AGB - Synchron.io

Allgemeine Verkaufsbedingungen (AGB).

1. Preamble

These General Terms and Conditions of Sale (the “T&Cs”) govern the contractual relationship between , a French simplified joint stock company (Société par actions simplifiée unipersonnelle – SASU) with share capital of euros, registered with the Paris Trade and Companies Register under number , whose registered office is located at Tt hL3 [email protected] tsVVs fXI@J (the “Provider”), and any professional client (the “Client”) wishing to subscribe to the services offered by the Provider.

Where applicable, the contractual relationship between the Parties is also governed by (i) any specific conditions or order form accepted by the Client, (ii) any specific service level agreement (SLA), (iii) the Data Processing Agreement (DPA) annexed to these T&Cs, (iv) these T&Cs and (v) the Terms of Use of the Website and the Service. In the event of any inconsistency between these documents, they shall prevail over one another in the foregoing order.

2. Purpose

The Provider supplies the Client with a software-as-a-service offering (“SaaS”) enabling the Client to connect, automate and synchronise applications via a dedicated online platform (the “Service”). The Service consists in the grant of a non-exclusive, non-transferable, revocable and time-limited licence (corresponding to the subscription term) to use the Synchron.io software, without any sale or transfer of intellectual property rights. The software remains the exclusive property of the Provider and is protected by copyright. The fees paid by the Client primarily remunerate this right to use the software, together with associated online access, technical support and application maintenance services. The detailed characteristics of the Service are described on the Provider’s website and in the applicable contractual documentation. These T&Cs set out the rights and obligations of the Parties in connection with the use of the Service.

For the avoidance of doubt, the Provider acts as a technical integration and automation service provider. The Provider does not provide legal, tax or regulatory advice and does not recommend, endorse or guarantee any particular third-party tool, platform or configuration. The Client remains solely responsible for selecting the applications and services it chooses to connect via the Service and for assessing whether such choices are appropriate for its business and compliant with applicable law.

3. Acceptance of the T&Cs

Acceptance of these T&Cs is evidenced by the validation of an order or the creation of an account on the platform. Such acceptance implies full and unconditional adherence to these T&Cs. The Client must read them carefully before placing any order. The choice and purchase of the Service are the sole responsibility of the Client.

These T&Cs are accessible at any time on the Synchron website and prevail over any other contractual or pre-contractual document not expressly accepted in writing by the Provider. Unless proven otherwise, the data recorded in the Provider’s information systems constitute proof of all transactions concluded with the Client.

3.2. Changes to the T&Cs

The Provider reserves the right to amend these T&Cs at any time. The new version of the T&Cs will be notified to the Client by any appropriate written means (including by email or by notification within the Service interface) and shall take effect from the next renewal period of the relevant subscription.

In the event that the Client disagrees with the amended T&Cs, it may terminate the Contract before the effective date of the changes, in which case termination shall take effect on that date, without any compensation being due by either Party.

4. Access to the Service

4.1. Account creation

Access to the Service requires the creation of a user account by the Client. The Client is responsible for the confidentiality of its login credentials and undertakes to inform the Provider without delay of any unauthorised or suspicious use.

4.2. Availability

The Provider undertakes to use reasonable efforts to provide access to the Service after acceptance of the T&Cs, validation of the order and, where applicable, receipt of the amounts due. The Service is in principle accessible 24 hours a day, 7 days a week, except for maintenance operations, updates, events of force majeure or incidents beyond the Provider’s reasonable control.

Planned maintenance: the Provider will, where reasonably possible, inform the Client in advance of maintenance windows likely to result in temporary unavailability of the Service.

Emergency maintenance: in the event of urgent corrective maintenance, the Provider undertakes to minimise interruptions and inform the Client as soon as possible.

4.3. Subscription term

The right to access and use the Service is granted for the subscription term (monthly, annual or otherwise) defined in the order, and is renewed by tacit renewal for successive periods of the same duration, unless terminated in accordance with Article 11. The licence is revocable in the event of non-payment or breach of the T&Cs and does not entail any transfer of rights beyond the period effectively paid for.

