Data Processing Agreement

Processor: SynqOS Ltd, 2 Edmund Court, Sheffield, United Kingdom. Company number: 17338012. Email: hello@synqos.co.uk

Controller: The Customer as identified in their SynqOS account.

SynqOS Ltd processes personal data on behalf of the Customer solely to provide the SynqOS service for the duration of the active subscription. On termination, personal data is deleted within 30 days unless retention is required by law.

Processing activities include:

• Storing venue operational data submitted by the Customer
• Sending operational data to Google Gemini to produce briefings and suggestions
• Generating marketing content, social media posts and email campaigns at the Customer's direction
• Syncing with third-party platforms the Customer connects (Square, SumUp, Meta, Google) at the Customer's direction
• Returning results, reports and recommendations to the Customer's dashboard

• Customer names and email addresses
• Booking history and session data
• Review content and customer feedback
• Payment references (not full card details — held by Stripe)
• Any other personal data the Customer chooses to connect via integrations

The Customer's venue guests, end customers, and staff members whose data the Customer submits to the SynqOS service.

The Customer (as data controller) confirms:

• They have a valid lawful basis under UK GDPR to process the personal data submitted to SynqOS.
• They are responsible for obtaining any consents required from their end customers.
• They are responsible for handling data subject rights requests from their own customers.
• They will only submit personal data to SynqOS that is necessary for the service.
• They will notify SynqOS of any instructions that would cause SynqOS to breach applicable data protection law.

SynqOS Ltd confirms:

• We will process personal data only on the Customer's documented instructions (delivering the service as described).
• We will ensure persons authorised to process personal data are bound by appropriate confidentiality obligations.
• We will implement appropriate technical and organisational measures to protect personal data, including TLS encryption in transit, AES-256 encryption at rest, and row-level security isolating each customer's data.
• We will assist the Customer in complying with data subject rights requests where technically possible.
• We will notify the Customer without undue delay (and within 72 hours where possible) of any personal data breach affecting their data.
• We will make available all information necessary to demonstrate compliance with this DPA upon reasonable request.
• We will delete or return all personal data on termination of the service, within 30 days.

The Customer authorises SynqOS to engage the following sub-processors. SynqOS will notify the Customer of any material changes to this list with at least 14 days' notice.

All sub-processors are contractually prohibited from using personal data for any purpose other than providing their services to SynqOS. When the Customer uses Customer Support tools, the content of their customers' emails (including name and email address) is sent to Google Gemini to draft replies and spot follow-ups; nothing is sent unless those tools are used. We use Google's paid Gemini API, under which Google does not use this content to train its models. Our automation workflows (n8n) also send venue data to Gemini to produce briefings, including café, revenue, support, competitor and SEO briefings. The Family & Education tool sends the text of web pages the Customer chooses (which may include school or nursery contact details) to Gemini to extract dates, events and contacts. Re-engagement and Family & Education emails are sent from the Customer's own connected Gmail account; customer names and email addresses from the Customer's booking API pass through our automation service to do this.

Successful automation runs are not stored by our automation service (n8n). Failed runs are kept in its log only for troubleshooting and are deleted automatically.

Where personal data is transferred outside the UK, SynqOS relies on the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses with the UK Addendum, as specified in the sub-processor table above.

SynqOS maintains the following technical and organisational measures:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security ensuring each customer's data is isolated
• Passwords hashed with bcrypt
• Access controls restricted to authorised personnel
• Regular security reviews of the platform and sub-processors

The Customer may request a summary of SynqOS's data protection practices once per year at no charge by emailing hello@synqos.co.uk. SynqOS will respond within 30 days.

This DPA is governed by the laws of England and Wales. Disputes are subject to the exclusive jurisdiction of the courts of England and Wales.

Data protection queries: hello@synqos.co.uk

Full Terms of Service: synqos.co.uk/terms