General Data Protection Regulation (GDPR) Compliance

Synervibe OÜ is committed to protecting personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”). This page summarises how we support your compliance as our customers.

1. Processing roles

For data contained in the invoices and business documents you process through the platform, you act as the controller and Synervibe acts as the processor, acting solely on your instructions.

2. Data Processing Agreement (DPA)

We provide a Data Processing Agreement that sets out our obligations as a processor. Please contact us to obtain a copy.

3. Data location and infrastructure

Data is hosted entirely within the European Union, in Hetzner data centres (Germany and Finland). ISO 27001 certification applies to Hetzner’s hosting infrastructure.

4. Sub-processors

We use a limited number of sub-processors, such as hosting and email providers, that are bound by corresponding data protection obligations. An up-to-date list is available on request.

5. International transfers

We do not transfer personal data outside the European Economic Area as part of the core Service. If a transfer becomes necessary, appropriate safeguards, such as Standard Contractual Clauses, will apply.

6. Data subject rights

We support requests for access, rectification, erasure, restriction, portability, and objection. As a processor, we will help you respond to requests from your own data subjects.

7. Security

We implement technical and organisational measures to protect data, including encryption in transit and at rest, access controls, and activity logging.

8. Breach notification

If a data breach affects you, we will notify you without undue delay, in accordance with GDPR requirements.

9. Contact

For any data protection matter or to request a DPA, please contact us using the form on the home page.