Privacy policy for SOP
Effective date: 22 October 2026
Version: 1
1. Who we are
SOP is the operations-management platform provided by SyncDit B.V. ("Syncdit", "we", "us"), a private limited liability company (besloten vennootschap) incorporated in the Netherlands. Our registered address is Koninginnegracht 23, 2514 AB Den Haag, the Netherlands. Our KvK registration number is 42099785.
For privacy enquiries, contact legal@syncdit.ai or write to our registered address. For product support, contact support@syncdit.ai.
We have not appointed a data protection officer, because we are not required to under GDPR Article 37. Syncdit has no establishment or representative outside the European Economic Area. Syncdit also operates a recruitment platform with its own privacy policy; this policy covers SOP only.
This policy explains two different situations:
- Our own business activities: Syncdit is controller when it decides how personal information is used to manage its customer relationships, respond to direct enquiries, meet its own legal duties or pursue its own legal claims.
- Customer operations in SOP: the organisation responsible for your placement or onboarding decides the purposes of that processing. Syncdit processes the information on its instructions under a data processing agreement. Where our customer acts for another controller, Syncdit is a subprocessor in that chain.
For customer-controlled processing, read the privacy notice provided by the organisation managing your onboarding. It identifies the controller, its contact details and the legal grounds for its processing. This policy supplements that notice. Contact us if you need help identifying the responsible organisation.
2. Information and sources
| Category | Examples | Sources |
|---|---|---|
| Business contacts and communications | Name, work email, organisation, job role, enquiries and correspondence | You and your organisation |
| Billing and accounting information | Billing contacts, invoice details and payment records | You, your organisation and accounting records |
| Website and legal-page visits | IP address, browser details and the page requested, in our server logs. Public pages use no analytics or tracking | Your browser |
| Account and access information | Name, email, memberships, roles, sign-in events and access records | You, authorised administrators and identity providers |
| Contractor and placement information | Contact details, date of birth, nationality, gender, address, bank and tax details (which can include a national ID number), emergency contacts, company details for self-employed contractors, protective-equipment sizes, projects and onboarding tasks | You, the customer, its authorised users and connected recruitment systems such as Vincere through Unified.to |
| Documents and signatures | Identity and immigration documents, qualifications, insurance, signed documents, metadata and extracted details | You, authorised users, connected systems and signing providers |
| Assistance and support | Messages, AI conversations, selected operational context, feedback and submitted screenshots | You and authorised users requesting assistance |
| Technical records | IP addresses, authentication events, audit records, errors and usage events | Your use of SOP and the systems that deliver it |
Medical or fitness information is a special category of personal data. Where a customer asks for it, SOP stores the medical or fitness certificate the contractor uploads (for example an offshore medical certificate) and details read from it, such as its expiry date. It is visible to the customer's authorised operations users with access to that contractor. The customer decides whether to ask for it and on what legal ground.
Some information concerns people other than the user who submits it, such as emergency contacts and signatories. The responsible organisation informs those people.
3. Syncdit's own purposes and legal grounds
For the purposes below, SyncDit B.V. is the controller.
| Purpose | Information used | Legal ground |
|---|---|---|
| Manage business enquiries and customer relationships | Business contact details, correspondence and account-management records | Article 6(1)(f): our legitimate interest in responding to enquiries and administering relationships with organisations using SOP |
| Administer a contract with an individual customer | Contact details and information needed to arrange and deliver that contract | Article 6(1)(b): performance of that contract or steps taken at your request before entering into it |
| Provide direct support and follow up reported problems | Contact details, correspondence and relevant diagnostic information | Article 6(1)(f): our legitimate interest in resolving enquiries and keeping the service working |
| Protect SOP against abuse and investigate security incidents | Access, authentication and technical records | Article 6(1)(f): our legitimate interest in preventing unauthorised access, fraud and disruption |
| Keep required business and tax records | Invoice, payment and accounting information | Article 6(1)(c): Dutch statutory administration and retention duties, including Article 52 of the Algemene wet inzake rijksbelastingen |
| Respond to rights requests about our own processing | Identity-verification information, correspondence and outcomes | Article 6(1)(c): our obligations under GDPR Articles 12–22 |
| Establish, exercise or defend legal claims | Relevant contract records, correspondence and evidence | Article 6(1)(f): our legitimate interest in protecting and enforcing legal rights |
You can object to processing based on legitimate interests, as explained in section 9.
4. Customer-controlled processing in SOP
For the activities below, Syncdit acts as processor for the customer. The customer's own privacy notice sets out the legal grounds.
| Purpose | Information used |
|---|---|
| Provide workspace access and manage permissions | Accounts, memberships and assigned roles |
| Organise placements and onboarding | Contractor profiles, project records, tasks and communications |
| Store documents and extract their details | Uploaded documents, metadata and extracted details |
| Arrange signatures and communications | Signatory details, documents, contact details and delivery records |
| Provide requested AI assistance | Messages and selected operational context |
| Handle rights requests about customer data | Relevant records, request details and verification |
The customer decides which information its onboarding requires and explains what happens if it is not provided. Please do not submit unrelated personal information.
5. AI assistance and document extraction
SOP's assistant, Synco, uses AI models hosted by Deep Infra, Inc. (DeepInfra) in the United States. Messages and selected context can include a contractor's name, client, project, office, role and onboarding stage; bank, tax, date of birth, address, email and phone details are not included. Text from files attached to the chat is also sent. Only include information relevant to the task. DeepInfra does not retain request and response content and does not use it to train models, under its data processing agreement. The transfer to the United States relies on standard contractual clauses.
