Privacy Notice

This Privacy Notice explains how SynCore, trading as SynCore ("SynCore", "we", "us"), collects, uses, shares and protects personal data. We comply with the Data Protection Act 2017 of Mauritius. Where the European General Data Protection Regulation (GDPR), or a law based on it, applies to how we handle your data, we comply with it too.

1. Who we are and how to contact us

SynCore is a Global Business Company incorporated in the Republic of Mauritius, Company No. 240463, holding Global Business Licence [GBC LICENCE NO.]. Registered office: Suite 803, 8th Floor, Hennessy Tower, Pope Hennessy Street, Port Louis 11328, Mauritius.

• Data protection questions and requests: privacy@syncoretech.net
• Complaints: complaints@syncoretech.net
• General support: support@syncoretech.net

Controller. For account, billing, support, website and security data, we are the controller.

Processor. For the files and content our customers store in SynCore Cloud, or that we handle while doing work by quote, the customer is the controller and we are the processor. We handle that data only on the customer’s instructions, under our Data Processing Agreement. If your data is in a customer’s files, please contact that customer first.

2. Personal data we collect

• Account details: name, email address, organisation name (if you sign up for a business), password (stored only as a secure hash), two-step verification settings, time zone and display preferences.
• Billing details: your name and address (or your business name, address, registration and tax numbers), billing contacts, invoices, payments received and refunds made, the bank reference on a transfer, and the country evidence we need for tax.
• Identity and eligibility checks: where we ask for them, details that confirm who you are and where you live or are based (for example an ID document or proof of address), and the results of sanctions screening.
• Support, quotes and complaints: tickets, messages, requests, quotes and complaints, including what you write to us.
• Chats with SynCore Assistant: the questions you type into the "Ask SynCore" chat on our website or in your account, the answers it gave, any feedback you give and your IP address (used for abuse limits). If you are signed in, the chat is linked to your account. If you ask us to pass a chat to our team, we also keep the name and email address you give us.
• Security and activity records: sign-ins, IP address, browser type, and a log of actions in your account (for example uploads, shares and billing changes).
• File metadata: names, sizes and folders of stored files. The contents belong to the customer (see section 1).

We do not collect special categories of personal data (such as health data) on purpose. Please do not send them to us in tickets. We do not buy personal data, sell it, or use it for advertising.

3. Payment card data

Today we take payment by bank transfer. We do not collect, see or store payment card numbers, expiry dates or security codes. If we offer card or other online payment in future, card details will be entered only on the secure page of a licensed payment provider or acquiring bank, which is responsible for keeping them in line with the card industry security standard (PCI DSS). We would receive only the result of the payment and limited details such as the last four digits and card type. We will update this notice before any such method goes live.

4. Why we use personal data, and our legal basis

Where we rely on legitimate interests, we have balanced them against your rights, and you can object (see section 9). We do not send marketing emails. If we ever want to, we will ask for your consent first, and you can withdraw it at any time.

SynCore Assistant runs entirely on our own servers: chats are not sent to any outside AI provider and are not used to train AI models. Answers about your own invoices, storage or tickets are written by our system from your account; no account data is given to the language model. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

5. Who we share it with

We share personal data only:

• with the service providers that help us run SynCore, listed on our Subprocessors page, each bound by a written contract that protects the data;
• with our bank, and any payment provider we use, to receive payments, make refunds and respond to payment disputes;
• with professional advisers (such as accountants, auditors and lawyers) who are bound by confidentiality;
• with courts, regulators, law enforcement and other public authorities where the law requires it, or to establish, exercise or defend legal claims;
• with a buyer or successor if our business is reorganised or sold, under equivalent protection.

6. International transfers

We are based in Mauritius. Our application servers and file storage are located in the European Economic Area. Some providers may process data in other places. Where personal data is transferred out of Mauritius, or out of a region whose law restricts transfers, we do so only as the Data Protection Act 2017 and any other applicable law allow, for example by using standard contractual clauses or relying on an adequacy decision. You can ask us for details at privacy@syncoretech.net.

7. How long we keep it

• Invoices, payments, refunds and accounting records: 7 years after the end of the financial year they relate to.
• The account activity and security log: 7 years.
• Records of identity and eligibility checks: as long as the law that requires them says, and otherwise while your account is open and for up to 7 years after it closes.
• Account, support and complaint records: while your account is open and for up to 2 years after it closes, unless we need them longer for a legal claim.
• Chats with SynCore Assistant: 90 days after the last message, then deleted automatically. A chat passed to our team is kept like other support records.
• Ended sessions and used sign-in links: about 30 days. Sent email content: 90 days.

8. Security

We protect personal data with encryption in transit and at rest, access controls, two-step verification for staff and an append-only activity log. More detail is in our Security Overview. No system is completely secure, but we work to keep risks low and review our measures regularly.

If a personal data breach occurs, we notify the Data Protection Commissioner of Mauritius within 72 hours of becoming aware of it where the law requires, and we tell affected people without undue delay where the breach is likely to put their rights at high risk.

9. Your rights

Under the Data Protection Act 2017 and, where it applies, the GDPR, you can ask us:

• for access to your personal data and a copy of it;
• to correct inaccurate data;
• to erase your data;
• to restrict how we use it, or object to our use based on legitimate interests;
• to give you your data in a portable format, where the law provides this right;
• to withdraw any consent you have given, without affecting earlier use.

Write to privacy@syncoretech.net. We may need to confirm your identity first. We reply within one month, and tell you if we need longer as the law allows. There is no charge, unless a request is clearly unfounded or excessive. Some data must be kept by law (for example invoices) even if you ask us to delete it, and we will tell you when that applies.

10. Complaints

If you are unhappy with how we handle your data, please contact privacy@syncoretech.net or follow our Complaints Procedure. You also have the right to complain to the Data Protection Office of Mauritius, headed by the Data Protection Commissioner, or to the data protection authority where you live or work.

11. Children

Our services are not intended for anyone under 18, and we do not knowingly collect their personal data.

12. Cookies

We use only the cookies needed to run the services. See our Cookie Policy.

13. Changes to this notice

We publish every version of this notice with its version number and the date it takes effect, and earlier versions remain available. We tell you in your account about important changes before they take effect.