4.4. Technical requirements

The Client is responsible for having Internet access and equipment compatible with the technical requirements defined by the Provider. The Provider shall not be liable for any unavailability or malfunction of the Service resulting from technical incompatibility, Internet or telecom failures, issues with access providers or failures of the Client’s own infrastructure.

4.5. Configuration assistance

The Provider may provide assistance with the initial configuration of integrations on the platform, in accordance with the arrangements agreed with the Client. Unless expressly stipulated otherwise, such assistance does not include advisory or custom development services and does not involve any obligation of result.

4.6. Technical support

The Provider offers technical support via email, chat or any other channel indicated on the website, during business hours. Any guaranteed service levels or response times may be set out in a specific service level agreement (“SLA”), which, in the event of conflict, shall prevail over these T&Cs.

4.7. Usage limits – quotas – APIs

The Provider may define reasonable usage limits for the Service (maximum number of scenarios, tasks processed, concurrent connections, data volumes or API calls, etc.), as described on the Site, in the documentation or in the applicable order form.

In the event of significant and repeated exceedances of such limits, the Provider may, after prior notice to the Client, (i) propose an adjustment to the subscription, or (ii) limit, throttle or suspend the relevant processing, strictly to the extent necessary to preserve the stability of the Service and its infrastructure.

The Client acknowledges that the operation of integrations depends on APIs and services provided by third parties (software vendors, e-commerce platforms, payment providers, etc.), which may modify or discontinue their APIs, terms of use or performance. The Provider does not guarantee the future availability or compatibility of such integrations and shall not be liable for any consequences of any modification, limitation or discontinuation of a Third-Party Service or its API.

5. Prices and payment terms

5.1. Prices

The applicable prices are those in force on the date of the order, as displayed on the Synchron.io website or specified in the commercial proposal. Prices are expressed in euros, excluding and including VAT, and may reflect any discounts granted by the Provider on the Synchron website.

These prices are firm and non-revisable for their stated validity period, but the Provider reserves the right, for subsequent subscription periods, to modify its prices at any time. The Client shall be informed of any price changes within a reasonable period before they take effect and may, where applicable, terminate its subscription in accordance with Article 11.

For Clients established within the European Union, VAT is invoiced in accordance with the applicable regulations, based on the information provided by the Client, in particular its intra-Community VAT number where applicable. The Client is responsible for the accuracy and timely updating of such information.

For Clients established outside the European Union, prices are invoiced exclusive of tax; the Client is solely responsible for any declarations and payments of taxes, duties or charges that may be applicable in its country of residence or operation.

5.2. Payment

Payment is made by credit card, SEPA direct debit or any other method offered on the Site, according to the selected billing frequency (monthly, annual, etc.). Invoices are issued electronically by the Provider and made available to the Client.

Payment data are exchanged in encrypted form using the protocol defined by the authorised payment service provider responsible for processing card transactions carried out on the Synchron website.

Unless otherwise stated, the price is payable in full by the Client on the date of the order or in accordance with the subscribed billing frequency. Any customs duties or other local taxes, import duties or governmental taxes may be due; such amounts are the sole responsibility of the Client.

Payments made by the Client shall be deemed final only after actual receipt of the amounts due by the Provider. The Provider shall not be required to provide or maintain access to the Service if the Client fails to pay the agreed price in accordance with the conditions set out above.

5.3. Late payment

Any late payment shall automatically and without prior formal notice entail:

late-payment penalties calculated at a rate equal to three times the French legal interest rate; and
a fixed indemnity of forty (40) euros for recovery costs, without prejudice to the Provider’s right to claim additional compensation upon evidence of higher actual recovery costs.

5.4. Orders

It is the Client’s responsibility to select on the Synchron website the Services it wishes to order, according to the following steps:

the Client logs in to its customer area and selects a Service;
the Client enters its details and may modify or delete the Service before validating the order and accepting these T&Cs;
after validation of the information, the order is considered final and requires payment by the Client in accordance with the agreed terms.

The sale is deemed final only after full payment of the price. It is the Client’s responsibility to verify the accuracy of the order and to immediately report any error. Any order placed on the Synchron website constitutes the conclusion of a distance contract between the Client and the Provider.

The Provider reserves the right to cancel or refuse any order from a Client with whom there is a dispute relating to the payment of a previous order or a clear risk of insolvency.

