Skip to content
ESEN
← Back to home
Legal

Privacy policy

Last updated:

At The Synergy Labs we take the protection of your data seriously. This policy explains what personal data we process, for what purpose, how long we keep it, who we share it with and what rights you have over it, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). It covers two different situations:

  • The contact form on this site (sections 1 to 9). Here we are the controller of your data.
  • The data we process through our Meta app for the WhatsApp Business Platform (section 10). Here we process the data on behalf of the client businesses that connect their WhatsApp to our app, as a data processor.

1. Data controller

2. What data we process

We only process the data you provide when filling in and submitting the form:

  • Contact details: name, company, email and, optionally, phone.
  • Data about your enquiry: service of interest, platform, the size of your company, sector, the description of the problem or project you tell us about, and how you heard about us.
  • Technical request data: campaign parameters (UTM), referring page, browser identifier (user-agent) and the date and time of submission.
  • Confirmations: acceptance of the terms and of this privacy policy.

We do not collect special categories of data. Please do not include sensitive information in the free-text description field.

3. For what purpose

  • To attend to and respond to your request for information or a quote.
  • To assess whether your case fits our services and, where appropriate, contact you to book a call.
  • To manage the pre-contractual relationship arising from your request.

We do not use your data to send you commercial communications unrelated to your enquiry, nor to build profiles.

4. Legal basis

  • Your consent (art. 6.1.a GDPR), given when you tick the box and submit the form.
  • The application of pre-contractual measures requested by you (art. 6.1.b GDPR).

5. For how long

We keep your data for as long as necessary to handle your request and, if a relationship arises from it, for as long as it lasts. If no relationship begins, we delete it within a maximum of 12 months, unless there is a legal obligation to keep it longer or you exercise your right to erasure beforehand.

6. Who we share your data with

We do not sell or transfer your data to third parties, except where legally required. To provide the service we rely on providers that act as data processors and only process the data following our instructions:

  • Vercel Inc. — Site hosting and receipt of the contact form. (USA, under EU Standard Contractual Clauses)
  • Own server (self-hosted) — Database where your request is stored and internal automation (n8n) that notifies the team. (Germany (European Union))
  • Telegram — Internal notification to the team when a new request arrives. (International transfer with appropriate safeguards)

When any of these providers processes data outside the European Economic Area, we require appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission.

7. Your rights

You can exercise the following rights at any time:

  • Access: know what data of yours we process.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: ask us to delete your data.
  • Objection and restriction: object to or restrict the processing.
  • Portability: receive your data in a structured format.
  • Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise them, write to us at contact@thesynergylabs.es, stating the right you wish to exercise. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

We apply technical and organisational measures to protect your data: an encrypted connection (HTTPS/TLS) across the whole site, restricted access to the information, and a database with row-level access control that prevents unauthorised reading or writing.

9. Cookies

This site does not use analytics, advertising or tracking cookies. We only process the data you actively send through the form.

10. Data processed through our Meta app (WhatsApp Business Platform)

We provide businesses with a customer service, messaging and automation service on WhatsApp. To do so, each business connects its WhatsApp Business account to our Meta app (the application we have registered with Meta to connect WhatsApp Business accounts) and, from that moment on, we process the data in that account's conversations. This section explains how.

10.1. Who the controller is

In this service we act as a data processor. The controller is each client business that connects its WhatsApp: it decides what its contacts' data is used for and is responsible for informing them. We process that data only following its instructions and what has been agreed with it. If you have written on WhatsApp to one of those businesses, please also check its privacy policy.

10.2. What data we process

  • Contact identification: phone number or WhatsApp user ID and profile name.
  • Conversation content: messages and files sent and received.
  • Metadata: message dates and their delivery statuses.
  • Business account data: its WhatsApp Business account identifiers and the integration's access credentials.

10.3. For what purpose

Only to provide the customer service, messaging and automation service each business hires: receiving and replying to its contacts' messages, running the automations it has requested and, when it hires one, operating its AI agent.

We do not use this data for our own purposes, we do not sell or transfer it, and it is not used to train artificial intelligence models.

10.4. Legal basis

The legal basis is the one applicable to each controller business according to its relationship with its contacts (for example, the performance of a contract, its legitimate interest or the contact's consent). We process the data on its behalf.

10.5. For how long

We keep the data for as long as the service with each business lasts. When it ends, we delete it as agreed with that business, unless a legal obligation requires any of it to be kept longer.

10.6. Who is involved in the processing

  • Meta Platforms (WhatsApp Business Platform). WhatsApp platform through which the business’s messages are sent and received. (Meta infrastructure, subject to its WhatsApp Business terms)
  • Own servers (self-hosted). Customer service inbox and automations we use to provide the service. (European Union)
  • AI model providers. Processing of messages, only when the business hires an AI agent. (As agreed with each business)

When any of them processes data outside the European Economic Area, appropriate safeguards apply under the GDPR, such as the Standard Contractual Clauses approved by the European Commission.

10.7. Your rights and the deletion of your data

If you have written to a business that uses our service, you can exercise your rights with that business. You can also write to us at contact@thesynergylabs.es: we will pass your request on to the controller business and coordinate it with that business. We explain how to request deletion, and how a business disconnects our app, on the Data deletion page.

11. Changes to this policy

We may update this policy to adapt it to legal changes or changes in our services. Any modification will be published on this same page, with its update date.