Privacy & GDPR

Data controller

Sytue Projects, S.L. (Spanish tax ID B88729900; Calle Atenas, 10, 28822 Coslada, Madrid, Spain; registered with the Madrid Companies Register, section 8, sheet M-887153), as the provider of the Sytue One suite, is the controller for the data of the service’s accounts and organisations. Data protection contact: privacidad@sytue.eu.

What data we process

• Account data: name, email address and organisation, managed by Sytue ID (SSO + MFA).
• Your organisation’s content: mail, files, documents, calendar and messages that your organisation hosts in the suite. That content belongs to your organisation.
• Technical operating data: access logs and connection data needed for security, abuse prevention and running the service.

We do not sell data and we do not use it for advertising. All data is hosted exclusively in the European Union (Scaleway, fr-par and nl-ams regions, and an on-premise zone in Madrid), encrypted in transit (TLS 1.3) and at rest, with no transfers outside the EU.

Legal basis

Processing relies on the legal bases in Article 6 GDPR: performance of the service contract with your organisation, our legitimate interest in security and abuse prevention, compliance with legal obligations and, where expressly requested, your consent. The detail basis by basis, processing by processing, will be part of the final text.

Retention

We keep account data and content for as long as your organisation keeps the service active. When an account or organisation is closed, the data is deleted or anonymised within a reasonable period, except for what we must keep by law (invoicing, for example). Technical operating logs are purged periodically. The specific periods per category are set out in the final version.

Processors and sub-processors

Our infrastructure provider is Scaleway (fr-par and nl-ams regions), acting as a processor and operating exclusively within the European Union; we also operate an on-premise zone in Madrid (Spain) on our own premises. For subscription payments we rely on Mollie B.V. (Netherlands), which processes only the data needed for the payment. To send the text message with the code that verifies the mobile number when an account is created, we rely on Sweego (Mindbaz SAS, France), which receives only that number and the code. We use no sub-processors outside the EEA. The list of sub-processors will be published and kept up to date, with advance notice of any addition.

Security

We apply technical and organisational measures in line with the GDPR: encryption in transit (TLS 1.3) and at rest, isolation between organisations (multi-tenant with row-level security), strong authentication (MFA/WebAuthn), access logging and least privilege. No system is infallible: should a breach affect you, we will notify you within the periods set by the Regulation.

Cookies

We use only technical cookies required for single sign-on and session security. We use no advertising or third-party tracking cookies, so there is no consent wall for tracking.

International transfers

All processing and hosting happen in European Union regions. There is one exception, and we prefer to write it down: notifications sent while the app or browser is closed. The device’s push service (Google, Mozilla or Apple, depending on your browser or phone) sees an anonymous identifier for your device and the time of each notification — never the content, which travels encrypted end to end, and on iOS is sent empty. You can turn notifications off, and then not even that leaves.

Your rights

The GDPR grants you the rights of access, rectification, erasure, objection, restriction of processing and portability. You can exercise them by writing to privacidad@sytue.eu; we reply within the periods set by the Regulation. You also have the right to lodge a complaint with your supervisory authority.

Data protection officer (DPO)

For any data protection query, or to reach our data protection officer: privacidad@sytue.eu.

Minors

Sytue One is a service for organisations and their professional users; it is not aimed at minors and we do not knowingly collect data from minors.

Changes to this policy

If we update this policy we will change the “last updated” date and, where the changes are material, we will tell you through the service channels before they take effect.