6. Provider’s obligations

6.1. Provision of the Service

The Provider undertakes to use all reasonable efforts to ensure the availability and proper functioning of the Service, in accordance with industry standards and the applicable documentation. The Provider is bound by an obligation of means.

6.2. Maintenance and updates

The Provider may carry out maintenance, update or upgrade operations that may render the Service temporarily unavailable. Where reasonably possible, such operations are scheduled at times intended to minimise their impact on the Client’s business.

The Provider is free to modify and improve the content and features of the Service in order to take account of technical, legal or organisational developments.

In the event of any substantial modification affecting an essential functionality of the Service, the Provider shall inform the Client at least thirty (30) days before the change takes effect. If such modification has a significantly adverse impact on the Client’s use of the Service, the Client may terminate the Contract before the effective date of the modification, in which case termination shall take effect on that date, without any compensation being due by either Party.

6.3. No right of withdrawal

The Client acknowledges that it enters into the Contract in the course of its professional activity. As a result, consumer law provisions relating to any statutory right of withdrawal do not apply. The Contract is therefore deemed final as from the placement of the order by the Client.

6.4. Third-party services and integrations

The Service may enable the Client to connect its information systems with third-party online services, in particular software-as-a-service applications, e-commerce platforms, marketplace platforms, payment solutions, accounting software, CRMs, ERPs and other tools published and operated by third parties (the “Third-Party Services”).

The Client acknowledges that the Third-Party Services are provided exclusively by their respective publishers or providers, under their sole responsibility and pursuant to contractual terms to which the Provider is not a party. The Provider does not distribute, resell, represent or guarantee any Third-Party Service and does not control their availability, performance, security, evolution or legal compliance.

The Client is solely responsible for choosing, subscribing to and maintaining any contracts with the Third-Party Services and for complying with their applicable terms and conditions. The Provider shall not be liable for any interruption, suspension, modification or termination of a Third-Party Service, nor for any malfunction, configuration error or data loss attributable to a Third-Party Service or to the contractual relationship between the Client and the relevant third party.

The existence of an integration between the Service and a Third-Party Service shall not be construed as creating any agency, partnership, representation, joint venture or employment relationship between the Provider and the provider of such Third-Party Service.

7. Client’s obligations

7.1. Cooperation and accuracy of information

The Client undertakes to provide the Provider with all accurate, complete and up-to-date information necessary for the implementation of the Service, including connection parameters, technical information relating to its information systems, and any changes likely to affect the functioning of the Service.

7.2. Configuration, checks and controls

As the Service consists in particular of integrating, synchronising and automating data flows between different third-party applications, the Client remains solely responsible for:

the choice of connectors, workflows and synchronisation rules it implements via the platform;
the configuration, administration and security of its own systems, applications and third-party accounts (ERP, CRM, e-commerce sites, payment solutions, etc.);
performing regular checks on the proper execution of synchronisations and the resulting data (consistency, completeness, absence of anomalies, duplicates or unintended deletions).

The Client shall implement, within its own systems, appropriate control and validation procedures suited to its business and undertakes to notify the Provider without delay of any anomaly observed.

7.3. Backups and data security

The Service is not intended to replace a backup or archiving system. The Client is solely responsible for implementing, within its own systems and/or those of its third-party providers, adequate backup, recovery and security measures to preserve the integrity of its data.

The Client acknowledges that, in the absence of such backups, any loss or alteration of data may have significant consequences for which the Provider cannot be held liable beyond the limits set out in Article 10 of these T&Cs.

7.4. Legal compliance and processed content

The Client remains solely responsible for the lawfulness of the data and content it processes using the Service (including customer data, orders and e-commerce content), as well as for compliance with all regulations applicable to its business (contract law, data protection law, consumer law where applicable, tax rules, etc.).

The Client shall indemnify and hold harmless the Provider from and against any third-party claim based on the unlawful nature of data or processing carried out by the Client through the Service.

The Client represents and warrants that it complies with all laws and regulations applicable to it, including export control, economic sanctions and anti-corruption rules (including, where applicable, the French Sapin II law and sanctions regimes adopted by the European Union and, where relevant, the United States). The Client shall not use the Service in or for countries, persons or activities that are the subject of applicable sanctions or embargoes. In the event of a breach of this clause, the Provider may suspend or terminate the Contract with immediate effect, without prejudice to any damages it may claim.

