GDPR Compliance

1. Our role

For the account, billing and support data you provide to us, SineBoot acts as a data controller. For the data your own end users submit to services you run on our infrastructure, you are the controller and SineBoot is a data processor — those relationships are governed by our Data Processing Addendum.

2. Lawful bases for processing

• Contract — to create your account, provision services and take payment.
• Legitimate interests — to secure our platform, prevent fraud and abuse, and improve our services, balanced against your rights.
• Legal obligation — to meet tax, accounting and law-enforcement requirements.
• Consent — for optional communications, which you may withdraw at any time.

3. Your rights under the GDPR

Subject to the conditions in the GDPR, you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data (the “right to be forgotten”).
• Restriction — limit how we process your data in certain cases.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where processing relies on consent.

4. How to exercise your rights

You can access, export or delete much of your data directly from your client area, or email us to make a request. We respond within one month, as required by the GDPR, and will verify your identity before acting. Exercising your rights is free unless a request is manifestly unfounded or excessive.

5. International data transfers

SineBoot operates from India, so your data may be transferred and stored outside the EEA/UK. Where we transfer personal data internationally, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses (and the UK Addendum), together with supplementary technical measures such as encryption in transit and at rest.

6. Data retention

We keep personal data only for as long as necessary for the purposes described in our Privacy Policy — for the life of your account and thereafter as required to meet legal, tax and accounting obligations, after which it is deleted or anonymised.

7. Sub-processors

We use vetted third-party sub-processors (for example, payment gateways, email delivery and infrastructure providers) under contracts that require GDPR-equivalent protection. A current list is available on request and is maintained under our DPA.

8. Complaints

If you believe we have not handled your data lawfully, please contact us first so we can put it right. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office).

9. Contacting us about data protection

For any privacy or GDPR request, contact us using the details below and mark your message “Data Protection”. We will route it to the person responsible for privacy at SineBoot.