SINQ LTD – PRIVACY & DATA PROTECTION

This Comprehensive Privacy & Data Protection Policy ("Policy") outlines how SINQ Ltd ("SINQ", "we", "us", "our") collects, uses, discloses, stores, transfers, and protects personal and project data through its web platform, mobile application, and connected services (the "Platform"). It applies to all users globally and is compliant with:

• UK GDPR and the Data Protection Act 2018
• California Consumer Privacy Act (CCPA/CPRA)
• Other applicable UK, EU, and US state data protection regulations

By using our services, you acknowledge that you have read and understood this Policy. This Policy also includes provisions for international data transfers, third-party integrations, user rights, and security controls.

SINQ is committed to protecting your privacy and applying data protection principles throughout our system:

• Transparency: Clear explanation of what we collect and why.
• Security: Use of industry-leading security protocols.
• User Control: Mechanisms that empower users to manage, modify, or delete their data where applicable.

We may collect the following categories of personal and operational data:

• User Identity Data: Name, email address, login credentials
• Professional Information: Company name, job title, department
• Technical Data: IP address, browser type, device ID, access times
• Usage Data: Clickstream, feature use, support logs
• Project Data: Uploads, text entries, media files, annotations
• Verification Data: Email confirmation logs
• Geolocation Data: Via integrations with Mappr for mapping and address services

We process your personal data on the following legal bases, depending on your jurisdiction:

• Contractual Necessity: For registration, login, and core service provision
• Legitimate Interests: To ensure platform functionality and fraud prevention
• Consent: For email communications, analytics, and cookies where applicable
• Legal Obligation: For compliance with UK or US authorities

We use collected data to:

• Provide and manage your account
• Process project variation data, exports, and communications
• Personalise your experience and improve features
• Communicate with users via notifications, support, and updates
• Conduct security monitoring and usage analysis
• Meet legal and compliance obligations

Your data may be shared with carefully vetted service providers under data processing agreements:

• Google Cloud / Google Docs: For project-related document embedding
• Mappr: For address mapping, geolocation validation
• Abstract: For verifying email authenticity and preventing spam

These third parties may store and process data outside of your jurisdiction. We ensure they apply Standard Contractual Clauses (SCCs), UK IDTAs, or equivalent safeguards.

SINQ stores and processes data primarily in the UK and United States. Where your data is transferred outside the UK, EEA, or US, we apply appropriate legal safeguards including:

• Standard Contractual Clauses (SCCs)
• UK Government-approved IDTAs
• Due diligence and contractual data protection addenda with processors

• Personal Account Deletion: Users may request deletion of their personal data. This must be approved by their company administrator. Once approved, the user's personal data will be permanently removed.
• Corporate Account Deletion: When a company deletes its account, administrator personal data is deleted after a 30-day cancellation period. Corporate project data is retained for SINQ’s operational, legal, and business use.
• Retention Periods: We retain personal data only as long as necessary to fulfill its intended purpose and comply with legal obligations.

To protect your data, we implement:

• Encryption: All data is encrypted in transit (TLS) and at rest (AES)
• Access Controls: Restricted access based on user roles and credentials
• Regular Audits: Ongoing vulnerability scans and security testing
• Physical Security: Our AWS-hosted environments in the UK are ISO/IEC 27001-certified
• Incident Response: We have procedures in place to respond to and report security breaches

You have the following rights, depending on your jurisdiction:

• Right to Access: Obtain a copy of your personal data
• Right to Rectification: Request correction of incomplete or inaccurate data
• Right to Erasure ("Right to be Forgotten")
• Right to Restrict Processing
• Right to Data Portability
• Right to Object: Where processing is based on legitimate interests or direct marketing
• Right to Withdraw Consent: At any time when processing is based on consent

To exercise these rights, contact: contact@sinq.co.uk

California residents have additional rights under the CCPA/CPRA:

• Right to know what personal data we collect and how we use it
• Right to request deletion
• Right to opt out of the sale or sharing of personal information (SINQ does not sell data)
• Right to non-discrimination for exercising CCPA rights

We use cookies and similar tracking technologies to:

• Maintain session state and login continuity
• Track usage patterns for feature improvement
• Manage preferences

You may adjust your browser or mobile device settings to reject or delete cookies. For full functionality, we recommend allowing cookies.

Our services are not intended for children under the age of 16. We do not knowingly collect data from children. If we learn that we have collected data from a child without verified parental consent, we will delete it immediately.

We may revise this Privacy Policy at any time. If changes are material, we will notify you through email or the Platform. The “Effective Date” at the top of this document will always reflect the current version.

To raise a concern, make a request under data protection law, or for general queries, contact: