Privacy Policy
This policy explains how SynQflows, s.r.o., ID No. 23685450, registered office Příčná 1892/4, Nové Město, 110 00 Praha 1 (“we” or the “Operator”), processes personal data in connection with the Negotiq platform (the “Platform”) under Regulation (EU) 2016/679 (“GDPR”) and Czech Act No. 110/2019 Coll., on Personal Data Processing. Capitalised terms have the meaning given in the Terms of Service.
1. Controller and contact
The Operator is the controller. For data protection matters contact inquiry@negotiq.synqflows.com or write to our registered office. We have not appointed a data protection officer as we are not required to.
The Platform serves businesses. Most data concern companies (name, ID number, prices, offers) and are not personal data. Personal data are mainly data about the people who act for companies on the Platform, data of self-employed individuals (e.g. their bank details) and contact details of people at companies we approach.
2. When we are controller and when processor
- As controller we process data about the people who use the Platform on behalf of Organisations, data needed to provide the Platform, for Settlement and proof of Deals, for invoicing and for security, and data about prospective suppliers (section 3).
- As processor for the Organisation, which is the controller, we process personal data in User Content (e.g. a contact person in a specification or attachment), in messages sent to the Intake Address, in credentials for connected systems (ERP) and data fetched from them, and in data we send to the Organisation's Webhooks on its instruction. This is governed by the Data Processing Agreement; please direct requests concerning these data to the Organisation concerned.
3. What data, why, on what basis and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Registration and account, sign-in, roles and permissions | name, work e-mail, Organisation and role, password and recovery code hashes, sign-in sessions (token hash and expiry only), number of failed sign-in attempts | contract (Art. 6(1)(b) GDPR), see the note below the table | for the life of the account; sessions 30 days; after the account is deleted the data are erased or anonymised |
| Record of acceptance of the Terms and other documents | document, version, time of acceptance, hash of the IP address, browser identification | legitimate interest in proving conclusion and content of the Contract (Art. 6(1)(f)) | for the life of the Contract and 4 years after it ends |
| Providing the Platform: Requests, Agent negotiations, Deals, Receipts, notifications, Integrations | identity of the person who created a Request, approved an Offer or set up an Integration; contact details disclosed to the counterparty after a Deal | contract; legitimate interest in demonstrable transactions (Art. 6(1)(f)) | for the life of the account; after deletion the data are erased or anonymised, except the records listed in the “Audit Chain” row |
| Settlement of Deals | Supplier's Payment Details (personal data in the case of self-employed individuals), invoice data (number, amount, due date, variable symbol), who marked invoicing, payment, receipt or a dispute and when, dispute notes, AP2 Records | contract; legitimate interest in demonstrable transactions and fraud prevention (Art. 6(1)(f)) | 10 years from conclusion of the Deal; after an account is deleted, names and contacts of persons are replaced by an internal identifier |
| Audit Chain and security (abuse prevention, incident investigation, proof of Deals) | who did what and when, content of the action, technical records, IP address in operational logs | legitimate interest in security, integrity and demonstrability of actions (Art. 6(1)(f)) | Audit Chain entries, Receipts and AP2 Records 10 years from creation; after an account is deleted in pseudonymised form (an internal identifier instead of name and e-mail), because the Audit Chain cannot be altered; operational logs at most 90 days |
| Invoicing and accounting (paid features) | identification and billing data, contact person | legal obligation (Art. 6(1)(c)) | 10 years (Act No. 235/2004 Coll., on VAT, and Act No. 563/1991 Coll., on Accounting) |
| Payments and reminders (payment matching, card payment, automatic payment) | payment and payer account data, card brand and last 4 digits, e-mails sent | performance of contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) | 10 years for accounting records; saved card until removed |
| Notices of illegal content and complaints under the DSA | name and e-mail of the notifier or complainant, content of the notice, the decision and its statement of reasons | legal obligation under Arts. 16 and 17 of Regulation (EU) 2022/2065 (Art. 6(1)(c)); for complaints, legitimate interest in handling them (Art. 6(1)(f)) | 3 years after resolution |
| Database of prospective suppliers and outreach (B2B) | company data from public registers; generic company contacts from their websites (e.g. info@, reception phone); name and work contact of a person the company itself gives us; call record and outreach result | legitimate interest in offering cooperation to businesses (Art. 6(1)(f)); we approach companies by telephone and send an invitation by e-mail only with their consent (Section 7 of Act No. 480/2004 Coll.) | until objection or 3 years from last contact; on objection we keep only the fact that the company does not want to be contacted |
| Communication with you (support, queries) | name, e-mail, content of communication | contract or legitimate interest | 3 years after resolution |
| Commercial messages to existing customers about similar services | work e-mail | Section 7(3) of Act No. 480/2004 Coll.; legitimate interest; every message includes an unsubscribe option | until unsubscribed |
Note on the legal basis: Where we state “contract”, this means Art. 6(1)(b) GDPR if you are yourself a party to the contract (a self-employed individual). If you act for an Organisation as an employee or other person, the legal basis is our legitimate interest in performing the contract with the Organisation (Art. 6(1)(f)).
