Privacy Policy

1. Roles Under Data Protection Law

1.1 For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018: (a) Merchants act as data controllers in respect of personal data processed through the App; (b) SyncVue Ltd acts as a data processor, processing personal data solely on the documented instructions of the Merchant; and (c) Clover / Fiserv may act as a separate data controller in certain circumstances, in accordance with its own privacy notice.

1.2 SyncVue does not determine the purposes or means of processing personal data and does not process personal data for its own independent commercial purposes.

2. Categories of Personal Data Processed

2.1 Subject to Merchant configuration, SyncVue may process the following categories of personal data on a long-term basis: (a) Transaction and payment-related data, including transaction reference identifiers, date and time of transactions, transaction amounts, merchant location, and limited payment metadata. SyncVue does not store full payment card numbers, CVV codes, or PIN data. (b) Customer contact and invoice data, including customer names (where provided by the Merchant), email addresses, telephone numbers, invoice references, billing or delivery details, payment status information, and invoice documentation, including PDF files and scanned invoice records.(c) Merchant personnel data, including user account identifiers, role-based access permissions, and activity logs relating to use of the App. (d) Additional data provided by Merchants, including accounting records, settlement data, and reconciliation information made available through system integrations.

3. Purposes of Processing

3.1 SyncVue processes personal data solely for the purpose of providing, operating, and maintaining the App, including to: (a) synchronise transaction, invoice, and payment data; (b) store, retrieve, and manage invoice documentation; (c) facilitate reconciliation and payment-status visibility; (d) maintain system security and integrity; (e) provide technical support and respond to Merchant requests; and (f) comply with applicable legal and regulatory obligations.

3.2 SyncVue does not use analytics or tracking tools, does not market directly to end customers, does not sell personal data, and does not engage in profiling or automated decision-making. 4

4. Legal Basis for Processing

4.1 SyncVue processes personal data on the basis that the Merchant, as data controller, has established a lawful basis for processing under UK GDPR.

4.2 SyncVue processes personal data strictly in accordance with the Merchant’s documented instructions.

5. Disclosure of Personal Data

5.1 Personal data may be disclosed only to: (a) the relevant Merchant; (b) Clover / Fiserv, where required for App functionality; (c) third-party service providers acting on SyncVue’s behalf under appropriate data processing agreements; or (d) regulatory or law enforcement authorities where disclosure is required by applicable law.

5.2 In the event of a merger, acquisition, reorganisation, or sale of assets, personal data may be transferred subject to appropriate safeguards.

6. International Transfers

6.1 Merchants may operate internationally. Where personal data is transferred outside the United Kingdom or the European Economic Area, SyncVue ensures that appropriate safeguards are implemented, including: (a) UK International Data Transfer Agreements; (b) the UK Addendum to EU Standard Contractual Clauses; or (c) other lawful transfer mechanisms permitted under applicable data protection law.

7. Data Retention

7.1 Personal data is retained only for as long as necessary to: (a) provide the App and related services; (b) store transaction and invoice records in accordance with Merchant instructions; (c) comply with legal obligations; and (d) resolve disputes and enforce contractual rights.

7.2 Retention periods are determined by agreement with the Merchant.

8. Data Subject Rights

8.1 Individuals located in the United Kingdom or the European Economic Area have rights under applicable data protection law, including rights of access, rectification, erasure, restriction, objection, and data portability.

8.2 As SyncVue acts as a data processor, data subjects should direct any rights requests to the relevant Merchant. SyncVue will provide reasonable assistance to Merchants in responding to such requests where required by law.

8.3 Data subjects may lodge complaints with the UK Information Commissioner’s Office.

9. Security Measures

9.1 SyncVue implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

10. Amendments

10.1 SyncVue may amend this Policy from time to time. Any amendments shall be effective upon publication of the revised Policy, as indicated by the updated effective date above.

11. Contact Information

11.1 Privacy-related enquiries may be directed to:

SyncVue Ltd 11 Falkland Road London, NW5 2PS

Email: info@syncvue.co.uk

Telephone: +44 (0) 203 355 5615 12

12.California Residents (If Applicable)

12.1 Where personal data relating to California residents is processed and the California Consumer Privacy Act (“CCPA”) applies, SyncVue acts as a service provider and does not sell personal information.

12.2 California residents should direct any CCPA-related requests to the relevant Merchant. SyncVue will assist Merchants as required under applicable law