Privacy Policy

1. Who we are

This site (syntranova.ai) is operated by SYNTRANOVA AL LTD, a company registered in Cyprus under number HE 485824, located at Nikis 1, Anthoupoli, 2350, Nicosia, Cyprus.

We are the data controller in the sense of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

2. What data we collect

We only collect data strictly necessary for the operation of the site and our services:

• Contact form: name, email, company (optional), phone (optional), project type, estimated budget, message.
• Newsletter (opt-in): email + name, if you subscribe.
• Technical analytics: anonymized IP, user-agent, time on page — aggregated, without individual identification.
• Functional and analytical cookies: see Cookie Policy.

3. Why we process this data (Legal basis)

• Response to inquiries: art. 6(1)(b) GDPR — necessary for the conclusion/fulfillment of a contract or pre-contractual measures.
• Newsletter: art. 6(1)(a) GDPR — explicit consent (you can withdraw at any time).
• Analytics: art. 6(1)(f) GDPR — legitimate interest for improving services.
• Legal obligations: art. 6(1)(c) GDPR — billing, taxation, compliance.

4. Who we share your data with

We never sell your data. We only share it with contractual processors:

• Brevo (Sendinblue) SAS — for sending emails (FR, GDPR-compliant)
• Cloudflare Inc. — CDN and DDoS protection (DPF certified)
• Hetzner Online GmbH — hosting infrastructure (Germany, GDPR-compliant)
• Stripe Payments Europe Ltd. — payment processing (IE)

All processors are covered by Standard Contractual Clauses (SCC) and Data Processing Agreement (DPA).

5. How long we keep your data

• Contact messages: 36 months, then automatically deleted.
• Contractual data: 10 years (tax/accounting obligation).
• Newsletter: until unsubscribed.
• Aggregated analytics: 26 months.

6. Your GDPR rights

You have the right, under art. 15-22 GDPR, to:

• Request a copy of your data (art. 15 — Right of access)
• Rectify incorrect data (art. 16)
• Delete your data (art. 17 — Right to erasure / “right to be forgotten”)
• Limit processing (art. 18)
• Request data portability (art. 20)
• Object to processing (art. 21)
• Not be subject to automated decisions (art. 22)
• File a complaint with the supervisory authority — in Cyprus: Office of the Commissioner for Personal Data Protection

To exercise any of these rights, contact us at privacy@syntranova.ai. We respond within 30 days.

7. Security

We implement reasonable technical and organizational measures: HTTPS across the site, encryption at rest for databases, restricted access based on the principle of least privilege, audit logs, encrypted backups, MFA for infrastructure.

8. International transfers

All our primary processors are in the EU/EEA. For exceptions (e.g., Stripe based in IE but US group), we apply Standard Contractual Clauses (SCC) or DPF certification.

9. Changes

We may update this policy. The current version is always available on this page, with the date of the last modification at the top.

10. Privacy contact

For any questions regarding your data, contact us at privacy@syntranova.ai.