Legal & privacy

1. About this Privacy Notice

1.1 This notice (Privacy Notice) explains how we collect, use, store, share and protect personal data when you:

• visit our website at syncsoftware.uk (Website);
• use the Sync Software web application;
• use the Sync Software mobile applications for iOS or Android;
• access a customer portal, subcontractor portal or any other portal we make available;
• use an application programming interface (API) or an integration connected to Sync Software; or
• otherwise interact with us, including as a customer, prospective customer, supplier or other business contact.

1.2 Sync Software is a cloud-based software-as-a-service platform that supports business operations, project management, workflow management, site management, health and safety record keeping and project collaboration. In this Privacy Notice, our Website, web application, mobile applications, portals, APIs, integrations and associated services are together called the Services.

1.3 When providing the Services we may process personal and business information provided directly by users, provided by the organisation through which a user accesses Sync Software, generated through use of the Services, or collected automatically from the device used to access the Services.

1.4 The Services are provided for business use. They are intended for authorised business users and are not directed at children. Customers must not create accounts for children unless we have expressly agreed to it and the use is lawful and appropriate.

1.5 We may update this Privacy Notice from time to time. The effective date and version number at the top of this notice show when it last changed. We may also let users know about significant changes, for example by email or a notice within the Services.

2. Who we are and our role

2.1 We are SYNC SOFTWARE LIMITED, a company registered in England and Wales with company number 14520117. Our registered office is Chancery House, 3 Hatchlands Road, Redhill, Surrey, RH1 6AA, United Kingdom (Sync, we, us or our).

2.2 Our role under data protection law depends on the circumstances in which personal data is processed.

2.3 When we are a controller. We act as a controller where we decide why and how personal data is used. This includes personal data about visitors to our Website, our customers’ account holders and billing contacts, prospective customers, suppliers and other business contacts, and personal data we use for account administration, billing, sales, marketing, customer support, security and the operation of our business.

2.4 When we are a processor. Organisations that subscribe to Sync (Customers) use the Services to collect, record, store and manage personal data about their employees, workers, subcontractors, customers, site visitors and other individuals. For that information (Customer Data), the Customer will generally act as the controller and Sync acts as its processor. We process Customer Data only on the Customer’s documented instructions, under our agreement with that Customer (including our Data Processing Addendum) and applicable data protection law.

2.5 If you use Sync because your employer, a main contractor or another organisation has given you access, that organisation is usually responsible for how your information is used within its account. Questions or requests about that information are best directed to that organisation. If you contact us, we may need to refer your request to them.

3. How to contact us

3.1 If you have any questions about this Privacy Notice or how we use personal data, please contact us:

• Email: [email protected] (please include “Privacy” in the subject line)
• Phone: 020 4553 5333
• Post: Sync Software Limited, Bank Chambers, 2 Church Street, Reigate, Surrey, RH2 0AN
• Online: our contact page

4. Whose personal data we process

4.1 Depending on how Customers use the Services, personal data may relate to:

• customers and prospective customers, and their staff;
• Customer employees and workers;
• subcontractors and subcontractor personnel;
• engineers and field personnel;
• suppliers, consultants and professional advisers;
• site visitors;
• end customers of our Customers, such as clients who use a customer portal;
• contacts at other organisations; and
• other individuals whose information is entered into the Services by a Customer or its users.

5. The personal data we collect

5.1 Personal data means any information that identifies, or could be used to identify, a living person. The types of personal data we may process include:

• Identity Data: first name, surname, title and other identifying information associated with an account.
• Contact Data: work email address, telephone number and business contact details.
• Account Data: username, organisation, role, permissions, account status and account settings. Passwords are stored only as one-way hashes, so we cannot see or recover them.
• Technical Data: IP address, device type, device identifiers, browser type and version, operating system and platform, application version, time zone, language settings and similar technical information about the device used to access the Services.
• Usage and Audit Data: sign-in and account security events, such as logins, failed logins, password changes and two-factor authentication events, recorded with IP address and browser or device details; login history, features and screens used, records viewed, created or changed, actions performed and timestamps.
• Location Data: location information from your device where you use a location-enabled feature, such as checking in to a site. See section 7.
• Photographs and Videos: images and video you choose to capture or upload through the Services.
• Documents and Files: drawings, attachments, certificates, credentials and other documents uploaded to the Services.
• Project Data: information in projects, tasks, quotations, invoices, purchase orders, variations, programmes and other project records.
• Workforce and Site Data: site attendance, check-ins, inductions, toolbox talks, work records and associated site information.
• Health and Safety Data: information recorded in audits, inspections, incidents, near misses, accident records and other health and safety or compliance records.
• Financial and Transaction Data: billing details, subscription information and payment information. Card details are handled by our payment provider and are not stored by us.
• Support and Communications Data: correspondence with us, support requests, survey responses and feedback.
• Crash and Diagnostic Data: crash reports, error logs, application performance traces and technical diagnostic information, linked to your user ID and organisation so we can investigate problems.
• Notification Data: device tokens used to deliver push notifications, and information about their delivery.
• Marketing and Communications Data: your preferences for receiving marketing from us, and your interaction with our marketing emails and Website.

5.2 Special category data. Some information entered into the Services by Customers may be special category personal data under data protection law, most commonly information about an individual’s health recorded in an accident or incident report. Where we process that information on a Customer’s behalf, the Customer is responsible for ensuring it has an appropriate lawful basis and condition for processing it. We process it as a processor on the Customer’s documented instructions.

6. Where we get personal data from

6.1 We may obtain personal data:

• directly from you, for example when you contact us, book a demo, register for an account or use the Services;
• from the organisation through which you use Sync Software, for example when your employer creates your account or a main contractor records your site attendance;
• from another Customer or authorised user, where they are permitted to provide the information, for example a main contractor inviting a subcontractor to a project;
• from third-party systems connected to Sync Software at a Customer’s request, such as accounting or business software integrations;
• automatically when you use our Website, web application or mobile applications (see sections 7 and 13); and
• from publicly available business sources, such as Companies House or company websites, where appropriate.

7. Mobile applications and device permissions

7.1 Our mobile applications may request access to certain device functions where this is needed for a feature you choose to use. Depending on the features you use, this may include:

• Camera: to take photographs or video as evidence, for audits, inspections, incidents, project records or other attachments.
• Photographs and videos: to choose existing images or video from your device to upload to the Services.
• Location: to support site-related features such as checking in to a site. Location is used only to provide that functionality.
• Notifications: to send you push notifications about activity relevant to you in the Services.

7.2 Permissions are requested only when needed for the relevant feature. You can grant, refuse or withdraw any permission at any time through your device’s settings. Refusing or withdrawing a permission may stop the related feature from working, but will not stop you using unrelated parts of the Services. Withdrawing a permission does not affect processing that took place lawfully before you withdrew it.

7.3 Data the mobile applications collect. To provide the app’s functionality, our mobile applications collect and link to your account: your name, email address and phone number; your user ID; a device ID; precise location when you use a location-enabled feature; photographs and videos you choose to capture or upload; and crash data, performance data and other diagnostic data. This information is used only to provide and support the app’s functionality. It is not used for advertising or to track you across other companies’ apps or websites.

7.4 Where push notifications are enabled, we process a device or application notification token and related technical information in order to deliver notifications. Push notifications are delivered through the platform notification services provided by Apple (for iOS) and Google (for Android).

7.5 We collect crash reports, performance information and other diagnostic information, linked to your user ID and organisation, to identify faults, investigate technical issues and keep the Services secure and reliable. We use Sentry for this in our web application and mobile applications. We do not use Sentry’s session replay feature, and it is configured not to collect additional personal data by default.

7.6 Our mobile applications store limited information on your device, such as authentication tokens and application settings, so the application can keep you signed in and work as expected.

7.7 We do not use device permissions, device information, photographs, videos or location information for advertising, behavioural advertising or tracking across other companies’ apps or websites, and we do not sell this information.

7.8 Mobile accounts are created and managed by the organisation you work with. You cannot create a new Sync account from within the mobile applications. See section 17 for how to delete your account.

8. How we use personal data and our lawful bases

8.1 Data protection law requires us to have a lawful basis for each use of personal data. The table below sets out the purposes for which we act as a controller and the lawful bases we rely on.

