Syndik8 Privacy Policy

Effective date: 1 April 2026

Syndik8 (syndik8.app) is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, and your rights in relation to it.

1. Data Controller

The data controller for the personal data processed through Syndik8 is Deltatek Defence Ltd (trading as Deltatek Software), a company registered in England and Wales (Company No. 02975256). Registered address: 122 Great Berry Lane, Basildon, Essex, SS16 6BY. You can contact us about data protection matters at [email protected].

2. Data We Collect

When you use Syndik8, we collect the following personal data:

• Account data: your email address, full name, and display name
• Profile preferences: timezone and default syndicate selection
• Booking data: dates, times, and usage logs you create
• Syndicate membership data: which syndicates you belong to and your role
• Financial data: transaction amounts, billing history, and expense records processed through the platform (card details are held by Stripe, not by us)
• Technical data: your IP address, browser type, and device information collected automatically when you access the web application

3. Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we process your personal data on the following lawful bases:

• Contract performance: we process your account data, booking data, syndicate membership data, and financial data because it is necessary to provide the Syndik8 service you have signed up for
• Legitimate interests: we process technical data for security monitoring, fraud prevention, and service improvement, where our interests do not override your rights
• Legal obligation: we may process and retain certain data where required by law, for example for tax or accounting purposes

4. How We Use Your Data

We use your personal data to:

• Provide and maintain the Syndik8 service
• Authenticate your identity and keep your account secure
• Display your profile information to other members of your syndicates
• Enable booking, scheduling, and asset management features
• Process payments and financial transactions through Stripe
• Send you transactional emails such as invite notifications and payment receipts
• Improve and develop the service

We do not use your personal data for automated decision-making or profiling.

5. Data Storage and Security

Your data is stored securely using Supabase, a cloud database provider. Data is stored on servers in the European Economic Area (EEA). We implement industry-standard security measures including encryption in transit (TLS) and at rest.

We retain your personal data for as long as your account is active. When you delete your account, we delete your personal data within 30 days, except where we are legally required to retain it (for example, financial transaction records may be retained for up to 7 years for tax purposes).

6. Cookies and Local Storage

On the web application, Syndik8 uses cookies and browser local storage for the following purposes:

• Session cookies: to keep you signed in between page loads
• Preference storage: to remember your theme and other settings

We do not currently use third-party advertising or analytics cookies. You can decline cookies on first visit — the service will still function but your preferences may not be saved between sessions.

7. Data Sharing

We do not sell your personal data. We share data only as follows:

• With other members of your syndicates: your name, display name, and booking history within that syndicate, in accordance with the syndicate's privacy settings
• With Supabase (supabase.com): as our database and authentication infrastructure provider, processing data on our behalf under a data processing agreement
• With Stripe (stripe.com): to process payments, Stripe receives your name, email address, and payment information. Stripe acts as an independent data controller for payment data — see Stripe's privacy policy for details
• With your syndicate's Stripe Connect account: if your syndicate uses in-app payments, the syndicate administrator may see your name and transaction amounts through their Stripe dashboard
• If required by law or to protect the rights and safety of users

8. International Data Transfers

Our primary data storage is within the EEA. However, some of our service providers (such as Stripe) may process data in the United States or other countries. Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

9. Your Rights

Under UK data protection law, you have the following rights:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: correct inaccurate data
• Right to erasure: request deletion of your data
• Right to restrict processing: ask us to limit how we use your data
• Right to data portability: receive your data in a commonly used, machine-readable format
• Right to object: object to processing of your data where we rely on legitimate interests
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via an in-app notice. The current version is always available at syndik8.app/privacy.

12. Contact

Syndik8 is a product of Deltatek Software, a trading name of Deltatek Defence Ltd (Company No. 02975256), registered in England and Wales.

For questions or concerns about this Privacy Policy or how we handle your data, please contact us at [email protected] or visit syndik8.app.