https://syncora.solutions/dpa
When this summary applies (section link)
It applies when a business customer (the controller) subscribes to a Syncora product or commissions processing, and Syncora (the processor) processes personal data on that customer's documented instructions. It does not apply to personal data for which Syncora is the controller, such as our own billing records and the corporate website. Those are described in the Privacy Policy.
The customer decides the purposes and means of processing Customer Data. We process it only to provide the service the customer bought, and as the law requires. If a customer instruction would, in our reasonable view, breach the PDPA, the GDPR or the UK GDPR, we will tell the customer and we may suspend that instruction until it is corrected.
Subject matter and duration (section link)
| Item | Description |
|---|---|
| Subject matter | Hosting, displaying and supporting Customer Data inside the Syncora product or project the customer bought. |
| Duration | For the subscription or project term, plus the export window in the Terms of Service, unless the law requires a longer retention of a specific record. |
| Nature and purpose | Storage, transmission, backup, support access on request, and the product features the customer switches on. |
| Types of personal data | Whatever the customer submits. For a HR product this commonly includes employee identity, contact, leave and attendance data. The customer must not submit special-category data unless the product is expressly designed for it and the customer has a lawful condition. |
| Categories of data subjects | The customer's personnel, contractors and, if the customer chooses to store them, its own customers or candidates. The customer is responsible for telling those people that a processor is used. |
| Controller | The customer named on the order. |
| Processor | Syncora (Pvt) Ltd, Colombo, Sri Lanka, registration number [REG NO]. |
Customer instructions (section link)
The customer's instructions are the product configuration, the order, these processing terms, and written support requests that are consistent with them. We will not process Customer Data for our own advertising, and we will not sell it. We will not use it to train public machine-learning models.
Staff who handle Customer Data are bound by confidentiality, whether by contract or by a statutory duty, and they receive access only where their job requires it.
Security (section link)
We will apply technical and organisational measures appropriate to the risk, as described on the Security page. Those measures include encryption in transit (TLS), access control, backups, and an incident process. Customer Data is hosted on Plesk. Details that still depend on that host, including encryption at rest and the data-centre region, stay marked as placeholders on that page until they are confirmed. We do not claim ISO/IEC 27001, SOC 2, or another certification unless the Security page names a certificate we actually hold.
The customer is responsible for its own users' credentials, for configuring roles inside the product, and for deciding whether the product's security is enough for the data it chooses to upload.
Sub-processors (section link)
The customer gives a general authorisation for the sub-processors below, and for the infrastructure those sub-processors use to perform the listed purpose. We will impose contract terms on each sub-processor that are no less protective than this summary in all material respects. We remain liable to the customer for a sub-processor's performance of those obligations.
| Sub-processor | Purpose | Location | Personal data |
|---|---|---|---|
| Plesk | Application and database hosting | [HOSTING REGION] | Customer Data stored in the product |
| [EMAIL PROVIDER] | Transactional email, such as account and notification mail | [EMAIL REGION] | Recipient address and the content of the notification |
| [PAYMENT PROCESSOR] | Customer billing. This row is Syncora acting as controller of its own invoices, and is listed so customers can see it. It is not a sub-processor of Customer Data. | [PAYMENT REGION] | Billing contact of the customer, not the customer's end users |
Google Analytics on the corporate website is not a sub-processor of Customer Data, so it is not listed in the table. Syncora is the controller of that website measurement. It runs for visitors to the corporate website, and it does not receive product content. It is described in the Privacy Policy and the Cookie Policy. We have not appointed an analytics sub-processor for Customer Data. If we do, we will add it to this table before it processes that data.
Before we appoint a new sub-processor for Customer Data, or replace one, we will give the customer [SUBPROCESSOR NOTICE] to object on reasonable data-protection grounds. If the customer objects and we cannot reasonably provide the service without that sub-processor, either party may terminate the affected service. We will refund prepaid unused fees for the terminated portion. An emergency replacement to protect the service may be made first, with notice as soon as we reasonably can.
International transfers (section link)
We are established in Sri Lanka. Customer Data is hosted on Plesk. The data-centre region is [HOSTING REGION]. Other sub-processors may process Customer Data in the regions named in the table, once those placeholders are filled in. Where the PDPA applies, cross-border processing follows the Act. Where the GDPR or UK GDPR applies to the transfer, the transfer tool is [TRANSFER TOOL]. Do not treat the EU Standard Contractual Clauses or the UK International Data Transfer Addendum as signed until this placeholder names the tool and the addendum is executed. The customer appoints us to enter that tool with sub-processors where the signed addendum authorises it.
Helping with rights requests and assessments (section link)
Taking into account the nature of the processing, we will assist the customer, by appropriate technical and organisational measures, to respond to requests from data subjects to access, correct, erase, restrict, port or object. Products should provide export and deletion controls the customer can use itself. Where a person contacts us directly about data we process only as processor, we will direct them to the customer or forward the request, unless we are legally required to respond ourselves.
We will also provide information the customer reasonably needs for a data-protection impact assessment or a prior consultation, where the customer cannot reasonably get that information another way. We may charge a reasonable fee for assistance that goes beyond what the product already provides, unless the need was caused by our breach.
Personal-data breaches (section link)
We will notify the customer without undue delay after we confirm a personal-data breach affecting Customer Data, and in any event within [PROCESSOR BREACH NOTICE]. The notice will describe, so far as we know them, the nature of the breach, the categories and approximate number of people and records, the likely consequences, and the measures we have taken or propose. We will update the customer as material facts change. The customer is responsible for notifying its own supervisory authority and the affected people, where the law puts that duty on the controller. We will not notify the customer's end users ourselves unless the customer asks us to or the law requires us to.
Return and deletion (section link)
At the end of the service the customer may export Customer Data for [EXPORT WINDOW]. After that window we will delete Customer Data from production systems, unless Sri Lankan law or another law that applies to us requires us to keep a specific record. Backups are overwritten on the backup cycle rather than restored in order to pick out individual records. We will confirm deletion in writing if the customer asks.
Audits (section link)
We will make available the information reasonably necessary to demonstrate compliance with this summary. That information may be a summary of controls and a description of sub-processors, rather than raw security configurations. The customer may audit us once in a contract year, on at least 30 days' notice, during business hours, in a way that does not disrupt the service or expose another customer's data. An independent auditor bound by confidentiality may carry out the audit. A second audit in the same year is available if a confirmed breach affecting the customer makes it reasonable. We may charge a reasonable fee for an audit that is not triggered by our breach. We are not obliged to disclose vulnerability detail that would weaken the service.
Liability (section link)
Liability arising out of this processing is subject to the limitation of liability in the Terms of Service, except where a non-waivable law, including the GDPR where it applies between the parties, requires a different allocation. Nothing in this summary limits liability for a matter the Terms of Service say cannot be limited.
How to put a DPA in place (section link)
- Email legal@syncora.solutions from a person who can bind the customer. Include the legal name, address, registration number and the product.
- We will send [DPA DOCUMENT] for signature. Read it with your own counsel. This web page is only a summary of the offer.
- Processing on these terms starts when the order is in force and, if you require a signature before processing, when the addendum is signed. If you upload Customer Data before signature, you instruct us to process it under this summary until the signed addendum replaces it.
Contact (section link)
Processor: Syncora (Pvt) Ltd, Colombo, Sri Lanka. Registration number: [REG NO]. Email: legal@syncora.solutions. Data protection officer: [DPO NAME].