https://syncora.solutions/privacy-policy
Who we are (section link)
Syncora (Pvt) Ltd is a private limited company incorporated in Sri Lanka. We build and operate cloud software products and we provide custom web development. Our tagline is "Technology That Moves Business Forward".
- Registered name: Syncora (Pvt) Ltd
- Company registration number: [REG NO]
- Registered address: Colombo, Sri Lanka
- Website: syncora.solutions (opens in a new tab)
- Privacy contact: legal@syncora.solutions
- Phone: +94 77 565 2040
- Data protection officer: [DPO NAME]. Until that name is published, write to legal@syncora.solutions.
For personal data collected through syncora.solutions (the corporate website), Syncora is the controller. For personal data that a business customer loads into a Syncora product about its own users, see "Controller and processor" below.
What this policy covers (section link)
This policy covers personal data we process through the corporate website, sales and support conversations, billing of Syncora services, and account data we need in order to run a product. It covers visitors, people who contact us, customers, and customer staff who deal with us.
It does not replace a product privacy notice. Staffora (staffora.syncora.solutions) and any later Syncora product may publish its own notice. If that notice conflicts with this one on a point that is specific to the product, the product notice applies to that product. This policy also does not make us the controller of personal data that you, as a business, collect from your own customers or employees and then store in our software.
Laws we design for (section link)
We design this website and our contracting practices to meet:
- Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA), as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025, where that Act applies to our processing.
- The EU General Data Protection Regulation (GDPR) and the UK GDPR, together with the UK Data Protection Act 2018, where we offer services to people in the European Economic Area or the United Kingdom, or otherwise fall in scope.
- The California Consumer Privacy Act as amended by the CPRA (together, CCPA/CPRA), to the extent those laws apply to us. We describe California rights briefly below. We do not claim that every Syncora entity or product is a "business" under the CCPA in every year.
Where more than one law applies, we honour the right that gives you the stronger protection on that point. Nothing in this policy limits a right that the law says we cannot contract out of.
Controller and processor (section link)
The same company can be a controller for some data and a processor for other data. The distinction matters because it decides who must respond to a rights request.
| Data | Typical role | Who decides the purpose |
|---|---|---|
| Corporate website visits, contact-form messages, marketing choices, and Syncora's own recruitment mail | Controller | Syncora |
| Account, subscription and invoice records for a customer who buys from Syncora | Controller | Syncora, so that we can perform the contract and keep statutory records |
| Content a business customer uploads about its own personnel, customers or other end users (for example employee records in a HR product) | Processor | The business customer, who is the controller. We process that data on the customer's instructions. |
| Product telemetry we need to secure, bill and support the service (such as login time, plan and error logs), separate from the customer's own content | Controller for that limited operational data | Syncora |
If you are an employee or end user of one of our business customers, please contact that organisation first. They decide why your data is in the product. We will help them respond, as described in our Data Processing Addendum summary. If you contact us directly, we will either refer the request or act on it where we are the controller.
Personal data we collect (section link)
We collect only what we need for the purposes in the next section. Depending on how you deal with us, that can include:
- Identity and contact data: name, work email, phone number, company, job title and country.
- Enquiry data: the topic you choose, the product you ask about, and the message you send through the contact form or by email.
- Account data: login identifiers, role, and preferences on a product you subscribe to. Product sites describe any extra fields.
- Billing data: billing contact, billing address, plan, invoices and payment status. Card numbers are collected by [PAYMENT PROCESSOR], not typed into our corporate site. Do not send card numbers by email.
- Customer content: files, records and messages a customer submits to a product. We host that content as processor.
- Technical data: IP address, browser type, device type, referring URL, and date and time. Our servers log this to keep the site available and secure.
- Cookie and consent data: the choice you make in the cookie banner, stored in the essential cookie `syncora_consent`.
- Analytics data: pages you view, browser and device type, a coarse location, traffic source, and interactions such as scrolls, outbound clicks, site search, video engagement, file downloads, and whether a form was started or submitted. The form event does not include what you typed. This is collected on each visit by Google Analytics 4 (Google LLC), measurement ID G-CDFGZMB1B0, as described in the Cookie Policy.
- Support and correspondence: emails and attachments you exchange with us.
We do not ask you to send special-category data (such as health, biometric or religious data) through the corporate contact form. A product may process such data only where the customer has a lawful condition and the product terms say so. Do not put special-category data in a free-text enquiry unless you have a proper basis and you accept that email is not a suitable channel for it.
We do not buy personal-data lists, and we do not sell personal data.
