Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between Syndeya, LLC ("Syndeya") and a company that uses a Syndeya company account (the "Customer"). It applies to personal data in the Customer's company account. It takes effect automatically when the Customer uses a company account; no signature is needed. A countersigned copy is available on request from support@syndeya.com.

1. Roles

For personal data in the company account, the Customer is the controller and Syndeya is the processor. Syndeya processes that data only to provide the Service and only on the Customer's documented instructions, which are the Terms, this DPA, and the Customer's use of the Service's settings. Syndeya will tell the Customer if it believes an instruction breaks data protection law.

2. What is processed

• People concerned: the Customer's team members, and the people they meet and save (contacts, prospects, partners).
• Data: names, job titles, companies, email addresses, phone numbers, where and when people met, notes and follow-ups, voice memos and their transcripts, card tap counts, and team members' account and profile details.
• Purpose: providing the Service: storing contacts, reminders, briefings, event reports, the company dashboard, CRM export and integrations the Customer connects.
• Duration: for as long as the company account is active, then as described in section 8.

The Customer should not put special categories of data (such as health information) into the Service.

3. Confidentiality and security

People at Syndeya who can access Customer data are bound by confidentiality. Syndeya maintains the security measures in Annex 1 and may improve them over time without lowering the overall level of protection.

4. Subprocessors

The Customer authorizes Syndeya to use the subprocessors in Annex 2. Syndeya will give at least 30 days' notice of a new subprocessor by updating this page and emailing the Customer's account owner. The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may cancel and receive a refund of prepaid fees for the remaining period. Syndeya requires each subprocessor to protect the data at least as well as this DPA does and remains responsible for them.

5. Helping the Customer

Owners and managers can view, export, correct, and delete company contacts in the dashboard. Syndeya will help the Customer, as reasonably needed, to answer requests from people exercising their data protection rights, and with security, breach notification, and data protection impact assessments relating to the Service. If Syndeya receives such a request directly, it will refer the person to the Customer.

6. Personal data breaches

Syndeya will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting Customer data, with the information reasonably available to help the Customer meet its own obligations.

7. International transfers

Syndeya and its main subprocessors process data in the United States. Where the GDPR, UK GDPR, or Swiss law applies to a transfer, the parties agree to the EU Standard Contractual Clauses (Commission Decision 2021/914, Module Two, controller to processor), with the UK International Data Transfer Addendum and Swiss amendments where applicable, which are incorporated by reference. For those clauses: the Customer is the data exporter and Syndeya the importer; Clause 7 (docking) applies; option 2 (general authorization) applies under Clause 9 with the notice period in section 4; the optional language in Clause 11 does not apply; the governing law and courts under Clauses 17 and 18 are those of Ireland; and Annexes 1 and 2 of this DPA complete the clauses' annexes.

8. Return and deletion

The Customer can export its contacts at any time. Within 90 days after a company account is closed, Syndeya deletes the Customer's data, unless the law requires keeping it. Backups are overwritten on their normal cycle.

9. Audits

Syndeya will make available the information reasonably needed to show compliance with this DPA, including answers to a reasonable security questionnaire once a year. Further audits can be agreed in writing, at the Customer's cost, with reasonable notice and confidentiality.

10. Liability and order of precedence

The limits of liability in the Terms apply to this DPA. If this DPA conflicts with the Terms, this DPA controls for personal data; the Standard Contractual Clauses control over both where they apply.

Annex 1: Security measures

• Data is hosted on Google Cloud (Firebase), encrypted in transit and at rest by Google Cloud.
• Access to data is enforced by server-side security rules: team members see their own contacts; only the Customer's owners and managers see the company's contacts and reports.
• Sensitive operations, such as joining a company, removing someone, and billing, run only on Syndeya's servers, not in the app.
• Sign-in is through Apple or Google; Syndeya does not store passwords.
• Payment card details are handled only by Stripe and never reach Syndeya.
• Administrative access to production systems is limited to Syndeya personnel who need it.
• Crash reporting and monitoring are used to detect and fix problems.

Annex 2: Subprocessors

• Google (Firebase and Google Cloud, United States): hosting, database, storage, sign-in, notifications, speech-to-text and text-to-speech, crash reporting.
• Google (Gemini, United States): AI meeting briefs, suggested messages, voice memo notes and card translations.
• Stripe (United States): payments for company plans and card orders.
• Resend (United States): email delivery.
• Apple (United States): Sign in with Apple and in-app purchases.
• RevenueCat (United States): in-app subscription status.
• ipapi.co (approximate location of people who share details back on a public card).
• Tap Tag (United States): making and shipping smart cards (name and shipping address only).
• Integrations the Customer chooses to connect, such as HubSpot, receive the contacts the Customer syncs to them.

Questions about this DPA: support@syndeya.com