Purpose	Lawful basis
Creating and administering accounts for Authorised Users, authenticating users, managing permissions and providing access to the Services	Legitimate interests (providing the Services purchased by the Customer, maintaining account security and enabling authorised business users to access the Services)
Administering the account of a Customer’s account owner or billing contact, where they are party to our agreement	Contract
Billing, payments, invoicing and managing subscriptions	Contract; legal obligation (accounting and tax records)
Providing customer support and responding to enquiries	Contract; legitimate interests (helping our customers and users)
Protecting the security and integrity of the Services, and detecting, investigating and preventing unauthorised access, fraud, misuse and security incidents	Legitimate interests (keeping the Services and our users safe); legal obligation where relevant
Monitoring performance and diagnosing faults, crashes and technical issues	Legitimate interests (keeping the Services reliable)
Maintaining logs and audit trails	Legitimate interests (security, accountability and supporting our Customers’ own record keeping)
Sending service communications, such as security notices, changes to the Services and changes to our terms	Contract; legitimate interests (keeping users informed)
Improving and developing the Services	Legitimate interests (making Sync better for our customers)
Business-to-business marketing	Legitimate interests; or consent where the law requires it (see section 14)
Website analytics and non-essential cookies	Consent (see our Cookie Policy)
Complying with the law and responding to lawful requests from authorities	Legal obligation
Establishing, exercising or defending legal claims	Legitimate interests; legal obligation

8.2 Customer Data. When we process Customer Data as a processor, we do so on the Customer’s instructions. The Customer, as controller, is responsible for identifying the lawful basis for that processing.

8.3 Legitimate interests. Where we rely on legitimate interests, we have considered whether our use of the information is necessary and balanced it against your rights and freedoms. You can ask us for more information about this balancing and you have the right to object (see section 16).

8.4 Consent. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew it.

8.5 If you do not provide information. Where we need personal data to provide the Services or perform a contract, failing to provide it may mean we cannot provide the Services to you.

8.6 Automated decision-making. We do not carry out solely automated decision-making using personal data that produces legal effects or similarly significant effects on individuals. If this changes we will update this Privacy Notice and provide the information the law requires.

9. Access to Customer Data by Sync personnel

9.1 Authorised Sync personnel may access information held within a Customer’s account where reasonably necessary to:

• provide technical support requested by a Customer or user;
• investigate faults, incidents or unexpected behaviour;
• maintain, operate and secure the Services;
• investigate suspected misuse or security incidents;
• carry out maintenance, data migration or technical administration;
• comply with a Customer’s lawful instructions; or
• comply with applicable legal or regulatory obligations.

9.2 Access is restricted to authorised personnel who have a legitimate business need and who are bound by confidentiality and data protection obligations. We do not access Customer Data for unrelated purposes, and we do not sell Customer Data.

10. Who we share personal data with

10.1 We share personal data, or allow access to it, only where necessary and with the following categories of recipients:

• Our personnel: employees, contractors and authorised workers who need access to provide, operate, secure or support the Services and who are subject to confidentiality obligations.
• Hosting and infrastructure providers: organisations that provide cloud hosting, storage, databases, networking, content delivery and backup services.
• Application monitoring and diagnostic providers: organisations that help us monitor performance and diagnose crashes and errors in the Services.
• Communications providers: organisations that deliver transactional emails, such as account invitations, password resets and notifications.
• Push notification services: Apple and Google, to deliver push notifications to mobile devices.
• Payment providers: organisations that process subscription payments and billing information.
• Website, analytics and marketing providers: organisations that help us run our Website, understand how it is used (with your consent) and manage customer relationships and marketing.
• Integrations chosen by a Customer: third-party software a Customer chooses to connect to Sync, such as accounting or business software. Information is exchanged with that software on the Customer’s instructions.
• Other organisations using Sync, where a Customer shares information with them: for example, when a main contractor shares project information with a subcontractor or client through a portal, on that Customer’s instructions.
• Professional advisers: lawyers, accountants, auditors and insurers, where reasonably necessary.
• Authorities and regulators: where disclosure is required or permitted by law.
• Corporate transactions: a prospective or actual buyer, investor or successor if our business or assets are sold, transferred or reorganised, subject to appropriate confidentiality protections.

10.2 The service providers that process Customer Data on our behalf are listed in our Subprocessor List.

10.3 Where third-party service providers process personal data on our behalf, we require them by contract to process it only for the agreed purposes, keep it confidential and provide protection for it consistent with applicable data protection law.

10.4 If we are asked to provide personal data in response to a court order or legal request (for example from the police), we will consider the request carefully before responding.

10.5 We do not sell personal data.

11. International transfers

11.1 Our primary application infrastructure, and the Customer Data stored in the Services, is hosted in the United Kingdom.

11.2 Some of our service providers, for example those providing email delivery, crash and diagnostic reporting (European Union), payment processing, push notifications and Website analytics, may process limited personal data outside the United Kingdom.

11.3 Where personal data is transferred outside the United Kingdom, we make sure an appropriate legal mechanism is in place, such as UK adequacy regulations, the International Data Transfer Agreement or Addendum approved under UK law, or another transfer mechanism permitted by applicable data protection law.

12. How we keep personal data secure

12.1 We use appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful access, alteration, disclosure, loss or destruction. These include authentication and access controls, encryption where appropriate, infrastructure and network security, monitoring and security logging, backup arrangements and internal security procedures.

12.2 Access to personal data is limited to users, personnel and service providers who need it for an authorised purpose.

12.3 No system can be guaranteed to be completely secure. If a personal data breach occurs and we are the controller, we will notify the Information Commissioner’s Office and affected individuals where the law requires. Where we are the processor, we will notify the relevant Customer without undue delay and support them in responding.

12.4 If you notice any unusual activity on your account or believe you have found a security vulnerability, please tell us at [email protected].

13. Cookies and similar technologies

13.1 Our Website uses cookies and similar technologies. Non-essential cookies are only set with your consent. For details, and to change your choices, see our Cookie Policy.

13.2 Our web application and mobile applications use storage technologies that are strictly necessary to provide the Services you request, for example to keep you signed in and secure your session. They are not used for advertising.

14. Marketing

14.1 We send relevant business marketing about Sync to corporate business contacts where the law permits it and where we have a lawful basis, usually our legitimate interests in promoting our Services to businesses.

14.2 Where the law requires consent, including for certain electronic marketing to sole traders and some partnerships, we will obtain consent before sending it.

14.3 Every marketing email includes a way to unsubscribe. You can also opt out at any time by contacting us. Opting out of marketing does not affect service communications we need to send you about your account or the Services.

15. How long we keep personal data

15.1 We keep personal data only for as long as necessary for the purposes we collected it for, including to meet legal, accounting and reporting requirements. As a guide:

Information	How long we keep it
Customer account and contract records	For the duration of the relationship, then for as long as needed to meet accounting and legal requirements and to deal with any claims
Invoices, payment and tax records	For the period required by tax and company law
Support records and correspondence	For the duration of the relationship, then for as long as reasonably needed
Enquiries from prospective customers	For as long as reasonably needed to follow up the enquiry, unless a relationship begins
Marketing preferences	Until you opt out. We keep a minimal suppression record after that so we do not contact you again
Security and audit logs, such as sign-in and account security events	For as long as needed to keep the Services and accounts secure, investigate incidents, prevent fraud and deal with legal claims
Website analytics data	In line with the retention settings of our analytics tools
Customer Data	As described in 15.3 and 15.4
Backups	Until overwritten through our normal backup cycle

15.2 How we decide. Where we have not given a fixed period, we decide how long to keep information by considering the purpose we hold it for and whether that purpose can be met another way, legal, tax and accounting requirements, the amount, nature and sensitivity of the information, the risk of harm from unauthorised use or disclosure, the need to deal with complaints or legal claims, and, for Customer Data, the Customer’s instructions.

15.3 Customer Data. Where we act as a processor, Customer Data is kept in line with the Customer’s instructions and our agreement with that Customer. Customers can export their Customer Data while their subscription is active, and for 30 days after a paid subscription ends they may ask us to provide an export. After a subscription ends, access to the account ends and we delete Customer Data from our live systems, normally within 90 days, unless the law requires us to keep it or we have agreed otherwise with the Customer. Copies may remain in secure backups until they are overwritten through our normal backup cycle.

15.4 When a user account is deleted. Personal data associated solely with that user account is deleted or anonymised, except where retention is required by law, is necessary for security or fraud prevention, is needed to establish or defend legal claims, or where the information forms part of business, project, audit, health and safety or other records controlled by the user’s organisation. For example, deleting an engineer’s account does not delete an accident record that belongs to their employer or a main contractor.

