Privacy notice

Who we are

SyntoraData is run by Syntora Ai, a company based in Islamabad, Pakistan, which decides how and why this data is used (the controller). See about us. For anything about your personal data, write to privacy@syntoradata.com; for anything else, hello@syntorahq.ai.

Because we are established outside the UK and the EU, we are appointing representatives there (UK GDPR / EU GDPR Art. 27). Their contact details will be published here once appointed; until then, write to the address above.

What we hold and where it comes from

We did not collect this information from you directly. It comes from:

• Official company registers such as Companies House and INSEE Sirene, reused under their open licences (list). These can include the names of company officers or sole traders where the register publishes them.
• The public website of the company you work for, anywhere in the world, read by our crawler SyntoraDataBot: the homepage and its about, contact, team, careers and legal pages, at most 25 pages per site.
• Licensed company datasets bought from a data vendor, for company-level information such as industry, size, funding and website.
• Licensed professional-profile datasets bought from a data vendor, built from public professional profiles. They can include your name, headline and job title, current and previous employers, city and country, education, certifications, languages and a short profile text, and the public address of the profile.

From a company's website we may store a work e-mail address at the company's own domain, together with your name, job title, department and seniority when the page shows them next to the address, plus the address of the page and the dates we first and last saw it there. We also keep an internal copy of the pages we read, to show where each fact came from.

We do not collect from social networks, pages behind a login, or pages the site owner has excluded in robots.txt. We do not store personal webmail addresses (Gmail, Outlook, Yahoo and similar), shared inboxes as if they were people, personal phone numbers, photos, dates of birth, home addresses or anything about your private life.

Why, and our lawful basis

So that business customers can find the right professional contact at a company, the role your employer has published you as the contact for, instead of writing to a generic inbox. Our lawful basis is legitimate interests (UK GDPR / EU GDPR Art. 6(1)(f)): your employer published these details on its own website, in a business capacity, so that other businesses can reach the right person. Our assessment is available on request. We do not market to you ourselves and we make no automated decisions about you.

Who receives it

Company-level data is provided to our business customers under terms restricting use to lawful B2B purposes, and parts of it are public in our company directory.

People on public pages. People linked to a company in the licensed professional-profile datasets appear on the public company pages and in the people directory only in masked form: initials followed by stars (for example "N***** T*****"), job title, seniority, department, country, the year the current role started, and the names of previous employers. We do not show full names, profile addresses, photos, city, education or contact details there, and these pages ask search engines not to index them. Full details are for signed-in business customers only; that access is not open yet.

Work contacts from company websites (a work e-mail with a name) are currently not shown to anyone. Our hosting provider in Germany runs the server for us, as a processor.

Where it is kept

Everything is stored on our own server in Germany (EU), on encrypted disks, with the databases not reachable from the internet. Our team works from Pakistan and reaches the server only over encrypted connections. Pakistan has no adequacy decision from the EU or the UK; we keep the data in the EU and limit access to the staff who need it.

How long we keep it

As long as your employer keeps publishing the details, plus 365 days after we last see them; then they are deleted. If they disappear from the page, we delete them after two further visits to that page. Internal copies of pages are kept for at most 180 days.

When you object or ask for erasure, we delete the record and every internal copy of a page that contains your address, and keep only a one-way fingerprint (a hash) of the address on our suppression list, for as long as we operate, so it is never stored again. A hash of a known address can be matched, so we protect it as personal data too.

If you contact us or request access

When you use the request-access form or e-mail us, we keep what you send (name, work e-mail, company, role, countries of interest, use case and message) to reply and follow up about SyntoraData. Our basis is legitimate interests, or steps you asked for before a contract. We keep it for 24 months after you contact us, do not store your IP address, and share it with nobody except our hosting provider.

Your rights

You can ask us to show you what we hold (including the exact page and dates), correct it, erase it, restrict it, or object to its use. Write to privacy@syntoradata.com from, or naming, the work e-mail address concerned, or see see or remove my data. We reply within one month.

You can also complain to the data protection authority in your country, for example the ICO in the UK or the CNIL in France.

Changes

We will update this notice when our processing changes; the current version is always at this address.