1. Who we are
For the purposes of the EU General Data Protection Regulation (GDPR), SynAdopt is the controller of your personal data. For the purposes of India’s Digital Personal Data Protection Act, 2023 and the rules made under it (together, the DPDP Act), SynAdopt is the data fiduciary.
Contact for privacy matters: privacy@synadopt.com
2. Scope
This policy covers personal data of:
- Visitors to the Website
- People who fill in our forms, use our tools or download our content
- Subscribers to our newsletter
- Business contacts at current and prospective clients, partners and suppliers
- Job and internship applicants
When we process personal data on behalf of our clients as part of delivering services, we act as a processor (GDPR) or data processor (DPDP Act) under our client contracts and data processing agreements, and the client’s own privacy notice applies.
3. Personal data we collect
Information you give us
- Contact and professional details: name, work email, phone number, job title, role, company, company size, industry.
- Enquiry details: the priorities, timelines, budget ranges and messages you share in our forms.
- Tool inputs and results: answers you provide in our AI Maturity Score, ROI Estimator and Licence Utilisation Estimator, and the resulting scores or estimates.
- Application details: CV, work history, qualifications and other information you include in a job or internship application.
- Communications: emails, meeting notes and correspondence with us.
Information collected automatically
- Device and usage data: IP address, browser type, device type, pages visited, referring pages and interactions with the Website, collected through cookies and similar technologies as described in our Cookie Policy — analytics and marketing cookies only with your consent where required.
- Email engagement: whether our emails are delivered and opened, and which links are clicked, where permitted.
Information from other sources
- Professional information about business contacts from publicly available professional sources and from B2B data providers, such as name, job title, company and business contact details, used for business-to-business outreach.
- Information from partners or referrers who introduce you to us.
We do not intentionally collect sensitive or special-category personal data through the Website. Please do not include such information in forms or messages.
4. How we use personal data and our legal bases
| Purpose | Examples | GDPR legal basis | DPDP Act basis |
|---|---|---|---|
| Responding to enquiries and booking consultations | Replying to forms, scheduling calls | Steps at your request before entering a contract; legitimate interests | Consent; voluntarily provided for a specified purpose |
| Providing tools and downloads | Calculating scores, emailing reports | Performance of your request; legitimate interests | Consent |
| Sending newsletters and marketing | Monthly insights, event invitations | Consent (or legitimate interests for existing business contacts where permitted) | Consent |
| Managing client and supplier relationships | Contracts, invoicing, account management | Contract; legal obligation; legitimate interests | Consent; legitimate uses under the DPDP Act |
| Recruitment | Assessing applications, arranging interviews | Steps before entering a contract; legitimate interests | Consent |
| Improving the Website and services | Analytics, aggregated benchmarks from tool results | Consent (for analytics cookies); legitimate interests (aggregated analysis) | Consent |
| Security and legal compliance | Preventing misuse, meeting legal obligations, handling disputes | Legal obligation; legitimate interests | Legitimate uses; compliance with law |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of this assessment.
Where we rely on consent, you can withdraw it at any time with the same ease with which you gave it, for example by using the unsubscribe link in our emails or by contacting us. Withdrawal does not affect processing carried out before it.
5. Lead scoring and automated processing
We use simple automated rules to prioritise enquiries — for example, based on company size, role and the topic you select — so that we can respond appropriately. This does not produce legal or similarly significant effects for you, and a person reviews enquiries before any decision about working together. Our online tools calculate scores and estimates automatically from your inputs; these are indicative and are not used to make decisions about you.
6. Aggregated and anonymised data
We may combine tool results from many users into aggregated, anonymised statistics — for example, average maturity scores by industry — and publish them. These statistics do not identify you or your organisation.
7. Who we share personal data with
We share personal data only as needed with:
Service providers (processors)
who support our operations, such as website hosting, email and newsletter delivery, customer relationship management, scheduling, analytics, form handling, workflow automation, video conferencing and document storage.
Group companies
, including ActiveLoc Globalization Services Pvt. Ltd., where needed to deliver or administer services.
Professional advisers
, such as lawyers, auditors and insurers.
Authorities
, where required by law or to protect our rights.
A buyer or successor
, if our business is reorganised, sold or merged, subject to appropriate safeguards.
We do not sell personal data.
8. International transfers
We operate in India and the European Union, and some of our service providers operate in other countries. Personal data may therefore be transferred between India, the EU and other countries.
- For transfers of personal data from the EU/EEA to countries without an adequacy decision, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where needed.
- For transfers of personal data from India, we comply with the DPDP Act, including any restrictions notified by the Government of India.
You can request information about the safeguards we use by contacting us.
9. How long we keep personal data
| Data | Retention period |
|---|---|
| Enquiries and consultation requests with no further engagement | 24 months from last contact |
| Newsletter subscriptions | Until you unsubscribe, then a suppression record to honour your choice |
| Tool results linked to your email | 24 months; aggregated anonymised data may be kept longer |
| Client and supplier records | Duration of the relationship plus 8 years for legal, tax and accounting obligations |
| Job applications | 12 months after the recruitment decision, or longer with your consent |
| Website analytics | 14 months |
When personal data is no longer needed, we delete or anonymise it. Under the DPDP Act, we erase personal data when the specified purpose is no longer being served and retention is not required by law.
10. How we protect personal data
We use appropriate technical and organisational measures to protect personal data, including access controls, multi-factor authentication, encryption in transit and at rest where supported, company-managed devices, confidentiality obligations for staff and contractors, and vendor due diligence. No system is completely secure, but we work to protect your data and will notify you and the relevant authorities of a personal data breach where required by law.
11. Your rights
If you are in the EU/EEA (GDPR), you have the right to:
- access your personal data;
- correct inaccurate data;
- erase your data in certain circumstances;
- restrict or object to processing, including objecting at any time to direct marketing and to processing based on legitimate interests;
- data portability;
- withdraw consent at any time;
- lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos (AEPD), or the authority where you live or work.
If your personal data is processed under India’s DPDP Act, you have the right to:
- obtain a summary of your personal data being processed and the processing activities, and the identities of other data fiduciaries and processors with whom it has been shared;
- correction, completion, updating and erasure of your personal data;
- withdraw consent at any time;
- grievance redressal through our Grievance Officer;
- nominate another person to exercise your rights in the event of death or incapacity;
- after exhausting our grievance process, complain to the Data Protection Board of India.
How to exercise your rights: email privacy@synadopt.com or write to our Grievance Officer at the address above. We may need to verify your identity. We will respond within the time required by applicable law — within one month under GDPR; within the period prescribed under the DPDP Rules.
12. Children
Our Website and services are intended for business users and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Cookies
We use cookies and similar technologies as described in our Cookie Policy. You can change your choices at any time through Cookie settings in the website footer.
14. Third-party links
The Website may link to other websites. We are not responsible for their privacy practices; please read their policies.
15. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page with a new "Last updated" date and, where changes are significant, notify you by email or through the Website.
16. Contact us
SynAdopt
Email: privacy@synadopt.com