The Client also undertakes to ensure that any end users to whom it grants access to the Service comply with these T&Cs and with the Terms of Use of the Website and of the Service.

7.5. Indemnity relating to Third-Party Services

Without prejudice to Article 7.4, the Client shall indemnify and hold harmless the Provider from and against any claim, action, proceeding, loss, damage, cost or expense (including reasonable legal fees) brought by (i) a publisher or provider of a Third-Party Service, or (ii) the Client itself against a Third-Party Service provider to the extent that such claim or proceeding also implicates the Provider, where such claim, action or proceeding arises from (a) the Client’s use of the Third-Party Services, (b) the Client’s breach of the contractual terms applicable to the Third-Party Services, or (c) any decision by the Client to initiate or conduct a dispute, complaint or legal action against a Third-Party Service provider, except where such claim, action or proceeding results from a proven breach by the Provider of its own contractual obligations under these T&Cs.

8. Confidentiality

Each Party undertakes to keep strictly confidential all information of any kind (commercial, technical, financial, organisational, etc.) received from the other Party in connection with the performance of these T&Cs, regardless of the medium used (written, oral, electronic, etc.) and which is not publicly available (the “Confidential Information”).

Except with the prior written consent of the other Party or where required by a mandatory legal or regulatory obligation, each Party shall refrain from disclosing the other Party’s Confidential Information to any third party or from using it for any purpose other than the performance of the Contract. Each Party shall disclose such information only to its staff members, corporate officers or service providers who are bound by a confidentiality obligation that is at least equivalent to that set out herein.

The following information shall not be regarded as Confidential Information:

information that was lawfully in the possession of the receiving Party before it was disclosed by the other Party;
information that enters the public domain through no fault of the receiving Party;
information that is lawfully received from a third party not bound by a confidentiality obligation; or
information that has been independently developed by the receiving Party without recourse to the other Party’s Confidential Information.

In the event of a request from a competent administrative or judicial authority, the Party required to disclose all or part of the other Party’s Confidential Information shall inform the other Party thereof, to the extent permitted by law and within a reasonable time, and shall limit the disclosure to the information strictly required.

The obligations set out in this Article shall remain in force throughout the term of the Contract and for a period of five (5) years following its termination, for any reason whatsoever.

9. Personal data

9.1. Roles of the Parties

For personal data processed by the Provider for its own purposes (management of the commercial relationship, invoicing, marketing, etc.), the Provider acts as data controller.

For personal data that the Client processes via the Service (data of its own customers, prospects, end users, etc.), the Client acts as data controller and the Provider as data processor within the meaning of the GDPR.

9.2. GDPR compliance

The Provider undertakes to process personal data in compliance with the applicable legislation, in particular the General Data Protection Regulation (GDPR). The Client is informed that the collection of its own personal data is necessary for the sale, performance and invoicing of the Services.

The categories of data processed, the purposes, retention periods and the rights of data subjects are detailed in the Provider’s Privacy Policy available on the Synchron website.

9.3. Security and sub-processing

The Provider implements appropriate organisational, technical, software and physical measures to ensure the security of personal data, in order to protect them against alteration, destruction or unauthorised access. The Provider may use sub-processors for certain operations, provided that they offer sufficient guarantees and agree to comply with equivalent obligations regarding personal data protection.

9.4. Data subject rights

In accordance with applicable regulations, data subjects have, inter alia, rights of access, rectification, erasure, restriction, objection, portability and the right to define instructions relating to the fate of their data after their death. Such rights may be exercised under the conditions set out in the Provider’s Privacy Policy or, where the Provider acts as processor, directly with the Client acting as data controller.

10. Liability

10.1. Obligation of means

The Provider is subject, under these T&Cs, to an obligation of means. The Client acknowledges that, given the complex nature of data exchanges between distinct information systems and the current state of digital technologies, the Provider cannot guarantee the complete absence of errors or interruptions, nor the suitability of the Service for any specific needs of the Client other than those expressly described in the commercial documentation.

10.2. Direct and indirect damages

The Provider may only be held liable for direct material or immaterial damages suffered by the Client and resulting from a proven breach by the Provider of its contractual obligations.