Document extraction uses Google Cloud Document AI and Vertex AI in the EU. They can process document contents, including health information where present. Vertex AI is also used to suggest onboarding templates and briefings from placement details, and to translate email templates. Google does not use the content to train models and does not keep it after processing, apart from short-lived caching of up to 24 hours, under the Google Cloud Data Processing Addendum.
AI output and extracted details can be inaccurate. Authorised users check them before relying on them, and SOP is not used for solely automated decisions with legal or similarly significant effects.
6. Recipients and international transfers
Information is accessible to the customer's authorised users and, where needed for their work, to Syncdit personnel, who are based in the Netherlands. Customer users can be located anywhere the customer operates, including outside the European Economic Area; the customer's privacy notice explains this. Providers support hosting, authentication, AI, recruitment integrations, signing, email, feedback and analytics. The subprocessor list names each of them.
For Syncdit's own purposes in section 3, we share information only with professional advisers such as an accountant or lawyer where needed. We may also disclose information where the law requires it or where necessary for legal claims.
Our database, document storage, backups and logs are in Google Cloud in the Netherlands; background tasks run in Belgium. The recipients below process information outside the European Economic Area, each under the safeguard stated. Contact legal@syncdit.ai for a copy of the safeguards.
| Recipient | Country | Safeguard |
|---|---|---|
| Deep Infra, Inc. | United States | Standard contractual clauses |
| Plus Five Five, Inc. (Resend) | United States (account data and email logs; emails are sent from Ireland) | EU-US Data Privacy Framework; standard contractual clauses |
| Slack Technologies Limited | United States | Salesforce binding corporate rules; standard contractual clauses |
| Unified API Inc. (Unified.to) | Canada | EU adequacy decision |
| DocuSign | United States (account and signing audit-trail data) | DocuSign binding corporate rules; standard contractual clauses |
| ScaleKit, Inc. and PostHog, Inc. | United States (support access only; data stored in the EU) | Standard contractual clauses |
7. Retention
We keep personal information only as long as needed for the purpose it was collected for, then delete or anonymise it. Where the law requires us to keep information longer, we keep only what is required and use it only for that purpose.
Information Syncdit controls
| Information | How long we keep it |
|---|---|
| Business contacts and correspondence | While the business relationship or enquiry continues; afterwards we review it and delete what we no longer need |
| Direct support correspondence | Until the issue is resolved, and afterwards only while it is needed to follow up or handle a related claim |
| Requests about your rights | Until the request is handled, and afterwards only while needed to show how we handled it |
| Accounting records | 7 years, as required by Dutch tax law |
| Server and application logs, including IP addresses | 30 days |
Information we process for customers
| Information | How long we keep it |
|---|---|
| Contractor, placement, onboarding and document records, including AI conversations, extracted details, signing records and communications | As long as the customer decides. When the customer's agreement with Syncdit ends, we return the information on request and then delete it within 30 days |
| User accounts and permissions | While the customer gives the user access. The customer can remove access at any time |
Backups. Deleted information remains in encrypted backups until they expire, within 60 days. Backups are used only to restore the service, and deletions are applied again after any restore.
8. Cookies and similar technologies
| Type | Purpose | Duration | Consent |
|---|---|---|---|
| Sign-in and security | Keep you signed in, renew your session, open the right workspace and protect single sign-on against forged requests | Up to 7 days | Not needed: necessary |
| Preferences | Remember your language, layout and display choices, and announcements you closed | Up to 1 year, or until cleared | Not needed: functional |
| Analytics: PostHog (ph_…_posthog cookie and local storage) | Usage analytics and session replay in the operator dashboard, provided by PostHog, Inc. | 1 year | Asked first; optional |
Only the operator dashboard uses optional cookies, and it asks before setting them. The contractor portal and public pages use only necessary and functional cookies.
Analytics are provided by PostHog, in its EU cloud in Germany. They run only in the operator dashboard, after you choose "Allow". Events use an internal user ID and page paths with identifiers removed. Session replays show how the dashboard is used, with all text, form inputs and attributes masked and images blocked. We use them only to improve SOP. Events are kept for 12 months and session replays for 30 days. You can withdraw at any time in Settings > Privacy, which stops recording and removes the analytics cookie and local storage from that browser. Your choice is saved on your account, so you are not asked again on another device. Contact legal@syncdit.ai to have earlier events and recordings deleted.
9. Your rights
You can request access to, correction, erasure or restriction of your personal information, and data portability. You can object to processing based on legitimate interests and, at any time, to direct marketing. Where processing relies on consent, you can withdraw it without affecting earlier processing. You also have rights concerning automated decisions.
Contact legal@syncdit.ai, also if you cannot sign in or have no account. For information a customer controls, contact that organisation directly or ask us to pass your request on; we help it respond. We may ask for information needed to verify your identity. Requests are answered within one month, which can be extended by two months for complex requests; we tell you if that happens. Requests are free.
You can complain to a supervisory authority, particularly where you live, work or believe an infringement occurred. In the Netherlands this is the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, the Netherlands, telephone +31 88 180 5250. You do not need to contact us first.
10. Security and changes
SOP limits access to authorised users with role-based permissions, encrypts information in transit and at rest, and keeps production data separate for each customer.
We announce material changes to this policy by email where we have your address, and on this page. Previous versions are available from legal@syncdit.ai.
11. Minors and language
SOP is not intended for anyone under 18, and customers do not onboard contractors under 18 through it. If we learn that a minor's information was submitted, we ask the customer to remove it.
This policy is available in English. If a translation is provided, the English version prevails.