1. Introduction

This Comprehensive Privacy & Data Protection Policy("Policy") outlines how SINQ Ltd ("SINQ", "we", "us", "our") collects, uses, discloses, stores, transfers, and protects personal and project data through its web platform, mobile application, and connected services (the "Platform"). It applies to all users globally and is compliant with:

• UK GDPR and the Data Protection Act 2018
• California Consumer Privacy Act (CCPA/CPRA)
• Other applicable UK, EU, and US state data protection regulations

By using our services, you acknowledge that you have read and understood this Policy. This Policy also includes provisions for international data transfers, third-party integrations, user rights, and security controls.

2. Our Commitment to Privacy

SINQ is committed to protecting your privacy and applying data protection principles throughout our system:

• *Transparency:* Clear explanation of what we collect and why.
• *Security:* Use of industry-leading security protocols.
• *User Control:* Mechanisms that empower users to manage, modify, or delete their data where applicable.

3. Information We Collect

We may collect the following categories of personal and operational data:

• *User Identity Data:* Name, email address, login credentials
• *Professional Information:* Company name, job title, department
• *Technical Data:* IP address, browser type, device ID, access times
• *Usage Data:* Clickstream, feature use, support logs
• *Project Data:* Uploads, text entries, media files, annotations
• *Verification Data:* Email confirmation logs
• *Geolocation Data:* Via integrations with Mappr for mapping and address services

4. Legal Bases for Processing

We process your personal data on the following legal bases, depending on your jurisdiction:

• *Contractual Necessity:* For registration, login, and core service provision
• *Legitimate Interests:* To ensure platform functionality and fraud prevention
• *Consent:* For email communications, analytics, and cookies where applicable
• *Legal Obligation:* For compliance with UK or US authorities

5. How We Use Your Data

We use collected data to:

• Provide and manage your account
• Process project variation data, exports, and communications
• Personalise your experience and improve features
• Communicate with users via notifications, support, and updates
• Conduct security monitoring and usage analysis
• Meet legal and compliance obligations

6. Third-Party Services & Integrations

Your data may be shared with carefully vetted service providers under data processing agreements:

• *Google Cloud / Google Docs:* For project-related document embedding
• *Mappr:* For address mapping, geolocation validation
• *Abstract:* For verifying email authenticity and preventing spam

These third parties may store and process data outside of your jurisdiction. We ensure they apply Standard Contractual Clauses (SCCs), UK IDTAs, or equivalent safeguards.

7. International Data Transfers

SINQ stores and processes data primarily in the UK and United States. Where your data is transferred outside the UK, EEA, or US, we apply appropriate legal safeguards including:

• Standard Contractual Clauses (SCCs)
• UK Government-approved IDTAs
• Due diligence and contractual data protection addenda with processors

8. Data Retention and Deletion

• *Personal Account Deletion:* Users may request deletion of their personal data. This must be approved by their company administrator. Once approved, the user's personal data will be permanently removed.
• *Corporate Account Deletion:* When a company deletes its account, administrator personal data is deleted after a 30-day cancellation period. Corporate project data is retained for SINQ’s operational, legal, and business use.
• *Retention Periods:* We retain personal data only as long as necessary to fulfill its intended purpose and comply with legal obligations.

9. Security Measures

To protect your data, we implement:

• **Encryption:** All data is encrypted in transit (TLS) and at rest (AES)
• **Access Controls:** Restricted access based on user roles and credentials
• **Regular Audits:** Ongoing vulnerability scans and security testing
• **Physical Security:** Our AWS-hosted environments in the UK are ISO/IEC 27001-certified
• **Incident Response:** We have procedures in place to respond to and report security breaches

10. Your Rights

You have the following rights, depending on your jurisdiction:

• *Right to Access:* Obtain a copy of your personal data
• *Right to Rectification:* Request correction of incomplete or inaccurate data
• *Right to Erasure ("Right to be Forgotten")*
• *Right to Restrict Processing*
• *Right to Data Portability*
• *Right to Object:* Where processing is based on legitimate interests or direct marketing
• *Right to Withdraw Consent*: At any time when processing is based on consent

To exercise these rights, contact: contact@sinq.co.uk

11. California Residents – CCPA/CPRA Notice

California residents have additional rights under the CCPA/CPRA:

• Right to know what personal data we collect and how we use it
• Right to request deletion
• Right to opt out of the sale or sharing of personal information (SINQ does not sell data)
• Right to non-discrimination for exercising CCPA rights

12. Cookies and Similar Technologies

We use cookies and similar tracking technologies to:

• Maintain session state and login continuity
• Track usage patterns for feature improvement
• Manage preferences

You may adjust your browser or mobile device settings to reject or delete cookies. For full functionality, we recommend allowing cookies.

13. Children's Privacy

Our services are not intended for children under the age of 16. We do not knowingly collect data from children. If we learn that we have collected data from a child without verified parental consent, we will delete it immediately.

14. Changes to This Policy

We may revise this Privacy Policy at any time. If changes are material, we will notify you through email or the Platform. The “Effective Date” at the top of this document will always reflect the current version.

15. Contact Us

To raise a concern, make a request under data protection law, or for general queries, contact:

SINQ Ltd

19 North Street

Ashford, Kent, England, TN24 8LF

Email: contact@sinq.co.uk