In all circumstances, and even if foreseeable, the following shall in any event be excluded from compensation as indirect damages (non-exhaustive list):

loss of turnover, orders, profits, margin, income or clientele;
damage to image or reputation;
loss of opportunity;
the cost of obtaining a substitute service or solution;
commercial loss or business interruption;
loss or alteration of data where no regular backup has been implemented by the Client in its own systems.

In particular, the Provider shall not be liable for any loss or damage resulting from the unavailability, malfunction, suspension, modification or termination of any Third-Party Service integrated by the Client via the Service, nor from any dispute, complaint or legal action between the Client and the provider of such Third-Party Service.

10.3. Global limitation of liability

All causes and events combined, the Provider’s aggregate and cumulative liability under these T&Cs, the Contract and any order, whether in contract, tort or otherwise, is expressly limited to:

the amount, excluding taxes, actually received by the Provider in respect of subscriptions paid by the Client for the Service during the twelve (12) months preceding the event giving rise to the damage, multiplied by two (2); and
without exceeding, for the entire duration of the contractual relationship, a total amount of fifty thousand euros (€50,000), all causes, claims and damages combined.

The Client acknowledges that this limitation of liability reflects the allocation of risk between the Parties and the price level agreed for the Service.

10.4. Claims and limitation period

Any claim or action by the Client against the Provider relating to the formation, performance or non-performance of these T&Cs must be brought within a maximum period of twelve (12) months from the event giving rise to the damage, failing which it shall be time-barred.

10.5. Mandatory exceptions

The limitations and exclusions of liability set out in this Article do not apply to bodily injury caused to individuals, nor to cases of gross negligence or wilful misconduct by the Provider, within the limits provided by mandatory applicable law.

11. Termination

11.1. Termination by the Client

The Client may terminate its subscription at any time, subject to a notice period of fifteen (15) days before the end of the current subscription period, via its customer area or by any other written means accepted by the Provider. No refund shall be made for any period already invoiced.

11.2. Termination by the Provider

The Provider reserves the right to suspend or terminate access to the Service, in whole or in part, in the event of the Client’s breach of these T&Cs, after a formal notice to remedy such breach has remained without effect for thirty (30) days, or immediately in the event of a serious breach that compromises the security or proper functioning of the Service.

11.3. Termination for non-payment

In the event of non-payment, the Provider may suspend access to the Service and, if the situation is not remedied within thirty (30) days of a formal demand for payment, terminate the Contract automatically, without prejudice to any legal action for recovery.

11.4. Effects of termination

Upon termination of the Contract, access to the Service is deactivated. The Client has a period of ninety (90) calendar days from the effective end date to request the retrieval of its data in a standard open format (in particular CSV and/or JSON) allowing reasonable reuse. After this period, the data may be deleted or anonymised by the Provider, except where statutory retention obligations apply.

The provision of a single standard export is included in the subscription fee. Any specific assistance relating to reversibility (data restructuring, multiple exports, assistance with import into another system, etc.) shall be the subject of a separate quotation and shall be invoiced at the Provider’s then current rates.

12. Intellectual property

All elements of the Synchron.io website and Service, including texts, images, software and databases, are the exclusive property of the Provider or its partners. No transfer of intellectual property rights is effected; the Client is granted only a non-exclusive, revocable licence to use the Synchron.io software for the duration of the subscription, without any right of assignment, sub-licensing or modification of the software. Any reproduction, representation or exploitation, in whole or in part, is strictly prohibited without the Provider’s prior written authorisation.

13. Governing law – Language

These T&Cs and the contractual relationship between the Provider and the Client are governed by French law. The T&Cs are drawn up in French and translated into English for convenience. In the event of any discrepancy between the French version and any foreign-language translation, the French version shall prevail.

14. Dispute resolution

14.1. Amicable resolution

In the event of any dispute relating to the interpretation, performance or termination of these T&Cs, the Parties shall use their best efforts to seek an amicable solution in good faith, in particular through written exchanges or meetings, before initiating legal proceedings.