Data we process as processor (section 2) are kept according to the Organisation's instructions and the Data Processing Agreement; messages sent to the Intake Address (sender, subject, time of receipt, attachments) are deleted after 90 days, while imported offers remain.
4. Sources
- you, during registration and use of the Platform, or your Organisation Administrator (colleague invitation);
- the Organisation and its Integrations (messages to the Intake Address, connected systems);
- the counterparty to a Deal (the Supplier's Payment Details, invoice data and Settlement statuses);
- public sources: the Business Register of the Czech Statistical Office, ARES, the commercial register and companies' public websites — generic company contacts only;
- the company we approach, if it gives us a contact person.
5. Recipients
- The Deal counterparty — after a Deal is concluded, the Buyer and the Supplier see each other's company name, contact e-mail and phone so they can perform the Deal; the Buyer also sees the Supplier's Payment Details and invoice data, and both parties see Settlement statuses and dispute notes. Before the Deal the counterparty does not see your identity.
- Your Organisation Administrator — sees in the Organisation's audit records who did what and when.
- Processors operating the service for us (bound under Art. 28 GDPR):
The current list is kept in the Data Processing Agreement.Processor Purpose Location / safeguards Railway Corporation application and database hosting, backups USA / EU; EU Standard Contractual Clauses, or the EU-U.S. Data Privacy Framework Anthropic, PBC converting unstructured price lists (PDF, text) into tables — only when you use this feature USA; Standard Contractual Clauses; data not used for model training e-mail intake provider (the specific provider will be added to this list before the feature is launched) receiving messages sent to Intake Addresses and passing them to the Platform to be stated together with the provider; transfers outside the EEA only with safeguards under Chapter V GDPR e-mail service provider (SMTP) delivering invoices, reminders and service messages (recipient address and message content) EU - Payment services as independent controllers, when you use them: Stripe Payments Europe, Ltd. (Ireland) processes card payments and stores the card for automatic payment — you enter the card number directly with Stripe; we never see or store it (we only know the brand, last 4 digits and expiry); Raiffeisenbank a.s. holds our account and provides data on incoming payments (amount, variable symbol, payer name and account number, message) which we match to invoices.
- Systems chosen by your Organisation — on the Organisation's instruction we send data to its Webhooks and sign in to its connected systems (ERP, product feeds). These recipients are not our processors; the Organisation is responsible for their processing.
- Public authorities where required by law.
We do not sell personal data or use them for third-party advertising.
6. Transfers outside the EEA
Some processors are based in the USA. Transfers rely on the Commission's adequacy decision (EU-U.S. Data Privacy Framework) for certified recipients, otherwise on Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 with supplementary measures (encryption in transit and at rest, data minimisation). A copy of the safeguards is available on request.
7. Automated decision-making
Platform agents automatically negotiate prices and terms between businesses under rules the businesses set. These decisions concern companies' commercial terms, not natural persons, and do not produce legal effects concerning you or similarly significantly affect you within Art. 22 GDPR. We do not profile natural persons. See the AI Governance statement.
8. Security
Passwords are stored only as hashes (Argon2id), sign-in sessions and API keys only as hashes, sign-in is protected by secure cookies and request origin checks, communication is encrypted (HTTPS), credentials for connected systems are encrypted (AES-256-GCM), access is restricted by role and Organisation, and important actions are written to an immutable Audit Chain. See the Security & Trust document for details.
9. Your rights
You have the right of access, rectification, erasure, restriction and portability and the right to object to processing based on legitimate interest — including objecting to being approached as a prospective supplier and to commercial messages, which we always honour. The Organisation Administrator can export the Organisation's data (JSON) and delete a User account or the entire Organisation directly in the app. Send other requests to inquiry@negotiq.synqflows.com; we respond without undue delay and within one month at the latest. We need not honour erasure to the extent we need the data to comply with a legal obligation or for the establishment, exercise or defence of legal claims (Art. 17(3) GDPR); this is why Audit Chain entries, Receipts and AP2 Records are only pseudonymised after an account is deleted. You may also lodge a complaint with the Czech Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz) or with the supervisory authority of the EU Member State of your habitual residence or place of work.
10. Is providing data mandatory?
The data needed to create an account are a contractual requirement, and billing data are also a statutory requirement; without them the Platform cannot be used. Providing any other data is voluntary.
11. Cookies
We use only strictly necessary cookies and browser local storage. See the Cookie Policy.
12. Changes
We may update this policy and will inform you of material changes on the Platform or by e-mail. The current version is always on this page.