16. Your rights

16.1 You have the following rights over your personal data:

• Access: to ask whether we hold your personal data and receive a copy of it.
• Correction: to ask us to correct personal data that is inaccurate or incomplete.
• Deletion: to ask us to delete your personal data where there is no good reason for us to keep it.
• Restriction: to ask us to limit how we use your personal data.
• Objection: to object to our use of your personal data where we rely on legitimate interests, and to object to direct marketing at any time.
• Portability: to ask us to provide personal data you gave us in a structured, machine-readable format, or to send it to another organisation.
• Withdraw consent: where we rely on consent, to withdraw it at any time.

16.2 To exercise any of these rights, email [email protected]. There is normally no charge. We may ask for information reasonably necessary to confirm your identity before we act on a request. We will respond within the time required by data protection law.

16.3 Where we hold your personal data as a processor on behalf of a Customer, we may pass your request to that Customer and act on its instructions.

16.4 Complaints. You have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113. We would welcome the chance to help with your concern first, but you do not have to contact us before complaining to the ICO.

17. Deleting your account

17.1 You can ask us to delete your Sync user account and the personal data associated with it. Full details, including what is deleted and what may be kept by your organisation, are on our account deletion page.

17.2 In summary:

• Sync accounts are created and managed by organisations. You can ask your organisation’s Sync administrator to remove you, or deactivate your account yourself in the Sync web application under Account Settings, in the Deactivate tab.
• Deactivating an account stops you signing in straight away, and you will no longer be able to view or download anything from the account. Download anything you need first. To have the personal data associated with your account deleted, email [email protected] from the email address linked to your account.
• A deletion request results in deletion or anonymisation of personal data associated solely with your account, unless we or the organisation controlling the information must or may keep particular information for legal, regulatory, security, fraud-prevention, contractual or record-keeping reasons.
• Where your account is managed by an employer, contractor or other organisation, we may refer the request to that organisation or process it on its instructions.
• Deleting your account does not necessarily delete project, commercial, audit, site, health and safety or other organisational records you contributed to, where those records belong to or are controlled by that organisation.

1. About this policy

1.1 This policy explains how our website at syncsoftware.uk (Website) uses cookies and similar technologies. It is provided by Sync Software Limited (we, us, our). Our Privacy Notice explains more about how we use personal data.

1.2 This policy covers our public Website. The Sync web application and mobile applications only use storage that is strictly necessary to provide the Services, such as keeping you signed in. This is described in section 13 of our Privacy Notice.

2. What cookies are

2.1 Cookies are small text files placed on your device when you visit a website. They let the website recognise your device, remember your choices and understand how the website is used. Similar technologies, such as local storage and tracking pixels, work in a similar way. In this policy we call them all cookies.

2.2 First-party cookies are set by the website you are visiting. Third-party cookies are set by another organisation whose service the website uses. Session cookies are deleted when you close your browser. Persistent cookies stay on your device for a set period or until you delete them.

3. How we use cookies

3.1 We use strictly necessary cookies where they are required to operate the Website, keep it secure or provide a service you have asked for, such as remembering your cookie choices. These cookies do not need your consent.

3.2 We only use analytics, performance and advertising cookies if you give your consent through our cookie banner. Until you consent, these cookies are not set, and the analytics and marketing tools that use them are not loaded. We use Google Consent Mode, so Google tools respect your choice.

3.3 We use these non-essential cookies to understand how visitors find and use our Website, to measure and improve our pages and content, and to understand interest in Sync from businesses who visit our Website. We do not use them to sell your information.

4. The cookies we use

4.1 Strictly necessary (always active)

Cookie	Provider	Purpose	Duration
cookieyes-consent	CookieYes (first party)	Remembers your cookie choices so we do not ask again on each visit	1 year
__cf_bm	Cloudflare	Protects the Website from malicious bot traffic	30 minutes

4.2 Analytics (only with your consent)

Cookie	Provider	Purpose	Duration
_ga	Google Analytics	Distinguishes visitors so we can produce statistics about how the Website is used	2 years
_ga_*	Google Analytics	Keeps track of the current visit for Website statistics	2 years
_clck	Microsoft Clarity	Remembers a visitor ID and settings for Clarity, which shows us how pages are used so we can improve them	1 year
_clsk	Microsoft Clarity	Connects page views in a single visit for Clarity	1 day
SM	Microsoft Clarity	Links activity across Clarity for the current visit	Session
MR	Microsoft (Bing)	Used by Microsoft to refresh the MUID cookie used by Clarity	7 days
__hstc	HubSpot	Tracks visits, used to understand interest from business visitors	6 months
hubspotutk	HubSpot	Recognises a returning visitor. If you submit our contact form, it links your visits to your enquiry	6 months
__hssc	HubSpot	Tracks the pages viewed in the current visit	30 minutes
__hssrc	HubSpot	Tells HubSpot whether you have restarted your browser	Session

4.3 Performance (only with your consent)

Cookie	Provider	Purpose	Duration
SRM_B	Microsoft (Bing)	A Microsoft identifier used by Clarity to measure how the Website performs	1 year

4.4 Advertising (only with your consent)

Cookie	Provider	Purpose	Duration
MUID	Microsoft (Clarity)	A Microsoft user identifier used across Microsoft services, including Clarity	1 year
ANONCHK	Microsoft (Clarity)	Used by Microsoft to check the status of the MUID cookie	10 minutes

4.5 Durations are those set by each provider and may change. Our cookie banner shows the current list of cookies.

5. Managing your cookie choices

5.1 When you first visit our Website, our cookie banner asks for your choices. You can accept all cookies, reject non-essential cookies, or choose by category.

5.2 You can change or withdraw your choices at any time using the button below, or the Cookie settings link at the bottom of every page.

Change cookie settings

5.3 You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the Website may not work properly. The All About Cookies website explains how to do this in different browsers. Google provides an opt-out tool for Google Analytics.

6. Contact

6.1 If you have questions about our use of cookies, email [email protected] or see our Privacy Notice.

1. About these Terms

1.1 These Customer Terms of Service (Terms) set out the terms on which Sync Software Limited provides Sync Software and the associated Services. The Services may be accessed through our Website, web application, mobile applications, portals, APIs or other interfaces we make available from time to time.

1.2 By registering for, purchasing, accessing or using the Services, or by clicking to accept these Terms, you agree to them. If you do not agree, you must not use the Services.

1.3 Business use only. The Services are provided for business and professional use only. They are not intended to be bought or used for personal, family or household purposes.

1.4 Authority. If you accept these Terms on behalf of a company, partnership or other organisation, you confirm that you have authority to bind that organisation, and “you” and “Customer” mean that organisation.

1.5 Please read these Terms carefully. In particular, clauses 11 (health and safety and financial tools), 17 (limitation of liability) and 18 (indemnity) limit our responsibilities to you.

1.6 Documents that form the Agreement. The agreement between us (Agreement) is made up of:

• any signed Order Form or Enterprise agreement between us;
• our Data Processing Addendum, which applies where we process personal data on your behalf;
• these Terms;
• our Mobile App Licence, which applies to use of our mobile applications; and
• our Acceptable Use Policy.

1.7 Order of precedence. If there is a conflict between these documents, they apply in the order listed in clause 1.6, except that the Data Processing Addendum prevails on matters of data protection.

1.8 Enterprise and negotiated terms. Where we and a Customer sign a separate agreement or Order Form, it may vary these Terms. To the extent of any inconsistency, the separately agreed terms prevail.

2. Definitions

2.1 In these Terms:

• Authorised User means an individual authorised by a Customer to access or use the Services, including the Customer’s employees, workers and contractors, and portal users the Customer invites.
• Customer means the business or organisation that purchases, registers for or is otherwise given access to the Services.
• Customer Data means information, documents, photographs, videos, records and other content submitted to, stored within, transmitted through or generated using the Services by or on behalf of a Customer or its Authorised Users.
• Order Form means an order, proposal, quotation or online checkout that sets out the Subscription Plan, fees and any specific terms agreed for a Customer.
• Services or Sync Software means the Sync Software platform and related services provided by us, including our web application, iOS and Android mobile applications, customer portals, subcontractor portals, APIs, integrations and associated features, documentation and support.
• Subscription Plan means the subscription package, licence, free plan, trial or other commercial arrangement under which a Customer accesses the Services.
• Website means syncsoftware.uk.
• we, us and our means Sync Software Limited, and you and your means the Customer.

2.2 Headings do not affect interpretation. “Including” and similar words do not limit the words before them. “Writing” includes email.

3. Who we are

3.1 We are SYNC SOFTWARE LIMITED, registered in England and Wales with company number 14520117. Our registered office is Chancery House, 3 Hatchlands Road, Redhill, Surrey, RH1 6AA, and our trading address is Bank Chambers, 2 Church Street, Reigate, Surrey, RH2 0AN. Our VAT number is 431809894.

