Effective Date: August 18, 2026
Last Updated: September 22, 2026
This Privacy Policy explains how Synct Collective Limited ("we," "our," or "us") collects, uses, shares, and protects personal data when you visit https://synctcollective.com (the "Site"), inquire about our services or domain portfolio, or engage us for technical work.
For cookies and similar technologies, see our Cookie Policy. Site use is also subject to our Terms of Service.
1. Who is the data controller?
Synct Collective Limited is the data controller for personal data processed through this Site and related business communications.
- Company number: 138719C (Isle of Man)
- Registered address: Gordon House, 10a Prospect Hill, Douglas, Isle of Man, IM1 1EJ
- Contact for privacy requests: use our secure Contact Form and mark the message as a privacy request
We process personal data in line with the Isle of Man Data Protection Act 2018 and the Applied GDPR framework that applies in the Isle of Man. Where UK GDPR or other local laws apply to you as a data subject, we will honour those rights as required.
2. What personal data do we collect?
A. Data you provide directly
- Contact and inquiry data: name, email, phone, company name, and project or domain details submitted via contact forms, audit requests, or portfolio inquiries.
- Client and portal account data: authentication credentials, business contact details, and billing or onboarding information needed for client portals or project delivery.
- Interactive form submissions: information submitted through quote, onboarding, or fillable workflow forms.
B. Data collected automatically
When you use the Site, our servers and security tools may log:
- IP address and approximate region
- Browser type, operating system, and device class
- Pages viewed, referral URLs, and basic request diagnostics
- Security and performance logs used to protect the Site and maintain Core Web Vitals
We do not currently run a separate marketing analytics cookie suite on the public Site. See the Cookie Policy for live technologies such as form security (reCAPTCHA) and review widgets.
3. Why we process data and our lawful bases
We only process personal data when we have a lawful basis. Typical mappings:
- Responding to inquiries and preparing proposals - legitimate interests in operating a B2B services business, and/or steps prior to entering a contract.
- Delivering contracted engineering, portals, migrations, email infrastructure, branding, or related services - performance of a contract (or steps to enter one).
- Domain inquiries, negotiation, escrow, and transfer workflows - performance of a contract / steps prior to contract, and legitimate interests in completing secure transactions.
- Invoicing, accounting, and tax records - legal obligation and/or contract.
- Securing the Site, preventing abuse, spam, and unauthorized access - legitimate interests in protecting our systems, clients, and visitors.
- Security challenges such as Google reCAPTCHA on forms - legitimate interests in fraud and bot prevention (and, where consent is required for a non-essential cookie, consent under applicable ePrivacy rules).
- Optional marketing emails (only if you opt in) - consent, which you may withdraw at any time.
Where we rely on legitimate interests, we balance those interests against your rights and expectations as a B2B visitor or client contact.
4. Who we share data with
We do not sell, rent, or trade personal data. We share data only with service providers and partners needed to run the business, for example:
- Hosting and infrastructure - servers, CDN, DNS, and security tooling
- Communications - email and form notification tools that deliver your messages to us
- Domain escrow and registrars - platforms such as Escrow.com, Dynadot, Afternic, or similar, when you pursue a domain transaction
- Payment processors - for example Stripe, when collecting fees under a contract
- Security and bot protection - Google reCAPTCHA for form abuse prevention
- Review or trust widgets - for example Trustindex, when review embeds are shown
These parties process data under their own terms and, where required, under appropriate data processing terms with us. A current sub-processor list can be provided on request for active client engagements.
5. International transfers
Some providers (including US-based escrow, payment, security, or communication tools) may process data outside the Isle of Man or European Economic Area. Where we transfer personal data internationally, we use appropriate safeguards available under applicable law, such as adequacy decisions where they exist, or standard contractual clauses / equivalent transfer tools required by the Applied GDPR framework, together with vendor due diligence.
6. How long we keep data
We keep personal data only as long as needed for the purpose collected, then delete or anonymize it unless a longer period is required by law. Typical periods:
- General website inquiries: up to 24 months after the last meaningful contact, unless a project starts
- Active client / portal records: for the life of the engagement, then up to 7 years for accounting and contract records (or longer if required by law or dispute)
- Domain transaction records: for the life of the deal plus up to 7 years for audit and ownership proof
- Security and server logs: typically 30 to 180 days, unless needed longer to investigate an incident
- Marketing consents: until you withdraw consent, plus a short suppression record so we honour the opt-out
7. Security
We use technical and organisational measures appropriate to a B2B engineering practice, including HTTPS/TLS, access controls, least-privilege admin access, and hardened WordPress hosting practices. No method of transmission or storage is perfectly secure; if we become aware of a personal data breach affecting you, we will notify you and the relevant authority when required by law.
8. Your rights
Subject to applicable law, you may have the right to:
- access your personal data and receive a copy
- rectify inaccurate or incomplete data
- erase data in certain circumstances
- restrict or object to certain processing
- data portability where processing is automated and based on consent or contract
- withdraw consent where processing is based on consent (withdrawal does not affect prior lawful processing)
To exercise these rights, contact us via the Contact Form. We may need to verify your identity before acting on a request.
Complaints: If you are unhappy with how we handle your data, you can contact us first. You also have the right to complain to the Isle of Man Information Commissioner (the supervisory authority for Isle of Man controllers). If UK GDPR applies to you as a UK data subject, you may also contact the UK Information Commissioner's Office (ICO).
9. Children
The Site and our services are directed at businesses and adult professionals. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data to us, contact us and we will delete it where required.
10. External links
The Site may link to third-party sites (registrars, escrow platforms, partners). Their privacy practices are outside our control. Review their policies before submitting personal data to them.
11. Changes to this policy
We may update this Privacy Policy from time to time. The "Last Updated" date at the top will change when we do. Material changes will be posted on this page. Continued use of the Site after an update means you have read the revised policy.
12. Contact
Synct Collective Limited (Company No. 138719C)
Gordon House, 10a Prospect Hill, Douglas, Isle of Man, IM1 1EJ
Privacy inquiries: Contact Form
