UK and EU Data Protection

1. The rules we work under

Synthaveil Ltd is a UK company, registered with the Information Commissioner's Office under number C2019845. The rules that apply to us are:

• the UK GDPR and the Data Protection Act 2018;
• the Privacy and Electronic Communications Regulations, for cookies and email;
• the EU GDPR, where it applies because we offer the service to people in the European Union.

Where the privacy laws of another country apply because of where a customer or individual is located, those laws apply too.

2. Who is responsible for what

Customer data. When a customer puts data through the Synthaveil service, the customer is the controller and we are the processor. We act only on the customer's instructions, under our Data Processing Agreement.

Software that runs on the customer's own systems. Where Synthaveil runs entirely on a customer's infrastructure, the customer's records do not reach us, and the customer is the sole controller of them.

Our own data. We are the controller for the operational information our software sends back to us and for the personal data we collect through this website, customer accounts and billing. The Privacy Notice explains how we handle website data.

3. Where data is processed

The Synthaveil service and its database run in the United Kingdom (London). Records collected through this website are stored in Ireland (EU). Some of the providers we use are based in the United States of America and may process data there; the Privacy Notice lists them and the safeguards we rely on.

Transfers of personal data between the UK and the European Economic Area are covered by adequacy decisions in both directions.

4. Special category data

Health information and other special category data under Article 9 of the UK GDPR and the EU GDPR can go through the service where the customer's agreement with us covers it (see the Acceptable Use Policy). Some optional features can also involve special category data.

• Where a customer sends special category data, or turns on a feature that involves it, the customer is responsible for having a lawful condition for that processing.
• Anything the service uses to choose a stand-in is used only while it does its work. It is never added to the data returned to the customer.

5. Automated decisions

The Synthaveil service does not make decisions about individuals. It replaces identifying details with stand-ins. A customer who uses the output in a system that makes decisions about people needs our written agreement first (see the Acceptable Use Policy).

6. Contact

Data protection questions: policies@synthaveil.com.