3.2 You can contact us by email at [email protected], by phone on 020 4553 5333, or through our contact page. For help with the Services, email [email protected].

4. The Services

4.1 Sync Software is a cloud-based software-as-a-service platform for business operations, project management, workflow management, site management, health and safety record keeping and collaboration.

4.2 Licence to use the Services. Subject to these Terms and payment of the applicable fees, we grant the Customer a non-exclusive, non-transferable, revocable right, for the term of its Subscription Plan, to allow its Authorised Users to access and use the Services for the Customer’s internal business purposes, within the limits of its Subscription Plan.

4.3 Placing an order. A contract is formed when you complete an online checkout, or when we accept an Order Form in writing. We may decline an order at our discretion. You are responsible for making sure your order is complete and accurate.

4.4 Mobile applications. Our iOS and Android applications are available through the Apple App Store and Google Play. Their use is also governed by our Mobile App Licence.

4.5 Product development. We may update, improve, replace or modify features of the Services from time to time as part of normal product development.

4.6 Beta features. We may make beta, preview, experimental or early-access features available. These may be incomplete, may change or be withdrawn at any time, and are not intended for production use unless we say otherwise. They are provided as they are, without any commitment as to availability or performance.

4.7 Availability. We do not guarantee that the Services will be uninterrupted or error-free. The Services may occasionally be unavailable because of planned maintenance, updates, emergency maintenance, security issues, failures of third-party services or circumstances outside our reasonable control. Where a service level agreement has been expressly agreed in writing with a Customer, it applies instead of this clause.

4.8 Technical requirements. Authorised Users are responsible for maintaining a suitable internet connection and supported, reasonably up-to-date versions of their browser, operating system and our mobile applications. Some features may not work correctly on unsupported or outdated devices, operating systems or application versions.

5. Accounts, users and permissions

5.1 Administrators and users. The Customer is responsible for appointing its administrators, creating and removing Authorised Users and deciding what permissions and access each user has.

5.2 Removing access. The Customer must promptly remove or restrict access for any person who is no longer authorised to use its account, for example when an employee leaves.

5.3 Access granted by the Customer. We are not responsible for access that a Customer’s administrator grants to an Authorised User where that access is given in line with the permissions the Customer has configured.

5.4 Named users. Each account must be assigned to an identifiable individual, unless we have expressly provided a shared-account feature. Users must not share login details, let anyone else use their account, impersonate another user or try to get around access controls.

5.5 Account security. The Customer must keep account details secure, make sure its Authorised Users comply with these Terms, and tell us immediately if it suspects unauthorised access to its account or a compromise of its systems that could affect the Services.

5.6 Connected organisations and portals. Some features let a Customer share information with other organisations or with portal users, for example a main contractor sharing project records with a subcontractor or client. Where a Customer enables that access or shares information through the Services, the Customer is responsible for deciding that the recipient is entitled to receive it and for configuring the relevant permissions. We make the information available in line with the Customer’s instructions.

6. Subscription Plans, fees and payment

6.1 Subscription Plans. Access to the Services is provided under the Subscription Plan selected by the Customer or set out in an Order Form. Subscription Plans may be priced per organisation, per user, by type or number of users, by functionality, by usage or on another basis set out when the plan is bought.

6.2 Payment. Fees for self-service Subscription Plans are paid in advance by card through our online payment provider, Stripe, and the Customer can manage its billing, including upgrades and downgrades, through the billing settings in the Services. Other Subscription Plans may be invoiced directly by us, payable within the period stated on the invoice.

6.3 VAT. All prices are exclusive of VAT unless stated otherwise. The Customer must pay VAT and any other taxes properly chargeable on the fees.

6.4 Renewal. Unless an Order Form says otherwise, paid subscriptions renew automatically for successive billing periods of the same length until cancelled. You can cancel at any time in your account settings, or by contacting us. Cancellation takes effect at the end of the current billing period, and you keep access until then.

6.5 Refunds. Fees are non-refundable. We do not provide refunds for partial billing periods or unused user licences, except where the law requires or we agree otherwise in writing.

6.6 Adding users. Where a Subscription Plan is priced per user, additional users added during a billing period are charged on a pro rata basis for the remainder of that period.

6.7 Free trials. We may offer free or discounted trials from time to time. Trials may be limited by duration, functionality, users, storage or support. A trial converts automatically to a paid Subscription Plan only where this is clearly stated when the trial begins and the Customer has provided a payment method for that purpose. In that case, unless the Customer cancels before the trial ends, the payment method provided will be charged for the Subscription Plan selected. Other trials end unless the Customer chooses to purchase or enter into a paid Subscription Plan. We may limit repeat trials by the same Customer or related organisations.

6.8 Promotional offers and discounts. Promotional offers, discounts and preferential pricing apply only to the Subscription Plan and for the period expressly stated when they are agreed. Unless stated otherwise, they do not apply to additional Services, additional accounts or tenancies, upgrades or renewals; are available only to eligible Customers established in the United Kingdom; cannot be exchanged for cash; are limited to one per Customer; and cannot be combined with other offers. We may withdraw an offer that has not yet been taken up at any time.

6.9 Price changes. We may change the fees for a Subscription Plan by giving notice. Unless we say otherwise, a price change applies from the Customer’s next billing period. If you do not accept a price change, you may cancel your subscription.

6.10 Late payment. If a payment is not received when due, we may charge interest on overdue amounts at the statutory rate applicable to late commercial payments from time to time, together with any compensation or reasonable recovery costs to which we are legally entitled, and we may suspend access in line with clause 19.

7. Customer Data

7.1 Ownership. As between us and the Customer, the Customer retains all rights, title and interest in Customer Data. Nothing in these Terms transfers ownership of Customer Data to us.

7.2 Licence to us. The Customer grants us a non-exclusive licence to host, store, copy, transmit, display, back up and otherwise process Customer Data only to the extent reasonably necessary to provide, operate, maintain, secure and support the Services, to comply with the Customer’s lawful instructions and to fulfil our obligations under the Agreement.

7.3 No sale. We will not sell Customer Data.

7.4 Customer responsibilities. The Customer is responsible for:

• the accuracy, quality and legality of Customer Data;
• having all rights, permissions and lawful bases needed to submit Customer Data to the Services and to share it with others through the Services;
• giving any privacy information required to the individuals whose personal data it enters into the Services;
• making sure its use of the Services complies with applicable law; and
• configuring user access appropriately.

7.5 Access by Sync personnel. The Customer authorises us and our authorised personnel to access Customer Data and the Customer’s account where reasonably necessary to provide support, investigate faults or reported issues, maintain, administer and secure the Services, investigate suspected misuse or security incidents, carry out authorised migration or technical activities, comply with the Customer’s instructions, or comply with applicable law. Access is limited to personnel with a legitimate business need who are subject to confidentiality obligations.

7.6 Export. While a subscription is active, the Customer may export Customer Data using the export functionality and formats made available within the Services from time to time. Additional migration, bespoke extraction or data transformation services may be charged for unless included in the Customer’s Subscription Plan.

7.7 Backups. We maintain backup and recovery arrangements appropriate to the nature of the Services. Backups are for service resilience and disaster recovery. They are not a substitute for the Customer keeping its own copies where it has its own record-keeping obligations, and we do not guarantee that individual items can be restored on request.

7.8 Aggregated information. We may use information about how the Services are used, in an aggregated or de-identified form that does not identify the Customer or any individual, to operate, analyse and improve the Services.

8. Data protection

8.1 Each party will comply with applicable data protection law in connection with the Agreement.

8.2 Where we process personal data on behalf of the Customer as a processor, our Data Processing Addendum forms part of the Agreement and applies automatically. We process that personal data in accordance with the Customer’s documented instructions, applicable data protection law and the Data Processing Addendum.

8.3 Our Privacy Notice explains how we use personal data where we act as a controller.

9. Acceptable use and restrictions

9.1 The Customer must, and must make sure its Authorised Users, comply with our Acceptable Use Policy.

9.2 Except as expressly permitted by these Terms or by law, the Customer must not, and must not allow anyone else to:

• copy, modify, translate, adapt or create derivative works of the Services;
• reverse engineer, decompile or disassemble the Services, or attempt to derive their source code;
• sell, resell, rent, lease, sub-license, distribute or otherwise commercially exploit the Services, or make them available to anyone other than Authorised Users;
• use the Services to build a competing product or service, or copy their features, functions or design;
• remove, obscure or alter any proprietary notices, labels or marks in the Services;
• circumvent or interfere with any security, access control or usage limit of the Services; or
• use the Services in breach of export control or sanctions laws.