Purposes and lawful bases (section link)
The PDPA allows processing only where a statutory condition is met. The GDPR and UK GDPR require a lawful basis in Article 6. The table uses both vocabularies. "Legitimate interests" is used only where our interest is not overridden by your rights, and you may object.
| Purpose | Data | Lawful condition / basis | How long we keep it |
|---|---|---|---|
| Answer sales, support, partnership and careers enquiries | Identity, contact and enquiry data | Steps towards a contract, and legitimate interests in running a business inbox | 24 months after our last message about that enquiry, unless a contract or dispute needs longer |
| Provide a subscription or a custom-development contract | Account, billing and project correspondence | Contract | For the life of the account, then 24 months, except invoices |
| Keep tax and accounting records | Invoices and payment status | Legal obligation | [TAX RECORD YEARS] years after the relevant financial year. Confirm the statutory period before publishing a number. |
| Keep the website secure and reliable | Technical logs | Legitimate interests in preventing abuse and diagnosing faults | 90 days, unless we need a specific log to investigate an incident |
| Remember your cookie choice | Consent cookie | Legitimate interests in honouring a refusal, and consent where you opt in | 180 days, then we ask again |
| Measure how the website is used | Pages viewed, browser and device type, coarse location, traffic source, and the interaction events listed in the Cookie Policy. Not the contents of a form. Google Analytics 4 does not store the full IP address. | Legitimate interests in understanding how the site is used | Google keeps event-level data for the retention period set in our Google Analytics property, which starts at 2 months. Aggregated reports may be kept longer. |
| Send optional product or marketing email | Name, email and campaign interaction | Consent. We do not send marketing email because you filled in the contact form. | Until you withdraw consent, then we suppress the address for as long as we need to honour the opt-out |
| Establish or defend a legal claim | The records relevant to the claim | Legitimate interests, or a legal obligation to disclose | Until the claim and any appeal period end |
We do not use personal data from this website to train public machine-learning models. If a product later offers an AI feature that processes customer content, that product's terms and notice will describe it before the feature processes the content.
Cookies (section link)
We use an essential cookie to store your cookie choice. Google Analytics 4 loads on every page. Marketing scripts are not loaded unless you opt in. The categories, the cookies, the banner, and how to change your mind are described in the Cookie Policy.
Who we share data with (section link)
We do not sell personal data. We share it with service providers who process it for us (sub-processors), with professional advisers, and with authorities when the law requires. Each provider is bound by contract to use the data only on our instructions, to keep it confidential, and to apply appropriate security.
| Sub-processor | Purpose | Location of processing | Data |
|---|---|---|---|
| Plesk | Host the website and application infrastructure | [HOSTING REGION] | Technical logs and, on products, customer content |
| [EMAIL PROVIDER] | Send and store enquiry and transactional email | [EMAIL REGION] | Contact details and message content |
| [PAYMENT PROCESSOR] | Take subscription and invoice payments | [PAYMENT REGION] | Billing contact and payment tokens. We do not store full card numbers. |
| Google LLC (Google Analytics 4) | Measure use of the corporate website on every visit. It is not used for advertising. | United States and other countries where Google operates data centres | Usage events described in the Cookie Policy. Not your name, not form contents, and not customer content from a product. |
A product may use additional sub-processors. Those will be listed in the product's data-processing terms. We may also share data with:
- Professional advisers (lawyers, auditors, insurers) under a duty of confidence.
- A buyer of our business, if we merge or sell assets, and only so they can evaluate or continue the service. We will tell you if your controller changes.
- Courts, regulators (including the Data Protection Authority of Sri Lanka), and law-enforcement bodies when we have a legal duty or a binding request.
- Your employer or the business that holds the account, where you use a product as their user and they are the controller.
International transfers (section link)
Syncora is established in Sri Lanka. The website and the products are hosted on Plesk. The data-centre region for that hosting is [HOSTING REGION]. Email and payments are processed in [EMAIL REGION] and [PAYMENT REGION] until those placeholders are replaced. Some of these providers may process personal data in countries that the EU, the UK or the PDPA do not treat as providing an equivalent level of protection. Google Analytics processes website measurement data in the United States and other countries where Google operates data centres.
Where the PDPA applies, we transfer personal data outside Sri Lanka only in a way the Act allows, including where the recipient is subject to an adequacy decision or we put appropriate safeguards in place. Where the GDPR or UK GDPR applies, we do not rely on a bare contractual promise. The transfer tool we will use is [TRANSFER TOOL]. Do not treat a transfer as covered by the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or any other named tool until that document is actually signed and this placeholder is replaced.
You may ask us for a summary of the safeguards by emailing the privacy contact. We may redact parts that would expose security detail.
How long we keep data (section link)
The periods in the purposes table are the ones we apply unless a longer period is required by Sri Lankan law, a dispute, or a signed contract. When a period ends we delete the data or irreversibly anonymise it. Backups roll off on the backup cycle described on the Security page, so a copy may persist in a backup until that cycle overwrites it. We do not restore a backup in order to keep using data we have otherwise deleted.
If you close a product account, we keep customer content available for export for [EXPORT WINDOW] after closure, then delete it, unless the law requires us to keep a record or the content is part of an unresolved dispute. Billing records follow the tax row in the table above.
