1. Who we are
This privacy statement applies to Syncer B.V., Stadhuisplein 10, 5611 EM Eindhoven, the Netherlands, registered with the Dutch Chamber of Commerce (Syncer, we or us).
For the processing described in this statement, Syncer is the controller within the meaning of the General Data Protection Regulation (GDPR). You can send questions about privacy to roel@syncer.nl or use our contact page.
2. What this statement covers
This statement covers the personal data we process when you visit syncer.io, contact us or request a quote, register for an event, create a Demo Pack account, book a meeting with us, or do business with us as a client or supplier.
It does not cover the data inside a merchant's store that our Shopify app or our migration team processes on behalf of that merchant. Section 5 explains how that works.
3. Personal data we process and why
Contact and quote requests
When you use a contact or quote form on our website, we process your name and email address and, if you provide them, your company name, webshop URL, current ecommerce platform and message. We also record the language of the page, the page or form you used and the date and time of your request.
We use this data to answer your question, prepare a quote and follow up on it. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in answering business inquiries (Article 6(1)(f) GDPR).
Our forms contain a hidden spam check. Submissions that fail this check are not stored.
Newsletter
When you sign up for the Syncer letter in the footer of our website, we process your email address, the language of the page and the date and time of your sign-up. We use this only to send you product updates and practical insights. The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time by replying to any newsletter or emailing roel@syncer.nl, after which we remove you from the list.
Event registrations
When you register for one of our events, we process your name, email address, company name and language. We use this to organize the event, manage the guest list and send you practical information. The legal basis is the performance of your registration (Article 6(1)(b) GDPR).
Demo Pack account
To use the free Demo Pack, you create an account with your name, company name, email address and a password. The password is stored in hashed form, so we cannot read it. You can also sign in with your Google account. In that case Google shares your name, email address and an account identifier with us. We also process login and session data to keep you signed in.
We use this data to give you access to the Demo Pack and to secure your account. The legal basis is the performance of the agreement for the Demo Pack (Article 6(1)(b) GDPR).
Booking a meeting
You can book a meeting with us through our online scheduler, which is provided by Pipedrive. When you book, you provide your name, email address, the time slot you choose and any other details you add. We use this to plan and hold the meeting. The legal basis is taking steps at your request before entering into a contract and our legitimate interest in talking to interested businesses (Article 6(1)(b) and (f) GDPR).
Clients and suppliers
If you or your organization works with us, we process the contact details of the people we work with, our correspondence, agreements, and billing and payment details. We need this to perform the agreement, keep our records and comply with legal obligations such as tax rules (Article 6(1)(b) and (c) GDPR).
Visiting our website
When you visit our website, our hosting providers process technical data such as your IP address, browser type, the page you request and the time of your request. This is necessary to deliver the website, keep it secure and detect and fix errors. The legal basis is our legitimate interest in a secure, working website (Article 6(1)(f) GDPR).
We do not use analytics, advertising or tracking tools on this website, and we do not build visitor profiles.
4. Who we share data with
We only share personal data with service providers that need it to provide their service to us. They act as our processors under a data processing agreement. We do not sell personal data.
- Lovable: hosts our website and the backend (Lovable Cloud) in which contact requests, event registrations and Demo Pack accounts are stored.
- Supabase: provides the database and login service behind Lovable Cloud.
- Cloudflare: provides the server and network infrastructure on which our website runs.
- Resend: sends us an email notification with the details of a new contact or quote request.
- Pipedrive: provides the scheduler you use to book a meeting with us.
If you choose to sign in with Google or install our app through the Shopify App Store, Google and Shopify process your data under their own privacy policies as independent controllers.
We may also share personal data when the law requires it, for example at the request of a supervisory authority or the police, or with advisers such as an accountant or lawyer who are bound by confidentiality.
5. Data in our Shopify app and migrations
When a merchant installs the Syncer app or hires us for an assisted migration, we process data from the merchant's source platform and Shopify store, such as product, customer and order data. Part of this is personal data of the merchant's customers.
For this data, the merchant is the controller and Syncer acts as a processor on the merchant's behalf. We only process the data on the merchant's instructions and for the migration and related services, under the applicable Shopify terms and our general terms and conditions. We sign a data processing agreement with merchants on request.
Are you a customer of a store that uses Syncer and do you want to exercise your privacy rights? Please contact that store first. We will help the store handle your request.
6. Transfers outside the EEA
Some of our service providers are located outside the European Economic Area (EEA), or use subcontractors there, for example in the United States. When personal data is transferred outside the EEA, we make sure appropriate safeguards are in place, such as an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified companies) or the Standard Contractual Clauses adopted by the European Commission.
7. How long we keep data
We keep personal data no longer than necessary for the purpose for which we collected it, and no longer than the law requires or allows.
- Contact and quote requests: as long as needed to handle the request and follow up on it. If no agreement follows, we delete the request once it is no longer relevant.
- Event registrations: until the event and its follow-up are complete.
- Demo Pack accounts: as long as the account exists. You can ask us to delete your account at any time.
- Client records: financial records are kept for seven years, as required by Dutch tax law.
8. Cookies and local storage
We do not use analytics, advertising or tracking cookies. We only use the following functional storage in your browser:
- Language preference: we remember the language you choose in your browser's local storage, so the website opens in that language next time. This contains no personal data.
- Login session: when you sign in to the Demo Pack, a session token is stored in your browser's local storage to keep you signed in. It is removed when you sign out.
- Staff-only pages: a few internal pages for our team use a strictly necessary session cookie.
Because this storage is strictly necessary or purely functional, we do not ask for cookie consent. You can clear local storage and cookies in your browser settings at any time.
The interactive demo on our demo page loads from a separate domain of our hosting provider (lovable.app). Our meeting scheduler opens on the Pipedrive website. These services may use their own technically necessary storage.
9. Security
We take appropriate technical and organizational measures to protect personal data against loss and unauthorized access. Examples are encrypted connections (HTTPS), access only for people who need it, and protection of our forms against spam and abuse. If you suspect misuse, please let us know right away.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted;
- restrict the processing of your data;
- receive your data in a structured, commonly used format (data portability);
- object to processing based on our legitimate interest;
- withdraw your consent at any time, where processing is based on consent.
Send your request to roel@syncer.nl. We respond within one month. We may ask you to confirm your identity in a proportionate way. We only ask for a copy of an identity document if there is no other way, and in that case you can black out your photo and citizen service number.
11. Complaints
If you are unhappy with how we handle your data, we would like to hear from you first. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the data protection authority in the EU country where you live or work.
12. Automated decision-making
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects for you.
13. Changes to this statement
We may update this privacy statement, for example when our services or the law change. The latest version is always on this page, with the date of the last update at the top.
14. Contact
Syncer B.V., Stadhuisplein 10, 5611 EM Eindhoven, the Netherlands. Email: roel@syncer.nl. You can also reach us through our contact page.