9.3 Automated access. The Customer must not use bots, scrapers, automated scripts or excessive API requests in a way that interferes with, degrades or places unreasonable load on the Services, except through APIs or automation features we have expressly authorised, and in line with any documentation and limits we publish.

9.4 Security testing. The Customer must not carry out penetration testing, vulnerability scanning or other security testing of the Services without our prior written authorisation. If you believe you have found a security vulnerability, please report it promptly to [email protected]. You must not exploit it, access information belonging to others or disclose it publicly before we have had a reasonable opportunity to investigate and fix it.

10. Third-party services and integrations

10.1 The Services may integrate with third-party software and services, such as accounting and business systems. Where a Customer enables an integration, it authorises us to exchange information with that third-party service as needed to provide the integration.

10.2 Third-party services are controlled by their providers and may be subject to separate terms, which the Customer is responsible for accepting and complying with. We are not responsible for third-party services, or for outages, changes, errors or discontinuation caused by third-party systems outside our reasonable control.

10.3 Our mobile applications are distributed through third-party app marketplaces, including the Apple App Store and Google Play. Use of those marketplaces is also subject to their terms. Apple, Google and other marketplace providers are not responsible for providing or supporting the Services.

11. Health and safety, compliance and financial tools

11.1 Health and safety and compliance. Health and safety, audit, inspection, induction, credential and compliance features are tools to help Customers manage and record their own processes. The Services do not replace the Customer’s statutory duties, competent professional judgement, site procedures, risk assessments or legal obligations. The Customer remains responsible for deciding what checks, controls, actions and compliance requirements apply to its activities, and for the content and accuracy of the records it creates.

11.2 Financial information. Financial information, forecasts, valuations, reports and calculations produced through the Services are tools to support the Customer’s business processes. The Customer is responsible for reviewing and verifying financial information before relying on it for accounting, tax, contractual or commercial decisions.

11.3 We do not provide health and safety, legal, accounting, tax or financial advice. Guidance, templates and content we make available are general information and should not be relied on as professional advice.

11.4 The Services have not been developed to meet each Customer’s individual requirements. The Customer is responsible for making sure the Services are suitable for its needs.

12. Support

12.1 We provide support in line with the support arrangements that apply to the Customer’s Subscription Plan. Support requests can be sent to [email protected].

12.2 Unless expressly agreed in writing, general support does not include bespoke software development, implementation or onboarding projects, training beyond our standard materials, data cleansing, data migration, administration of third-party systems or consultancy. We may agree to provide these for an additional charge.

13. Intellectual property

13.1 We and our licensors own all intellectual property rights in the Services, including the software, designs, documentation, templates and content we provide, and any improvements to them. Except for the rights expressly granted in these Terms, no rights are granted to the Customer.

13.2 Our ownership of the Services does not give us ownership of Customer Data. Ownership and use of Customer Data are governed by clause 7.

13.3 The Customer must not use our trade marks, trade names or logos without our prior written consent.

13.4 Feedback. If the Customer or its users give us suggestions, feedback or ideas about the Services, we may use them to develop and improve the Services without restriction or payment.

14. Confidentiality

14.1 Each party must keep confidential any confidential information it receives from the other party in connection with the Agreement, and use it only as necessary to perform or receive the Services. Customer Data is the Customer’s confidential information. Non-public information about the Services, our pricing and our security arrangements is our confidential information.

14.2 Confidential information does not include information that is or becomes publicly available other than through a breach of this clause, was already lawfully known to the receiving party, is independently developed by the receiving party, or is lawfully received from someone else without a duty of confidence.

14.3 A party may disclose confidential information to its personnel, subcontractors and professional advisers who need to know it and are bound by equivalent confidentiality obligations, and where required by law, a court or a regulator, in which case it will give the other party notice where legally permitted.

14.4 This clause continues to apply after the Agreement ends.

15. Security

15.1 We maintain appropriate technical and organisational measures designed to protect Customer Data and personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include access controls, authentication, infrastructure security, monitoring and security procedures appropriate to the risks. Further detail is set out in the Data Processing Addendum.

15.2 No system is completely secure, and we do not warrant that the Services will be free from vulnerabilities.

16. Warranties

16.1 We will provide the Services with reasonable skill and care. Beyond that, and except as expressly set out in the Agreement, we do not warrant that the Services will be uninterrupted, error-free or free from vulnerabilities, or that they will meet the Customer’s particular requirements.

16.2 Except as expressly set out in the Agreement, and to the maximum extent permitted by law, all conditions, warranties and other terms that might otherwise be implied by statute, common law or otherwise are excluded.

17. Limitation of liability

17.1 Nothing in the Agreement limits or excludes either party’s liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be limited or excluded. Nothing limits the Customer’s obligation to pay fees due.

17.2 Subject to clause 17.1, neither party is liable to the other, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any:

• loss of profits, revenue or sales;
• loss of anticipated savings;
• loss of business opportunity, goodwill or reputation;
• loss arising from business interruption; or
• indirect or consequential loss or damage.

17.3 Our liability for any loss, corruption or destruction of data is subject to the limit in clause 17.4. The Customer is responsible for keeping its own copies of Customer Data it needs, using the export features of the Services.

17.4 Subject to clause 17.1, each party’s total aggregate liability arising out of or in connection with the Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, will not exceed the total fees paid or payable by the Customer under the Agreement in the twelve months immediately before the event giving rise to the claim.

18. Indemnity

18.1 The Customer will indemnify us against third-party claims, and the reasonable costs, damages and losses arising from them, to the extent they arise directly from:

• Customer Data infringing a third party’s intellectual property rights or breaching applicable law;
• the Customer’s or its Authorised Users’ unlawful use of the Services; or
• the Customer’s or its Authorised Users’ material breach of the Acceptable Use Policy,

except to the extent the claim results from our breach of the Agreement, negligence or wilful misconduct.

19. Suspension

19.1 We may suspend all or part of a Customer’s or an Authorised User’s access to the Services where reasonably necessary because:

• fees are overdue and remain unpaid after we have given notice;
• use of the Services creates a security risk;
• we reasonably suspect unlawful or fraudulent activity;
• the Customer or an Authorised User has materially breached the Agreement or the Acceptable Use Policy;
• continued use could adversely affect the Services or other customers; or
• suspension is required by law.

19.2 Where we consider it appropriate, we may give notice before suspending access. We may restore access once we are satisfied the reason for the suspension has been resolved.

20. Term and termination

20.1 The Agreement starts when a contract is formed under clause 4.3 and continues for as long as the Customer has an active Subscription Plan, unless ended earlier in line with this clause.

20.2 The Customer may cancel its subscription at any time in its account settings or by contacting us. Cancellation takes effect at the end of the current billing period, unless an Order Form sets a different minimum term.

20.3 Either party may terminate the Agreement immediately by written notice if the other party:

• commits a material breach that cannot be remedied, or that is capable of remedy but is not remedied within a reasonable period after written notice; or
• ceases trading, is unable to pay its debts as they fall due, or enters liquidation, administration, a company voluntary arrangement, receivership or any similar insolvency process, subject to applicable insolvency law.

20.4 We may terminate or withdraw a free plan or free trial at any time.

21. What happens when the Agreement ends

21.1 When the Agreement ends, the Customer’s and its Authorised Users’ right to access the Services ends, including the ability to view or export Customer Data. Authorised Users must stop using, and should remove, our mobile applications.

21.2 Export. The Customer should export any Customer Data it wishes to keep before its subscription ends. For 30 days after a paid Subscription Plan expires or is cancelled, the Customer may ask us, by emailing [email protected], to provide an export of its Customer Data using the export functionality and formats available in the Services. This does not apply where access has ended because of unlawful activity, a serious security risk, fraud, material misuse of the Services or another serious breach of the Agreement. After that period, Customer Data is handled in accordance with clause 21.3 and our Data Processing Addendum.

21.3 Deletion. After the Agreement ends, we delete Customer Data from our live systems, normally within 90 days, unless the law requires us to keep it or we have agreed otherwise with the Customer. Residual copies may remain in secure backups until they are overwritten through our normal backup cycle, and remain protected under these Terms until then.

21.4 Termination does not affect rights and remedies that have accrued. Except where the law requires otherwise, termination does not entitle the Customer to a refund.

21.5 Clauses that are intended to continue after termination, including clauses 7, 13, 14, 16, 17, 18, 21 and 23, continue to apply.

22. Force majeure

22.1 Neither party is liable for delay or failure to perform its obligations caused by events beyond its reasonable control, including failures of telecommunications networks, cloud infrastructure or utilities, natural disasters, fire, flood, pandemic, industrial action, war, terrorism, civil disturbance, government action or widespread cyber incidents not caused by that party. This clause does not apply to obligations to pay amounts already due.

