Customer data processing terms
Version: 5 October 2026
What these terms cover
Section titled “What these terms cover”These terms form part of the Syndik8 Terms of Service between Deltatek Software Limited, registered in England and Wales (Company No. 02975256), of 122 Great Berry Lane, Basildon, Essex, SS16 6BY (“we”, “us”), and the customer identified under those Terms (“customer”). They govern personal information we process on the customer’s behalf (“Customer Personal Data”). Contact [email protected] for processing matters.
The customer is the company, individual or appropriately represented person or persons responsible for the syndicate’s records. For an unincorporated group, the accepting representative must have authority to bind the relevant governing principals, as the Terms describe. A group name or app administrator role alone does not establish that authority.
Where applicable data protection law makes the customer controller and us processor, these terms provide the Article 28 processing contract. Where the customer is itself a processor, it confirms its controller’s authority and we act as subprocessor. An individual’s genuinely personal or household activity can be exempt for that individual; the same contractual protections still apply to our instructed processing. We retain our own applicable data protection duties.
These terms do not cover information we control for our own account, authentication, security, support, diagnostic, platform subscription/fee or optional personal pilot-document purposes. Those uses are described in the Privacy Policy. A supplier’s own controller processing is likewise outside this processor schedule.
Processing details
Section titled “Processing details”| Item | Scope |
|---|---|
| Subject and purpose | Provide the customer’s shared syndicate administration, bookings, usage/technical logs, maintenance, defects, votes, expenses, member accounting, files, invitations and related communications; assist with payment-account setup where acting solely on the customer’s instructions. |
| Nature | Receive, organise, store, retrieve, display, synchronise to authorised devices, export, transmit to authorised recipients, restrict and delete records as required to provide the service. |
| People | Members and former members, applicants/invitees, guests and pilots, inspectors, directors/owners/representatives, suppliers and others legitimately named in customer records. |
| Information | Identity/contact/membership information, roles and shareholdings, bookings, usage and technical-log entries, maintenance/defect records, votes, expenses/receipts, ledger/payment and mandate information, verification details for instructed payment setup, documents and relevant notes/attachments. Health or other sensitive information can occur in customer files; the customer must establish a lawful condition before entering it. Optional account-level pilot medicals are covered separately by our Privacy Policy. |
| Duration | While we provide the service, including the closure/retention periods described in the Terms and Privacy Policy, until return/deletion under the provisions below. Those default periods do not override the customer’s lawful return/deletion choice. |
The customer determines lawful purposes, data subjects and relevant information, has the required rights and legal bases, provides required privacy information and establishes any special-category condition. It remains responsible for its aviation/accounting records, its authorised recipients and independently made exports.
Instructions and security
Section titled “Instructions and security”We process Customer Personal Data only on documented lawful instructions, including these Terms, the customer’s authorised use/settings and instructions to support. This includes instructions about international transfers. If UK law requires other processing, we inform the customer of that legal requirement before processing unless the law prohibits notification on important public-interest grounds. We immediately inform the customer if, in our opinion, an instruction infringes applicable data protection law, and may suspend the affected processing while the issue is resolved.
The customer authorises its administrators to give instructions within their authority and keeps that authority current. We authenticate requests and may seek clarification or evidence of authority where reasonably necessary. We do not resolve the group’s governance disputes merely because someone holds an app role.
People authorised by us to process the data are bound by confidentiality or an appropriate statutory duty. We apply technical and organisational measures appropriate to the risks under Article 32, including access controls and tenant separation, private file access, encryption in transit and at rest on managed infrastructure, and measures for system resilience, recovery and review of security effectiveness. Device caches and customer-controlled exports require the customer’s own appropriate protection; this does not remove our responsibility for service security.
Suppliers and transfers
Section titled “Suppliers and transfers”The customer gives general written authorisation to appoint subprocessors for instructed processing. The current suppliers and purposes are:
| Supplier | Instructed service |
|---|---|
| Supabase | Database, authentication infrastructure, file storage and server-side functions supporting customer records; primary storage in Ireland. |
| PowerSync / JourneyApps | Authorised record synchronisation and sync storage in the EU. |
| Resend | Delivery of customer-directed emails, including invitations and record notifications. |
| Cloudflare | Hosting and delivery of the web service and associated request handling; reading meter photos with AI vision models (currently Google and OpenAI) run through Cloudflare’s AI Gateway on Cloudflare’s own accounts with those providers. |
Where Google Firebase Cloud Messaging or Apple APNs processes notification information on our behalf, the same subprocessor requirements apply. Those services may also have independently determined purposes. Stripe’s payment and verification services involve its own controller processing as well as instructed activities; its own legal duties and the customer’s payment relationship are not converted into subprocessing by this schedule. Firebase Crashlytics supports our own fault-diagnostic purpose, not a general use of customer records for analytics.
We supply further information about relevant entities, locations and terms on request. Before adding or replacing a subprocessor, we inform the customer of the intended change with sufficient time to raise a reasonable data-protection objection before the change takes effect. We consider the objection and seek a workable alternative; if none is available, the customer may end the affected service before the change with a refund of unused prepaid fees for that service. We do not treat silence as authorisation where the applicable law requires specific approval.
We bind each subprocessor by a written contract imposing the applicable data protection obligations of this schedule, including sufficient guarantees for appropriate technical and organisational measures, and remain fully liable to the customer for that subprocessor’s performance of those obligations. Processing outside the UK must comply with applicable transfer requirements, using adequacy or appropriate safeguards and assessments where required. EU primary storage does not exclude overseas support access or downstream processing. Safeguard information and relevant terms are available through support.
Assistance and accountability
Section titled “Assistance and accountability”Taking account of the processing and information available to us, we assist the customer with rights requests, security, personal-data breach obligations, impact assessments and prior consultation under Articles 32–36. Appropriate technical and organisational measures support this assistance. We notify the customer without undue delay after becoming aware of a breach affecting Customer Personal Data and provide available information and subsequent updates needed for its assessment and notifications. We do not independently answer a customer-record rights request except on instructions or where the law requires; we direct it to the customer and assist as appropriate.
We make available information necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the customer or its authorised auditor. We can initially provide relevant reports and documentation and agree proportionate confidentiality, security and scheduling arrangements. Those arrangements do not exclude a necessary inspection or delay assistance beyond legal deadlines.
Return, deletion and retained records
Section titled “Return, deletion and retained records”At the end of the affected service, at the customer’s choice, we return or delete Customer Personal Data and delete existing copies unless UK law requires retention. Existing exports and support can be used to arrange this; a personal account export is not represented as a complete syndicate export. The customer must arrange its required records before ordinary access/retention periods end and contact support where the available exports do not cover its needs.
Residual backups remain protected, are not used for ordinary service purposes and are removed through their bounded backup cycles; any restoration remains subject to applicable deletion instructions. We provide relevant retention information on request. Lawfully required preservation is limited to relevant data, with access restriction and review, and does not justify indefinite retention of unrelated information.
Records we separately and necessarily hold as controller, such as our own invoices or relevant claim evidence, are governed by the Privacy Policy and applicable law. We do not automatically treat all customer records or documents as our own accounting records. These processing terms prevail over any inconsistent general Terms provision for instructed processing, without removing mandatory rights or responsibilities.