14.2. Jurisdiction

Failing an amicable settlement, any dispute relating to the validity, interpretation, performance or termination of these T&Cs and, more generally, to the contractual relationship between the Provider and the Client, shall be submitted to the exclusive jurisdiction of the competent courts of Paris (France), even in the event of multiple defendants, third-party proceedings or protective measures, notwithstanding any contrary clause contained in the Client’s documents.

15. Force majeure

Neither Party shall be liable for any failure to perform its contractual obligations where such failure results from an event of force majeure within the meaning of Article 1218 of the French Civil Code, including, without limitation: natural disasters, fire, flooding, explosion, pandemics, acts of war or terrorism, riots, general or partial strikes affecting the Parties or their service providers, prolonged failure of a telecommunications network or hosting provider, or decisions of a public authority.

The Party invoking a case of force majeure shall notify the other Party as soon as reasonably possible and shall use its best efforts to limit the effects of such event. If the case of force majeure continues for more than thirty (30) consecutive days, each Party may terminate the Contract by written notice, without any compensation being due by either Party.

16. Commercial references

Unless the Client expressly objects in writing, the Provider is authorised to mention the Client’s name and logo as a commercial reference, in particular on its communication materials (website, presentations, commercial proposals, etc.), without disclosing any Confidential Information.

17. Non-solicitation of staff

The Client undertakes not to solicit or hire, directly or indirectly, any employee or collaborator of the Provider who has participated in the performance of the Contract, for the duration of the Contract and for a period of twelve (12) months following its termination, except with the Provider’s prior written consent.

In the event of a breach of this clause, the Client shall pay the Provider a lump-sum indemnity equal to six (6) months of the most recent gross monthly remuneration of the staff member concerned, without prejudice to the Provider’s right to seek full compensation for the loss actually suffered.

Annex – Processing of personal data (Data Processing Agreement – DPA)

This Annex forms an integral part of the T&Cs and governs the processing of personal data carried out by the Provider as processor on behalf of the Client, within the meaning of the GDPR.

1. Purpose of the Annex

The purpose of this Annex is to define the conditions under which the Provider is authorised to process, on behalf of the Client, the personal data necessary for the provision of the Service.

2. Description of the processing activities

The main characteristics of the processing activities are as follows:

Nature of the operations: collection, receipt, transmission, synchronisation, hosting, storage, consultation, deletion or anonymisation of data.
Types of data: identification data, contact data, data relating to orders and invoicing, and more generally any data that the Client decides to process via the Service.
Categories of data subjects: customers, prospects, end users, the Client’s staff members and any other person whose data are processed via the Service.
Purposes: performance of the integration, synchronisation and automation functionalities offered by the Service, as well as the provision of related support and maintenance services.
Duration: the term of the Contract, plus, where applicable, any additional retention periods strictly necessary for compliance with legal obligations or for the establishment, exercise or defence of legal claims by the Provider.

3. Obligations of the Provider as processor

The Provider undertakes to:

process personal data only on the basis of documented instructions from the Client, unless otherwise required by law;
ensure that persons authorised to process the data undertake to respect confidentiality or are subject to an appropriate statutory confidentiality obligation;
implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks;
notify the Client, without undue delay, of any personal data breach of which it becomes aware, providing the information available to it;
assist the Client, insofar as reasonably possible, in carrying out data protection impact assessments, handling data subject requests and, more generally, in complying with the Client’s obligations under the GDPR;
make available to the Client all information necessary to demonstrate compliance with the obligations set out in this Annex.

Audits

The Client may, once (1) in any rolling twelve (12)-month period and at its own expense, have an audit carried out of the technical and organisational measures implemented by the Provider to protect personal data, by an independent auditor who is not a competitor of the Provider and is bound by a confidentiality obligation.

The audit shall be conducted during business hours, on at least thirty (30) days’ prior written notice, and in a manner that does not unduly disrupt the Provider’s activities or the security of its systems. The Provider may make available existing audit or certification reports, where applicable, which the Client agrees to review before requesting any on-site audit.

4. Sub-processing

The Client authorises the Provider to engage sub-processors for all or part of the processing activities covered by this Annex, provided that:

such sub-processors offer sufficient guarantees regarding the implementation of appropriate technical and organisational measures;
the Provider enters into a written agreement with them imposing obligations that are at least equivalent to those set out in this Annex; and
the list of the main categories of sub-processors is made available to the Client by any appropriate means (website, documentation, etc.).

