Synikon Privacy Policy

The Data Controller for the personal data collected and processed under this Policy is the company providing the Service with the following details:

SYNIKON

VAT number: 042746426

Tax Office: KE.FO.DE. ATTIKIS

Registered address: Zefyrou 23, Neo Irakleio 141 22

Contact email: support@synikon.gr

Phone: +30 210 220 3984

"Personal data": any information relating to an identified or identifiable natural person.

"Processing": any operation or set of operations performed on personal data, with or without the use of automated means.

"User": any natural person who uses the Service (e.g. building manager, owner, tenant or authorised person).

"Customer": the person (natural or legal) who enters into a subscription for the Service.

The Service allows Customers to enter data relating to residential buildings, properties and persons connected with them (e.g. owners, tenants, co-owners, representatives).

To the extent that the Customer determines the purposes and means of processing the data they enter into the Service, the Customer acts as Data Controller and Synikon acts as Data Processor, processing the data solely for the purpose of providing the Service and in accordance with the Customer's instructions.

The Customer/User declares that they hold a lawful basis for entering and processing third-party data in the Service and that they provide all required information to the data subjects.

Synikon may collect and process the following categories of data:

• Account information: full name, email address, login credentials. Passwords are stored in hashed form.

• Building/property data: building address, apartment/unit details, ownership shares, expense categories, common charge information, payment account details (e.g. IBAN) and contact details (e.g. IRIS phone number) where entered by the User.

• Building user data entered by the Customer: full name, email and phone number of owners/tenants/co-owners.

• Payment and transaction data: amounts, dates, descriptions, payment status and payment method. Synikon does not store payment card details.

• Documents and files: expense invoices and documents submitted for storage and/or automated processing (AI).

• Technical and security data: IP address, browser type and version, session identifiers, logs, device data and strictly necessary cookies.

• Communication and support data: content of messages sent to support@synikon.gr.

Synikon does not request or require the entry of special categories of personal data.

Synikon processes personal data for the following purposes:

• Providing, operating and supporting the Service, including account creation and management.

• Managing subscriptions, billing and related administrative functions.

• Sending notifications and updates necessary for the operation of the Service (common charge notices, receipts, technical notifications).

• Technical support, troubleshooting and communication regarding User requests.

• Information system security, fraud prevention and security incident management.

• Improving, maintaining and developing the Service.

• Traffic measurement, statistical analysis and (where applicable) advertising, exclusively in accordance with the User's cookie consent choices.

• Compliance with legal obligations and cooperation with competent authorities.

Synikon processes personal data where one or more of the following legal bases apply:

• Performance of a contract: in particular for the provision of the Service and management of accounts and subscriptions.

• Consent: where required, in particular for measurement/advertising cookies and informational communications. Consent may be withdrawn at any time.

• Legitimate interests: in particular for security, fraud prevention and improvement of functionality.

• Legal obligation: where processing is required by applicable law.

The Service may provide automated document processing features, such as extracting fields from invoices or other documents uploaded by the User.

For these features, Synikon may use Google's artificial intelligence services (Gemini AI). Documents are transmitted with encryption in transit to the AI service solely for the processing purpose requested by the User.

The User acknowledges that automated extraction may not be entirely accurate and must verify the accuracy of results before using them as the basis for any financial or other decision.

Synikon does not use documents submitted through the Service for model training, to the extent provided by the contractual commitments of the relevant AI provider.

Synikon does not sell personal data.

Synikon may disclose or make available personal data to third-party recipients only to the extent necessary for the purposes described in this Policy, such as:

Hosting and cloud infrastructure providers, including Google Cloud/Firebase services, for the technical operation, hosting and storage of the Service.

Email and/or notification service providers, for sending operational updates and notifications requested or triggered by the User.

Measurement, statistical analysis and advertising performance tool providers (where applicable), such as services that may operate via Google Analytics, Meta Pixel, TikTok Pixel, Google Tag Manager/Google tag, exclusively in accordance with the User's consent choices and for the purposes described in the "Cookies" section.

