Data Processing Agreement

This agreement applies when SynCore ("we") processes personal data contained in the files and content that a customer ("you") stores in SynCore services. It applies where you use SynCore for a business or organisation, or otherwise store other people’s personal data in it as a controller; if you use SynCore only for your own personal or household purposes, our Privacy Notice explains how we handle your data. It forms part of our Terms of Service and takes effect when you accept them. It is written to meet Article 28 of the GDPR and laws based on it and the Data Protection Act 2017 of Mauritius.

1. Roles

You are the controller of the personal data in your files. We are your processor. For account, billing and support data we are a controller; see our Privacy Notice.

2. What we process

• Subject matter: storing, organising, sharing and returning files you upload.
• Duration: for as long as you use the service, and until deletion under section 9.
• Data subjects and types: whatever personal data you choose to store in your files. We don’t look at the contents except as needed to provide the service, keep it secure, or comply with the law.

3. Your instructions

We process the data only on your documented instructions, which are these terms and your use of the service’s features. If we think an instruction breaks the law, we tell you. If the law requires us to process the data otherwise, we tell you first unless the law forbids it.

4. Confidentiality

Everyone at SynCore who can access the data is bound by confidentiality.

5. Security

We apply the measures described in our Security Overview, including encryption in transit and at rest, access control, two-step verification for staff and an append-only activity log.

6. Subprocessors

You authorise us to use the subprocessors listed on our Subprocessors page. We tell you at least 30 days before adding or replacing one that handles your files. If you object on reasonable data protection grounds and we can’t address it, you may end the affected service and we refund any prepaid fees for the unused period. We impose the same data protection obligations on each subprocessor and remain responsible for them.

7. Helping you

We help you, as far as we reasonably can, to respond to requests from data subjects, and with security, breach notification, impact assessments and consultations with authorities.

8. Breaches

If we become aware of a personal data breach affecting your data, we tell you without undue delay and in any case within 48 hours, so you can meet any duty to notify the Data Protection Commissioner of Mauritius or another authority, with the information we have.

9. Deletion and return

You can download your files at any time. When the service ends, your files remain available to download for at least 30 days and are then deleted, unless the law requires us to keep them.

10. Audits

We make available the information needed to show we meet this agreement. You may audit us (or appoint an independent auditor) once a year, with 30 days’ notice, at your cost, in a way that protects other customers’ data and our security.

11. International transfers

Your files are stored in the European Economic Area. Where personal data is transferred to a country without an adequacy decision, we use standard contractual clauses or another lawful safeguard.

12. Liability and law

The liability limits in the Terms of Service apply. This agreement is governed by the laws of the Republic of Mauritius, and the courts of Mauritius have jurisdiction, unless data protection law requires otherwise.