 GDPR

You can request copies of our Data Processing Agreements (DPAs), including applicable transfer mechanisms, at our Trust Center: trust.syncrent.io

8. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy and to comply with our legal obligations. The following indicative retention periods apply:

After the applicable retention period, personal data is deleted or anonymised. Where deletion is not immediately possible (for example, because data is contained in backup archives), the data will be securely isolated and deleted as soon as technically feasible.

9. Your Rights

Depending on where you are located, you have the following rights regarding the processing of your personal data. We will respond to any request within 30 days (or within one month as required under GDPR). If we need to extend this period, we will notify you in advance.

9.1 Rights under EU GDPR

If you are located in the European Union or the European Economic Area, you have the following rights under Regulation (EU) 2016/679 (the GDPR):

• Right of access (Art. 15 GDPR): You have the right to obtain confirmation of whether we process personal data about you and, if so, to receive a copy of that data together with further information about the processing.
• Right to rectification (Art. 16 GDPR): You have the right to have inaccurate personal data corrected and incomplete personal data completed.
• Right to erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data, subject to applicable legal exceptions (for example, where retention is required by law).
• Right to restriction of processing (Art. 18 GDPR): You have the right to request that we restrict the processing of your personal data in certain circumstances (for example, while you contest the accuracy of the data).
• Right to data portability (Art. 20 GDPR): Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to have it transmitted to another controller where technically feasible.
• Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data where that processing is based on legitimate interests, including any profiling based on legitimate interests.
• Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with the competent supervisory authority in your EU member state of habitual residence, place of work, or place of the alleged infringement. A list of EU supervisory authorities is available at: edpb.europa.eu

9.2 Rights under UK GDPR

If you are located in the United Kingdom, you have equivalent rights under the UK GDPR (the retained version of the EU GDPR as part of UK law) and the Data Protection Act 2018, including all rights listed in section 9.1 above as they apply under UK law. In addition:

• Right to lodge a complaint: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

9.3 Rights under Swiss revDSG

If you are located in Switzerland, you have the following rights under the revised Federal Act on Data Protection (Datenschutzgesetz / revDSG):

• Right of access: You have the right to request information about whether and how we process personal data about you.
• Right to rectification: You have the right to have inaccurate personal data corrected.
• Right to erasure: You have the right to request the deletion of your personal data where processing is unlawful or no longer necessary.
• Right to restriction: You have the right to request restriction of processing in certain circumstances.
• Right to data portability: Where applicable, you have the right to receive your personal data in a machine-readable format.
• Right to object: You have the right to object to certain types of processing.
• Right to lodge a complaint: You have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch

10. How to Exercise Your Rights

You can exercise any of your rights by using one of the following channels:

• Data Request Form: syncrent.io/data-request/ (preferred)
• Email: legal@syncrent.io
• Contact Form: syncrent.io/contact/

We will respond to your request within 30 days of receipt. In complex cases or where we receive a high volume of requests, we may extend this period by a further two months. We will inform you of any extension and the reason for it within the initial 30-day period.

In order to protect your personal data, we may need to verify your identity before we can process your request. We will aim to make this verification process as straightforward as possible.

11. Security

Syncrent takes the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration. These measures include encryption in transit (TLS) and at rest, access controls, DDoS protection, regular backups, and ongoing security monitoring. Our security practices and certifications are documented in our Trust Center at trust.syncrent.io.

12. Children

Our website and services are not directed at children under the age of 16, and we do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data relating to a child, please contact us immediately using the details in section 14 and we will take steps to delete such data.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, applicable law, or our services. The date of the most recent update is shown at the bottom of this page. We encourage you to review this Privacy Policy periodically.

Where changes are material, we will take additional steps to inform affected data subjects, for example by placing a notice on our website or by sending a notification to affected individuals where we hold their contact details and it is appropriate to do so.

14. Contact

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us:

Email: legal@syncrent.io
Contact form: syncrent.io/contact/
Data request form: syncrent.io/data-request/

Syncrent Technologies Limited
Piazzale Biancamano 8
Milano MI 20121
Italy

Last updated: 15.02.2026