Artificial intelligence providers (where applicable), solely for the automated document processing feature activated by the User.

Payment providers (where applicable), for (a) processing subscription payments to Synikon and/or (b) supporting common charge/debt payments to a building account via a third-party payment platform.

Specifically, the Service may use a secure payment platform such as VIVA, under which, following action/registration by the manager in the Service, an account may be created on the payment platform for the purpose of collecting amounts from tenants/owners into the building account. In this context, details necessary for account creation/management and transaction execution may be transmitted to the payment provider (such as the manager's identification/contact details, transaction identifiers, amounts and related payment information).

In addition, where the option to generate a unique reference code (RF) is provided for payment directly to a bank account designated by the manager (without involvement of a Synikon payment platform), Synikon solely provides the ability to generate/issue the RF and record the related debt in the Service. Synikon does not receive, verify or confirm the execution of the payment, nor does it have access to bank account transaction data. Payment status updates are made by the manager through manual entry of receipts/payments in the Service and/or based on information they hold.

Synikon does not store payment card details, to the extent that processing is carried out by third-party payment providers.

Competent public, judicial or administrative authorities, where disclosure is required by law or in the context of exercising or supporting legal claims.

Where required, contractual commitments for data protection and processing security are entered into with third-party providers.

Synikon aims, where feasible, to host and process data within the EEA.

Where data is transferred outside the EEA due to the operation of infrastructure or providers, Synikon applies appropriate safeguards in accordance with GDPR, such as Standard Contractual Clauses or another lawful transfer mechanism.

Synikon implements appropriate technical and organisational security measures to protect personal data.

Measures include, among others: encryption in transit and/or at rest, role-based access control, activity logging for security purposes, backup procedures and security incident management procedures.

Synikon retains data for as long as necessary for the processing purposes described in this Policy.

• Account data is retained for as long as the account is active.

• Upon cancellation or deletion of an account, data is deleted or anonymised within thirty (30) days, unless retention is required for compliance with legal obligations.

• Backup copies are retained and cycled within ninety (90) days.

Under GDPR and subject to the applicable conditions, data subjects have the right to:

• Access their data and receive a copy.

• Rectification of inaccurate or incomplete data.

• Erasure of data, where the legal conditions are met.

• Restriction of processing, where the legal conditions are met.

• Data portability, where applicable.

• Object to processing, in particular where based on legitimate interests or for direct marketing purposes.

• Withdraw consent, where processing is based on consent.

Synikon responds to requests within one (1) month of receipt. To exercise your rights, contact us at support@synikon.gr.

Note: where Synikon acts as Data Processor on behalf of a Customer, the request may be forwarded to the relevant Customer (Data Controller).

Synikon uses cookies and similar technologies for (a) the strictly necessary operation, security and proper provision of the Service, and (b) traffic measurement/statistics and the display/measurement of advertising activities.

Technologies such as Google Tag Manager/Google tag, Google Analytics, Meta Pixel and TikTok Pixel may be used. These may collect cookie identifiers, device/browser identifiers, IP addresses and information about use of the Service.

Non-essential cookies are only used after the User provides consent via the cookie consent mechanism. The User may withdraw consent or modify their preferences at any time through the cookie settings.

If the User does not consent to measurement or advertising cookies, the Service will continue to operate using only strictly necessary cookies.

The Service is not directed at persons under the age of 18. Synikon does not knowingly collect data from minors. If we become aware that data of a minor has been collected without a lawful basis, we will take appropriate steps to delete or restrict it.

In the event of a personal data breach, Synikon will assess the incident and act in accordance with GDPR obligations, including, where required, notification to the competent supervisory authority and/or communication to the affected data subjects.

Synikon may update this Privacy Policy. The updated version will be published on the Website/within the Service with an updated "Last updated" date.

In the event of material changes, Synikon will notify Users by email and/or within the Service at least fourteen (14) days before they take effect, where practically feasible.

If you believe that the processing of your data violates applicable law, you have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

For questions about this Policy or to exercise your rights, please contact us at support@synikon.gr.