5. Transfers outside the European Union

Where personal data are transferred outside the European Union or may be accessed from a third country, the Provider undertakes to implement appropriate safeguards as required by the applicable regulations (such as standard contractual clauses adopted by the European Commission or any other measure recognised as adequate), in order to ensure a level of protection that is essentially equivalent to that guaranteed within the European Union.

6. End-of-contract data processing

Upon expiry of the Contract, the Provider shall, in accordance with the Client’s instructions:

either return the personal data to the Client, in a standard format, within the period provided for in Article 11.4;
or delete or irreversibly anonymise them, subject to any statutory retention obligations or requirements relating to the establishment, exercise or defence of legal claims.

In the absence of contrary instructions within the above-mentioned period, the Provider may proceed with the deletion or anonymisation of the data under the conditions set out above.

This English version is provided for convenience only. In the event of any discrepancy or conflict between this document and its original French version, the French version shall prevail and be deemed the sole legally binding version. The contractual relationship remains governed by French law and the exclusive jurisdiction of the courts of Paris (France), as set out in the French terms.

Datenschutzerklärung.

This privacy policy describes how @F1PU931V3 (hereinafter “we”, “us”, “our”, or the “Provider”) collects, uses and protects personal data in the context of the use of our website Synchron.io (the “Site”) and our SaaS software service (the “Service”).

1. Data controller

For the processing activities described in this document (management of the Site, client accounts, invoicing, support, marketing, etc.), the data controller is:

SASU
Ff z7N 2JRW5-rJLZ7N3 feHHe xJ1R3 🇫🇷
RCS Paris /
Contact email: legal@synclivehron.io

For the data that you process yourself via the Service (for example: data of your own end customers, e-commerce orders, etc.), you act as the data controller and we act as a processor, under the conditions defined in our General Conditions of Sale (CGV) and their annex “Data Processing Agreement (DPA)”.

2. Scope

This policy applies to:

visitors to the Site (contact forms, browsing, cookies, etc.);
B2B prospects (information requests, demos, newsletters, etc.);
users of Synchron.io client accounts (administrators and users);
technical connection data required for the security and proper functioning of the Service.

Processing carried out in our capacity as processor on behalf of our Clients (data synchronised via connectors, e-commerce flows, etc.) is detailed in the DPA Annex to our CGV, which you should refer to for further details.

3. Data collected, purposes and legal bases

We only collect data that is strictly necessary for the purposes we pursue. The main categories of data are as follows:

Category of data	Examples	Purposes	Legal basis
Identification and contact data (clients / prospects)	First and last name, professional email, job title, company, phone number	Creation and management of accounts, management of the commercial relationship, invoicing, support, organisation of demos, sending information about the Service.	Performance of the contract (clients) Legitimate interest (B2B prospecting, information about our services)
Billing / invoicing data	Billing address, payment information (via payment service provider), invoice history	Subscription billing, accounting management, monitoring payments and outstanding amounts.	Performance of the contract Legal obligation (accounting)
Connection and usage data for the Site / Service	Login logs, IP address, browser type, operating system, timestamps, actions performed in the interface.	Securing the Site and the Service, prevention of fraud and unauthorised access, improvement of user experience, production of anonymised statistics.	Legitimate interest (security, improvement of the Service)
Prospecting / communication data	Email address, communication preferences, history of opening certain emails (where applicable).	Sending informational emails, newsletters, invitations to events or webinars related to Synchron.io.	Legitimate interest (B2B prospecting) Consent where required
Data processed via the Service on behalf of Clients	Data that the Client decides to synchronise (e.g.: end-customer data, orders, invoices, e-commerce data, etc.).	Integration, synchronisation and automation of data flows between applications (Shopify, WooCommerce, accounting systems, CRM, etc.) according to the configuration defined by the Client.	The Client determines the applicable legal basis or bases. We act as a processor in accordance with the DPA Annex.

Where applicable, our forms indicate whether fields are mandatory or optional, usually by means of an asterisk. If mandatory data is not provided, we may not be able to process your request or provide the Service.

4. Recipients and processors

We do not sell your personal data.