23. General

23.1 Changes to these Terms. We may update these Terms from time to time. The effective date at the top shows when they last changed, and we may also tell Customers about significant changes by email or through the Services. If the Customer does not accept a change, it may cancel its subscription. Continued use of the Services after a change takes effect means the change is accepted. Changes to a signed Order Form or Enterprise agreement must be agreed in writing.

23.2 Assignment. The Customer may not transfer its rights or obligations under the Agreement without our prior written consent. We may transfer our rights and obligations to another business, for example as part of a sale or reorganisation of our business. We may use subcontractors to perform our obligations, and remain responsible for them.

23.3 Notices. Notices must be in writing and sent to the other party’s registered office or the email address it has given for notices. Notices to us should be sent to [email protected]. A letter sent in the UK is treated as delivered three business days after posting, and an email is treated as delivered when sent, or the next business day if sent outside 9am to 5pm on a business day.

23.4 Entire agreement. The Agreement is the entire agreement between the parties about its subject matter and replaces any earlier agreements, representations or understandings about it. Each party confirms that it has not relied on any statement not set out in the Agreement. Any terms the Customer tries to impose, for example in a purchase order, do not apply. Nothing in this clause limits liability for fraud.

23.5 Severability. If any provision is found invalid or unenforceable, it applies with the minimum modification needed to make it valid, and the rest of the Agreement is unaffected.

23.6 Waiver. A failure or delay in exercising a right or remedy does not waive it.

23.7 Third-party rights. No one other than the parties has any right to enforce any term of the Agreement under the Contracts (Rights of Third Parties) Act 1999, except as stated in our Mobile App Licence in relation to Apple.

23.8 Relationship. The parties are independent businesses. Nothing in the Agreement creates a partnership, agency or employment relationship.

23.9 Governing law and jurisdiction. The Agreement and any dispute or claim arising out of or in connection with it (including non-contractual disputes) are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

23.10 Previous versions. This version 2.0 replaces our Terms & Conditions and End User Licence Agreement dated 5 September 2025.

1. About this Addendum

1.1 This Data Processing Addendum (DPA) forms part of the agreement between Sync Software Limited (Sync, we, us) and the Customer under our Customer Terms of Service (Agreement). It applies automatically, without needing to be signed, where Sync processes personal data on behalf of the Customer in providing the Services.

1.2 Capitalised terms not defined in this DPA have the meanings given in the Agreement. Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any other data protection law applicable to the processing, as amended or replaced. Controller, processor, data subject, personal data, personal data breach and processing have the meanings given in Data Protection Law.

1.3 If there is a conflict between this DPA and the rest of the Agreement on a matter of data protection, this DPA prevails.

2. Roles of the parties

2.1 For personal data contained in Customer Data (Customer Personal Data), the Customer is the controller and Sync is the processor.

2.2 Where the Customer is itself acting as a processor on behalf of another controller, the Customer confirms that its instructions to Sync, including the appointment of Sync as a sub-processor, have been authorised by that controller.

2.3 Sync acts as a controller for the limited personal data it uses to manage its relationship with the Customer, such as account, billing and support contact details. That processing is described in our Privacy Notice and is not covered by this DPA.

3. Details of the processing

3.1 Subject matter: the provision of the Services under the Agreement.

3.2 Duration: the term of the Agreement, plus the period until Customer Personal Data is returned or deleted in line with section 11.

3.3 Nature and purpose: hosting, storing, organising, displaying, transmitting, backing up, retrieving, exporting, deleting and otherwise processing Customer Personal Data to provide, secure, maintain and support the Services, and as otherwise instructed by the Customer.

3.4 Categories of data subjects: as determined by the Customer, and typically including the Customer’s employees and workers, subcontractors and their personnel, engineers and field personnel, suppliers, consultants, site visitors, the Customer’s clients and end customers, and contacts at other organisations.

3.5 Categories of personal data: as determined by the Customer, and typically including identity and contact details; job role, organisation and account details; site attendance, check-in and location information; inductions, training records, qualifications and credentials; photographs, videos and documents; project, task, audit, inspection and work records; timesheets and financial records relating to work performed; and usage, audit log and technical data.

3.6 Special category data: the Customer may choose to record special category personal data in the Services, most commonly information about health recorded in accident, incident or other health and safety records. The Customer is responsible for having an appropriate lawful basis and condition for processing it, and for limiting it to what is necessary.

4. Customer obligations

4.1 The Customer is responsible for:

• having a lawful basis, and where needed a condition for processing special category data, for all Customer Personal Data it processes through the Services;
• giving data subjects the privacy information required by Data Protection Law;
• the accuracy and quality of Customer Personal Data, and the lawfulness of how it was obtained; and
• making sure its instructions to Sync comply with Data Protection Law.

5. Sync’s obligations

5.1 Instructions. Sync will process Customer Personal Data only on the Customer’s documented instructions, unless required to do otherwise by UK law, in which case Sync will tell the Customer before processing unless the law prohibits it. The Agreement, this DPA and the Customer’s configuration and use of the Services are the Customer’s documented instructions. Sync will tell the Customer promptly if it believes an instruction breaches Data Protection Law.

5.2 Confidentiality. Sync will make sure that personnel authorised to process Customer Personal Data are bound by appropriate obligations of confidentiality.

5.3 Access. Sync personnel will access Customer Personal Data only where necessary for the purposes described in clause 7.5 of the Customer Terms of Service.

5.4 Security. Sync will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the UK GDPR. These are summarised in section 8.

6. Sub-processors

6.1 The Customer gives Sync general authorisation to engage sub-processors to process Customer Personal Data. The sub-processors Sync currently uses are listed in our Subprocessor List.

6.2 Sync will give the Customer reasonable written notice, normally at least 14 days, before appointing a new sub-processor or replacing an existing one. Notice may be given by email, through the Services or by another written method, and Sync will also update the Subprocessor List.

6.3 The Customer may raise a reasonable objection to a new sub-processor on data protection grounds within the period stated in the notice. If Sync cannot reasonably accommodate the objection, the Customer’s remedy is to stop using the affected Services and cancel its subscription.

6.4 Sync will impose data protection obligations on each sub-processor by written contract that are no less protective than those in this DPA, and remains responsible to the Customer for the performance of its sub-processors’ obligations.

6.5 Third-party services that the Customer chooses to connect to the Services, such as accounting or business software integrations, are not Sync’s sub-processors. Information shared with them is shared on the Customer’s instructions and is governed by the Customer’s own agreement with that provider.

7. International transfers

7.1 Customer Personal Data stored in the Services is hosted in the United Kingdom.

7.2 Sync will not transfer Customer Personal Data outside the United Kingdom, or allow a sub-processor to do so, unless an appropriate safeguard is in place as required by Data Protection Law, such as UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

8. Security measures

8.1 Sync’s technical and organisational measures may include:

• encryption of data in transit;
• role-based access controls within the Services, configured by the Customer;
• restricting internal access to Customer Personal Data to authorised personnel with a business need;
• authentication controls, including storing passwords only as one-way hashes, and logging of sign-in and account security events;
• hosting on secure cloud infrastructure with physical and environmental security provided by the hosting provider;
• logging and monitoring;
• backup and recovery arrangements; and
• confidentiality obligations for personnel.

8.2 Sync may update these measures from time to time, provided that the overall level of security is not reduced.

9. Assistance

9.1 Data subject requests. Taking into account the nature of the processing, Sync will help the Customer, by appropriate technical and organisational measures where possible, to respond to requests from data subjects exercising their rights. Many requests can be handled by the Customer directly using the features of the Services. If Sync receives a request directly, it will pass it to the Customer without undue delay and will not respond itself except on the Customer’s instructions or as required by law.

9.2 Other assistance. Taking into account the nature of the processing and the information available to it, Sync will provide reasonable assistance to the Customer with its obligations relating to security, personal data breach notification, data protection impact assessments and prior consultation with the Information Commissioner’s Office.

9.3 Sync may charge reasonable fees for assistance that goes beyond the standard features of the Services, except where the assistance is needed because of Sync’s breach of this DPA.

10. Personal data breaches

10.1 Sync will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

10.2 The notice will, as far as the information is available, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Where not all information is available at once, Sync will provide it in phases as it becomes available.

10.3 Sync will take steps it considers appropriate to contain and investigate the breach. Notifying the Customer is not an admission of fault.

11. Return and deletion

11.1 While its subscription is active, the Customer can export and delete Customer Personal Data using the features of the Services.