Security (section link)
We use technical and organisational measures appropriate to the risk, including TLS (HTTPS) for data in transit, access limited to people who need it, and the controls described on the Security page. Encryption at rest on Plesk is [ENCRYPTION AT REST]. No method of transmission or storage is perfectly secure, and we do not claim a named certification on that page unless it is actually held.
Your rights (section link)
Subject to the law that applies to you, and to exemptions (for example where a disclosure would reveal another person's data, or we must keep a record for tax), you can ask us to:
- Access the personal data we hold about you, and receive a copy.
- Correct data that is inaccurate, or complete data that is incomplete.
- Erase data, including where you withdraw consent and we have no other lawful ground, or the data is no longer needed.
- Restrict processing while a challenge is resolved, where the law gives that right.
- Object to processing based on legitimate interests, and object at any time to direct marketing.
- Port data you provided to us, where the processing is based on consent or contract and is carried out by automated means, in a commonly used machine-readable format.
- Withdraw consent at any time, without affecting processing that was lawful before the withdrawal.
- Human review of a decision based solely on automated processing that produces a legal or similarly significant effect. We do not make that kind of decision on the corporate website today.
- Appeal a refusal to the Data Protection Authority of Sri Lanka, where the PDPA gives you that route.
California residents (section link)
If the CCPA/CPRA applies, a California resident may have the right to know the categories and specific pieces of personal information we collected, the right to delete, the right to correct, and the right to opt out of "sale" or "sharing" of personal information. We do not sell personal information. We do not share it for cross-context behavioural advertising. If we ever do, we will add a "Do Not Sell or Share My Personal Information" link and honour a browser opt-out preference signal that the law requires us to honour. We will not discriminate against you for exercising a privacy right. You may use an authorised agent where the CCPA allows it; we may ask the agent for proof and we may verify you directly.
How to exercise a right (section link)
Email legal@syncora.solutions with the subject "Privacy request". Tell us which right you want to use, the email address or account the data relates to, and the country you live in. Please do not send copies of identity documents unless we ask. If we ask, send only what is needed to confirm it is you, and we will delete that copy once the check is done.
Under the PDPA as amended by Act No. 22 of 2025, we will tell you in writing, without undue delay and within one month of receiving a valid written request, whether we grant it or refuse it, with reasons where the law allows us to give them. If a request is complex we may extend that period by up to a further two months (not more than three months from receipt). We will tell you about an extension, and about your right to appeal a refusal to the Authority, before the first month ends. Where the GDPR or UK GDPR applies, the same one-month period applies and may be extended by a further two months for complex requests. Requests are free unless a fee is allowed because a request is manifestly unfounded or excessive, or the Authority's rules permit a fee.
If we are only the processor, we will pass the request to the controller (usually your employer or the business that holds the account) within a reasonable time and help them respond.
Children (section link)
The corporate website and our services are directed at businesses and adults. We do not knowingly collect personal data from anyone under 18. We do not knowingly offer an information-society service directly to a child. Where the GDPR applies, we also do not rely on consent given by a person under 16 (or a lower age, not below 13, fixed by an EU member state) without consent from a holder of parental responsibility.
If you are a parent or guardian and you believe a child has given us personal data, email legal@syncora.solutions. We will delete it. The PDPA's own definition of a child is [PDPA CHILD AGE]. Our under-18 rule is a business rule and does not change that statutory definition.
Personal-data breaches (section link)
If we become aware of a personal-data breach that affects data we control, we will assess the risk and, where the PDPA, the GDPR or the UK GDPR requires it, notify the relevant authority and the affected people. Under the GDPR, notification to the supervisory authority is made without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to people. Where we are a processor, we notify the customer within the time stated in the Data Processing Addendum summary, so the customer can meet its own duties. Our handling steps are on the Security page.
Complaints (section link)
Please contact us first at legal@syncora.solutions so we can try to put the matter right. You also have the right to complain to a regulator:
- Sri Lanka: the Data Protection Authority of Sri Lanka, dpa.gov.lk (opens in a new tab). You may appeal to the Authority against a refusal of a PDPA rights request, in the form and time the Authority prescribes.
- European Economic Area: the supervisory authority in your country of residence, place of work, or the place of the alleged infringement.
- United Kingdom: the Information Commissioner's Office, ico.org.uk (opens in a new tab).
- California: the California Privacy Protection Agency or the California Attorney General, where the CCPA/CPRA gives you that route.
Changes to this policy (section link)
We will post any new version on this page and change the "Last updated" date. The effective date is the same date shown at the top of the page. If we make a change that materially affects processing based on consent, we will ask for consent again where the law requires it. We will not rely on silence as consent. Continued use of the website after the effective date applies to processing that does not depend on consent.
Contact (section link)
Privacy questions and rights requests: legal@syncora.solutions. Data protection officer: [DPO NAME]. Post: Syncora (Pvt) Ltd, Colombo, Sri Lanka. Phone: +94 77 565 2040. Company registration number: [REG NO].
You can also use the contact form. Please do not include passwords, card numbers or special-category data in that form.