PTEN

Data processing agreement

Provisional version of 23 October 2026, accepted with the terms. It may be updated before the launch.

This agreement is part of the terms of use of the Synkora CRM-only subscription and is accepted with them, at sign-up. Your business is the controller. [Nome legal da Agência], VAT number [NIF da Agência], with its registered office at [Morada da sede da Agência], is the processor (“we”). It complies with Article 28 GDPR and Portuguese Law no. 58/2019. On data protection, it prevails over the rest of the terms. The «Website + CRM made to measure» contract has its own agreement.

1. Subject matter and duration

We process personal data on behalf of your business only to provide the CRM: storing and showing the records, sending the emails your business or its automations ask for, the booking page, backups, the support you ask for and the integrations you connect. The agreement runs while the account exists and, afterwards, until the data is deleted. We do not process the data for our own purposes, we do not sell it and we do not use it for advertising.

2. Data and data subjects

The data subjects are your business’s customers and contacts (including people who book on the booking page) and the people in your team. The data is what your business keeps: name, email, phone, address, VAT number, bookings, sales, orders, quotes, messages, notes and your own fields; for the team, also the role, the access and change log and the two-factor authentication data, stored encrypted. We do not receive payment card data. Your business does not record special categories of data or data on criminal convictions without the safeguards the law requires.

3. Instructions

We only process the data on your business’s instructions: the terms, this agreement, what you set up in the workspace (connecting an integration, creating an automation, exporting or deleting data) and written requests to support@synkora.pt. We tell you if an instruction seems to us to breach the GDPR. If the law requires other processing from us, we tell you first, unless the law forbids it.

4. Confidentiality and security

Whoever processes the data is bound to confidentiality and only accesses what is needed for the service or for the support asked for. Support access to a workspace only happens with the owner’s permission, for a limited time, and is logged. We apply the measures in annex 1, never lowering the level of protection when we update them. Your business protects the team’s credentials and recovery codes and removes access for people who leave.

5. Data subjects’ rights

The workspace lets you find a person by email, export their data and delete it, to answer data subjects’ requests. When needed, we help through support. If a data subject asks us directly, we pass the request on to your business without delay.

6. Sub-processors

Your business authorises the sub-processors in annex 2. We email at least 30 days before adding or replacing one. You may object on reasonable data-protection grounds; if there is no solution, you can end the subscription with no early exit charge. We impose on each sub-processor obligations equivalent to this agreement and are answerable for their compliance. Services where your business has its own account and connects to the workspace (certified invoicing, Meta, Google, carriers) are governed by the contract between your business and each provider.

7. Where the data is

The workspace data stays in data centres in the European Union. A transfer outside the European Economic Area, including by a sub-processor, only happens under an adequacy decision in force (such as the EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses.

8. Data breaches

We notify your business without undue delay after we learn of a breach affecting its data, aiming to do so within 48 hours, with what is known: nature, data subjects and records affected, likely consequences, measures taken and a contact. We help you notify the supervisory authority (72 hours) and the data subjects; those notifications are your business’s responsibility.

9. Export and deletion

You can export all the data in the workspace at any time, also during late payment and until the account is closed. On request, we deliver the export within 15 days. With a paid subscription, the account closes at the end of the period already paid (on the annual plan paid monthly, at the end of the 12 months). Once closed, we keep the data for 90 days and then delete the database, the files, the archive and the weekly copies; the hosting provider’s recovery copies expire up to 30 days later. A trial that ends without a plan is deleted 60 days after it ends, with warnings first. Only what the law requires is kept, such as the subscription invoices for 10 years. On request, we confirm the deletion in writing.

10. Information and audits

We provide the information needed to show compliance with Article 28 GDPR: this agreement, the annexes and the sub-processors’ reports and certifications, where they exist. An audit takes place with at least 30 days’ notice, at most once a year (except after a breach or when an authority requires it), by an auditor bound to confidentiality, without disrupting the service or access to other customers’ data. Each party bears its own costs.

11. Liability

Liability follows Article 82 GDPR and, between the parties, the limits in section 13 of the terms, except for wilful misconduct or gross negligence and what the law mandatorily imposes.

Annex 1: technical and organisational measures

Annex 2: sub-processors

Stripe, Google and the email providers may process data outside the European Economic Area, with the safeguards in section 7.

Contact

Requests and communications about data protection: support@synkora.pt.