11.2 On termination or expiry of the Agreement, and at the Customer’s choice, Sync will return or delete Customer Personal Data, except where applicable law requires continued storage.

11.3 Return. Unless otherwise agreed, Customer Personal Data is returned using the export functionality and formats available in the Services. The Customer can export it while its subscription is active and, for 30 days after a paid subscription ends, may ask Sync to provide an export, as described in the Customer Terms of Service.

11.4 Deletion. If the Customer does not request or complete an export during that period, Sync will proceed with deletion in accordance with its standard deletion process, normally deleting Customer Personal Data from its live systems within 90 days of the end of the subscription.

11.5 Backups. Customer Personal Data remaining in backups will remain protected in accordance with this DPA and will be deleted as those backups are overwritten through the normal backup lifecycle.

12. Audits

12.1 Sync will make available to the Customer the information reasonably necessary to demonstrate its compliance with Article 28 of the UK GDPR, which may include answers to reasonable security questionnaires and relevant policies or certifications.

12.2 Where that information is not sufficient, or where required by the Information Commissioner’s Office, the Customer may carry out an audit, or have one carried out by an independent auditor bound by confidentiality, no more than once in any 12-month period (unless following a personal data breach), on at least 30 days’ written notice, during normal business hours and in a way that minimises disruption to Sync’s business and protects the confidentiality of other customers’ data. The Customer bears its own costs of an audit.

13. Liability

13.1 Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.

1. About this list

1.1 This list sets out the sub-processors that Sync Software Limited uses to process Customer Data in providing the Services, as described in our Data Processing Addendum. Before appointing a new sub-processor or replacing an existing one, we give Customers reasonable written notice, normally at least 14 days, and update this list.

2. Sub-processors

Provider	Purpose	Data processed	Location
DigitalOcean	Hosting of the Sync platform, databases and file storage, and backups	All Customer Data	United Kingdom (London)
Sentry	Crash reporting, error monitoring and performance monitoring for the web application and mobile applications	User ID, organisation ID and name, error details and performance traces	European Union
Twilio SendGrid	Sending transactional emails, such as account invitations, password resets and notifications	Names, email addresses and email content	United States, with appropriate transfer safeguards
Stripe	Processing subscription payments and managing billing	Billing contact details and payment information	United Kingdom, European Union and United States, with appropriate transfer safeguards
Apple (Apple Push Notification service)	Delivering push notifications to iOS devices	Device notification tokens and notification content	Global, with appropriate transfer safeguards
Google (Firebase Cloud Messaging)	Delivering push notifications to Android devices	Device notification tokens and notification content	Global, with appropriate transfer safeguards

3. Integrations you choose to connect

3.1 Customers can choose to connect Sync to other software, such as accounting and business systems. When a Customer enables an integration, information is exchanged with that software on the Customer’s instructions. The provider is not our sub-processor. It is a service the Customer has chosen, governed by the Customer’s own agreement with that provider.

Integration	Purpose
Access	Exchanging information between Sync and the Customer’s Access software, where the Customer enables the integration

4. Our website

4.1 The providers we use to run our public Website, such as analytics and customer relationship tools, are not listed here because they do not process Customer Data. They are described in our Privacy Notice and Cookie Policy.

1. About this policy

1.1 This Acceptable Use Policy sets out the standards that apply when you use the Sync Software web application, our iOS and Android mobile applications, customer and subcontractor portals, APIs, integrations and our website at syncsoftware.uk (together, the Services). It applies to all content you upload, submit, create or share through the Services.

1.2 This policy is provided by SYNC SOFTWARE LIMITED, registered in England and Wales with company number 14520117, whose registered office is Chancery House, 3 Hatchlands Road, Redhill, Surrey, RH1 6AA (we, us, our).

1.3 By using the Services you agree to follow this policy. It forms part of our Customer Terms of Service, and should be read with our Website Terms of Use and Privacy Notice. Customers are responsible for making sure their Authorised Users follow it.

1.4 We may update this policy from time to time. The effective date at the top shows when it last changed.

2. Prohibited uses

2.1 You must not use the Services:

• in any way that breaches any applicable local, national or international law or regulation;
• in any way that is unlawful or fraudulent, or has any unlawful or fraudulent purpose or effect;
• for the purpose of harming or attempting to harm children in any way;
• to bully, harass, insult, intimidate or humiliate any person;
• to upload, send, knowingly receive, use or re-use any material that does not comply with section 4;
• to send unsolicited or unauthorised advertising or promotional material, or any other form of spam;
• to knowingly transmit any data, or upload any material, that contains viruses, trojans, worms, time-bombs, keystroke loggers, spyware, adware or any other harmful code designed to affect the operation of any software or hardware; or
• to upload or share terrorist content.

3. Security and access

3.1 You must not:

• share your login details, let anyone else use your account, impersonate another user or person, or try to get around access controls or permissions;
• attempt to gain unauthorised access to the Services, the servers on which they are hosted, or any server, computer or database connected to them;
• access, or attempt to access, information belonging to another organisation or user that you are not authorised to see;
• attack the Services through a denial-of-service attack or a distributed denial-of-service attack, or introduce anything malicious or technologically harmful;
• use bots, scrapers, automated scripts or excessive API requests in a way that interferes with, degrades or places unreasonable load on the Services, except through APIs or automation features we have expressly authorised;
• carry out penetration testing, vulnerability scanning or other security testing of the Services without our prior written authorisation; or
• reproduce, copy, resell, reverse engineer or tamper with any part of the Services, except as permitted by our Customer Terms of Service or by law.

3.2 You must tell us immediately if you suspect any unauthorised use of your account, any fraudulent or unlawful use of the Services, or any infringement of anyone’s rights.

3.3 Reporting vulnerabilities. If you believe you have found a security vulnerability, please report it promptly to [email protected]. You must not exploit it, access other users’ information or disclose it publicly before we have had a reasonable opportunity to investigate and fix it.

4. Content standards

4.1 These standards apply to all content you upload, submit, create or share through the Services, including photographs, videos, documents, drawings, comments, messages, project records and any other material (User Content).

4.2 You must make sure that User Content:

• is uploaded lawfully, and that you have the right and any permissions needed to upload and share it;
• does not infringe anyone’s privacy, data protection, intellectual property or other rights;
• is relevant to the authorised business purpose for which the Services are being used;
• is accurate, where it states facts, and is not knowingly false or misleading; and
• is not captured or uploaded where doing so would breach the law, site rules, client requirements or contractual restrictions, for example rules about photography on a particular site.

4.3 User Content must not:

• promote racism, bigotry, hatred or physical harm of any kind against any group or individual;
• harass, or advocate harassment of, another person;
• contain pornographic or sexually explicit material;
• be abusive, threatening, obscene, defamatory or libellous;
• promote, or give instructions for, illegal activities;
• exploit people in a sexual or violent manner;
• promote contests, sweepstakes or pyramid schemes without our prior written consent; or
• include more personal data about individuals, particularly special category data such as health information, than is necessary for the purpose.

4.4 Customers own their User Content, as set out in our Customer Terms of Service. Customers are responsible for the User Content their Authorised Users upload.

5. Breach of this policy

5.1 Failure to comply with this policy is a material breach of our Customer Terms of Service or Website Terms of Use, as applicable. If we reasonably believe a breach has occurred, we may take such action as we consider appropriate, including:

• issuing a warning;
• restricting or removing User Content that breaches this policy;
• suspending or closing an Authorised User’s account, or suspending access to all or part of the Services, in line with our Customer Terms of Service;
• disclosing information to law enforcement authorities where we reasonably believe it is necessary or the law requires it; and
• taking legal action.

5.2 Where a breach involves an Authorised User, we may tell the Customer’s administrator.

6. Complaints and reports

6.1 If you want to report content in the Services that you believe breaches this policy, or complain about our Website, please contact us at [email protected] or through our contact page.

7. Law and jurisdiction

7.1 This policy is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.

1. About this licence

1.1 This Mobile App Licence (Licence) is an agreement between you, the individual user (you), and SYNC SOFTWARE LIMITED, registered in England and Wales with company number 14520117, whose registered office is Chancery House, 3 Hatchlands Road, Redhill, Surrey, RH1 6AA (Sync, we, us). It governs your download, installation and use of the Sync Software mobile applications for iOS and Android (App).

1.2 The App gives access to the Sync Software platform. Your use of the platform is also governed by the agreement between Sync and the organisation that gave you access (your Organisation), which includes our Customer Terms of Service and Acceptable Use Policy. Our Privacy Notice explains how we use personal data, including the device permissions the App may ask for.