The main recipients of your data are:

Our authorised staff, in the course of their duties (support, technical, sales, billing, management);
Our technical service providers acting as processors on our behalf (hosting, payment provider such as Stripe, support tools, monitoring or emailing tools, etc.);
Where necessary, our professional advisors (lawyers, accountants) when required to defend our interests; and
Competent administrative or judicial authorities, where disclosure is required by law or a binding request.

We ensure that our processors provide sufficient guarantees in terms of security and confidentiality and that they only process data on our documented instructions. The main categories of processors can be provided upon simple request at legal.

5. Transfers of data outside the European Union

We favour hosting data within the European Union. However, some of our technical service providers may be located outside the European Union or may access data from a third country.

In such cases, we implement appropriate safeguards required by applicable regulations (such as standard contractual clauses adopted by the European Commission, or any other mechanism recognised as adequate) in order to ensure a level of protection that is essentially equivalent to that in force within the European Union.

6. Retention periods

We retain personal data only for as long as necessary for the purposes pursued, plus, where applicable, the statutory limitation periods. For example:

Account and billing data: for the duration of the contract, then in intermediate archiving for the limitation period applicable (in particular 10 years for accounting records);
B2B prospecting data: 3 years from the last active contact from you (click, request, reply, etc.);
Connection logs and technical data: from a few months up to 1 year, depending on security and traceability needs;
Data processed in our capacity as processor via the Service: for the duration of the contract, then 90 days after termination to enable data reversibility, in accordance with the DPA Annex and Article 11.4 of the CGV, before deletion or anonymisation, unless legal obligations require longer retention.

7. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

These measures include, without limitation: access control, management of user rights, logging of certain accesses, encryption of communications, regular backups, incident response procedures and periodic review of security practices.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you as soon as reasonably possible, in accordance with applicable regulations, as well as the measures taken to remedy or mitigate the breach.

8. Your rights

In accordance with applicable data protection law, you have, under the conditions laid down by the texts, the following rights:

Right of access: to obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, to obtain access to such data;
Right to rectification: to request the correction of inaccurate or incomplete data;
Right to erasure (“right to be forgotten”): to request deletion of your data in the cases provided for by law;
Right to restriction of processing: to request a temporary restriction of processing in certain cases;
Right to object: to object, on grounds relating to your particular situation, to processing based on our legitimate interests, as well as to object to processing for direct marketing purposes;
Right to data portability: to receive the data you have provided to us in a structured, commonly used and machine-readable format, and to transmit those data to another controller where the processing is based on consent or on a contract and carried out by automated means;
Right to define instructions regarding your data after your death.

You can exercise these rights:

via your client account, where the relevant functionality is available; or
by contacting us at the following address: rUE4rF6@uloZmuC9m.

We may ask you for proof of identity where we have reasonable doubts as to your identity. We will respond to your request within one (1) month, extendable by two (2) months in the event of complexity or a large number of requests.

When we act as a processor on behalf of a Client, we will assist that Client in handling requests to exercise rights that we receive, in accordance with the DPA Annex. You may be asked to contact the relevant Client directly, as the data controller.

9. Cookies and trackers

The Site may use cookies and other trackers to ensure its proper functioning, measure audience and, where applicable, improve your user experience.

Cookies that are strictly necessary for the operation of the Site are placed on the basis of our legitimate interests. Analytics or personalisation cookies that are not strictly necessary are only placed with your consent, which you can withdraw at any time.

For more information about the cookies used and how to manage your choices, you can consult our cookie policy, accessible from the Site.

10. Changes to this privacy policy

We may update this privacy policy from time to time to reflect legal, technical or organisational developments.

In the event of a material change, we will inform you by any appropriate means (banner on the Site, notification within the Service, email). The updated version will be published on the Site with the date of “last update”. Continued use of the Site or the Service after such information will constitute acknowledgement of the new policy.

11. Contact & complaints

For any question relating to this policy or to your personal data, you can contact us at: 1.591UZmbndIsbczs.

If, after contacting us, you consider that your rights have not been respected, you have the right to lodge a complaint with the competent supervisory authority, in particular in France with the CNIL (www.cnil.fr).

This privacy policy is governed by French law. In the event of a dispute, and unless mandatory legal provisions provide otherwise, the competent courts of Paris (France) shall have exclusive jurisdiction.