1.3 By downloading, installing or using the App you agree to this Licence. If you do not agree, do not use the App.

1.4 Accounts. The App can only be used with a Sync account created by your Organisation. You cannot create a new Sync account from within the App.

2. Licence

2.1 Subject to this Licence, we grant you a limited, non-exclusive, non-transferable, revocable licence to download, install and use the App on devices you own or control, for your Organisation’s authorised business use, for as long as your Organisation’s subscription and your account remain active.

2.2 If you install the App on a device you do not own, you must have the owner’s permission.

2.3 You must not, except as permitted by law:

• copy, modify, translate, adapt or create derivative works of the App;
• reverse engineer, decompile or disassemble the App, or attempt to derive its source code;
• rent, lease, lend, sell, sub-license, distribute or otherwise transfer the App;
• remove, obscure or alter any proprietary notices in the App;
• circumvent any security or access control in the App; or
• use the App in breach of export control or sanctions laws.

3. Updates and devices

3.1 We may release updates to the App from time to time. Some updates may be required for the App to keep working, and older versions may stop being supported. You should keep the App and your device’s operating system reasonably up to date.

3.2 The App requires a compatible device, a supported operating system and an internet connection. Some features need device permissions, such as camera, photos, location or notifications. You can manage these in your device settings. If you refuse a permission, the related feature may not work.

4. Intellectual property

4.1 The App, and all intellectual property rights in it, belong to Sync or its licensors. The App is licensed to you, not sold. Our ownership of the App does not give us ownership of your Organisation’s data, which is governed by our Customer Terms of Service.

5. Support and responsibility

5.1 Sync, not Apple or Google, is solely responsible for the App and its content, and for providing any maintenance and support for it. For help, email [email protected] or call 020 4553 5333.

5.2 Your Organisation’s agreement with us sets out the warranties and limits of liability that apply to the Sync platform, including when accessed through the App.

6. Ending this Licence

6.1 This Licence ends automatically if your account is deactivated or deleted, if your Organisation’s subscription ends, or if you breach this Licence. We may also end it by notice to you.

6.2 When this Licence ends you must stop using the App and should delete it from your devices. Information in your Organisation’s account is handled as described in our Customer Terms of Service and Privacy Notice.

7. Apple App Store terms

7.1 If you downloaded the App from the Apple App Store, the following terms also apply:

• Acknowledgement. This Licence is between you and Sync only, and not with Apple Inc. (Apple). Sync, not Apple, is solely responsible for the App and its content.
• Scope of licence. Your licence to use the App is limited to a non-transferable licence to use it on any Apple-branded products that you own or control, as permitted by the Usage Rules in the Apple Media Services Terms and Conditions, except that the App may be accessed and used by other accounts associated with you through Family Sharing or volume purchasing.
• Maintenance and support. Sync is solely responsible for providing any maintenance and support services for the App. Apple has no obligation whatsoever to provide any maintenance and support services for the App.
• Warranty. Sync is solely responsible for any product warranties, whether express or implied by law, to the extent not effectively disclaimed. If the App fails to conform to any applicable warranty, you may notify Apple, and Apple will refund any purchase price you paid for the App. To the maximum extent permitted by law, Apple has no other warranty obligation whatsoever with respect to the App, and any other claims, losses, liabilities, damages, costs or expenses attributable to any failure to conform to any warranty are Sync’s responsibility, subject to this Licence and your Organisation’s agreement with Sync.
• Product claims. Sync, not Apple, is responsible for addressing any claims by you or any third party relating to the App or your possession and use of it, including product liability claims, claims that the App fails to conform to any applicable legal or regulatory requirement, and claims arising under consumer protection, privacy or similar legislation.
• Intellectual property rights. If any third party claims that the App or your possession and use of it infringes that third party’s intellectual property rights, Sync, not Apple, is solely responsible for the investigation, defence, settlement and discharge of that claim.
• Legal compliance. You confirm that you are not located in a country that is subject to a UK or US Government embargo, or that has been designated by the UK or US Government as a “terrorist supporting” country, and that you are not listed on any UK or US Government list of prohibited or restricted parties.
• Developer contact. Questions, complaints or claims about the App should be sent to Sync Software Limited, Bank Chambers, 2 Church Street, Reigate, Surrey, RH2 0AN, United Kingdom; [email protected]; 020 4553 5333.
• Third-party terms. You must comply with applicable third-party terms, such as your mobile network or wireless data agreement, when using the App.
• Third-party beneficiary. Apple and Apple’s subsidiaries are third-party beneficiaries of this Licence, and, once you accept this Licence, Apple will have the right (and will be deemed to have accepted the right) to enforce this Licence against you as a third-party beneficiary.

8. Google Play terms

8.1 If you downloaded the App from Google Play, your use of Google Play is also governed by Google’s terms. This Licence is between you and Sync only, and Google is not responsible for the App or for providing support for it.

9. General

9.1 We may update this Licence from time to time. The effective date at the top shows when it last changed.

9.2 If any part of this Licence is found invalid or unenforceable, the rest remains in effect. Except as set out in section 7 in relation to Apple, no one other than you and Sync has any right to enforce this Licence.

9.3 This Licence is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

1. About these terms

1.1 These terms apply to your access to and use of our public website at syncsoftware.uk (Website). By using the Website you agree to them. If you do not agree, please do not use the Website.

1.2 These terms cover the Website only. Use of the Sync Software platform, including our web application, mobile applications, portals and APIs, is governed by our Customer Terms of Service, and purchases of Sync subscriptions are subject to those Terms, including their billing and refund terms. Use of our mobile applications is also governed by our Mobile App Licence.

1.3 You should also read our Privacy Notice, which explains how we use personal data, our Cookie Policy, and our Acceptable Use Policy, which applies to your use of the Website.

2. About us

2.1 The Website is operated by SYNC SOFTWARE LIMITED, a company registered in England and Wales with company number 14520117. Our registered office is Chancery House, 3 Hatchlands Road, Redhill, Surrey, RH1 6AA, and our trading address is Bank Chambers, 2 Church Street, Reigate, Surrey, RH2 0AN. Our VAT registration number is 431809894.

2.2 You can contact us by:

• emailing [email protected];
• using our contact page; or
• calling 020 4553 5333.

3. Using the Website

3.1 We make the Website available free of charge. We may change, suspend or withdraw all or part of the Website at any time. We do not promise that the Website will always be available or that your use of it will be uninterrupted or error-free.

3.2 You are responsible for your own internet connection and the devices you use to access the Website.

3.3 You must use the Website in line with our Acceptable Use Policy. In particular, you must not:

• attack the Website through a denial-of-service attack or introduce viruses, trojans, worms, logic bombs or other malicious or technologically harmful material;
• attempt to gain unauthorised access to the Website, the server on which it is stored or any server, computer or database connected to it; or
• remove, obscure, tamper with or circumvent any program code, data, copyright, trade mark or other proprietary notice on the Website.

3.4 We may prevent or suspend your access to the Website if you do not comply with these terms or any applicable law.

4. Intellectual property

4.1 We, or our licensors, own the intellectual property rights in the Website, its design and software, and the text, images, video, graphics and other content we publish on it. Those works are protected by copyright and other laws, and all rights are reserved.

4.2 You may view and print pages from the Website for your own business reference. You must not otherwise copy, reproduce, republish or commercially exploit any part of the Website without our written permission, and you must not use our trade marks, trade names or logos without our permission.

4.3 Nothing in these terms gives us ownership of any information you or your organisation store in the Sync platform. That is governed by our Customer Terms of Service.

5. Information on the Website

5.1 The content on the Website, including our guides, blog articles and Construction Library, is general information only. It is not legal, health and safety, financial or other professional advice, and you should take professional advice before acting on it.

5.2 We try to keep the Website accurate and up to date, but we do not guarantee that it is accurate, complete or current.

6. Links to other websites

6.1 Where the Website links to other websites, those links are for your information only. We have no control over, and are not responsible for, the content of those websites, and a link does not mean we endorse them.

7. Our liability

7.1 Nothing in these terms limits or excludes our liability for death or personal injury caused by our negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be limited or excluded by law.

7.2 The Website is provided for business use. To the extent permitted by law, we exclude all implied conditions, warranties and other terms that may apply to the Website, and we are not liable for any loss or damage arising from use of, or inability to use, the Website or reliance on its content, including loss of profits, sales, business or revenue, business interruption, loss of anticipated savings, loss of business opportunity, goodwill or reputation, or any indirect or consequential loss.

8. Changes to these terms

8.1 We may update these terms from time to time. The effective date at the top shows when they last changed. The terms in force when you use the Website apply.

9. Law and jurisdiction

9.1 These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from them.