Data protection summary
This page is for IT and data protection offices reviewing SynCaps before a researcher uses it. It summarises our terms of service and privacy policy, which are the full texts. Questions to [email protected].
Who we are
SynCaps is provided by Syntagm Ltd, registered in England (company number 01895345), 10 Oxford Road, Abingdon OX14 2DS, United Kingdom. We are registered with the Information Commissioner's Office under number ZC263863.
No personal data is needed
- Researchers sign in with an email address and a password. We do not ask for a name, organisation or phone number.
- Uploaded studies carry no personal identifiers. For each file the researcher either declares that it holds none, or has its participant IDs replaced with codes in their own browser before the file is sent; we never receive the IDs or the map. Comments and unrecognised lines are removed on upload.
- Card sorts run in SynCaps ask participants for no name, email address or panel ID. Each finished sort gets a completion code, which is how a participant asks for their data.
Roles
For card sorts run in SynCaps, the researcher's organisation is the controller of participants' data and Syntagm is its processor. The data processing agreement that UK and EU law require is section 5 of the terms, accepted each time a card sort is launched. Syntagm is the controller of researchers' account data.
Where it is held
| Provider | What it does | Where |
|---|---|---|
| DigitalOcean | Hosts SynCaps and its database | London |
| Cloudflare | Carries all traffic and protects it from attack | May process outside the UK, under the UK's arrangements for international transfers |
| Amazon Web Services | Sends emails to researchers (never to participants) | London |
| Paddle | Takes payments, as Merchant of Record; receives only the buyer's details, never studies or participants' data | UK (its United States and Canadian companies for buyers there) |
We email researchers at least 30 days before adding or replacing a provider that processes participants' data.
How long it is kept, and how it is deleted
- A study is kept for six months from its creation, longer if it is paid for. Its owner can delete it at any time.
- When its date passes, it can only be downloaded, for 30 days, and is then deleted with everything made from it. Backups are kept for about a month, so deleted data is gone from them within about a month.
- Sorts left unfinished are deleted after seven days. The scrambled internet addresses used to spot repeat participants are deleted when collection ends.
- Web server logs, which hold internet addresses, are kept for 14 days.
Security
- Encrypted in transit (HTTPS) between every browser and SynCaps.
- A study is reachable only through its owner's account, and by the people at Syntagm who run the service, who look at it only to help when asked or to deal with a problem.
- A participant's internet address is never stored with their sort; only a scrambled form that cannot be turned back into an address.
- Breaches affecting participants' data are reported to the researcher within 72 hours of our finding out.
- No analytics, advertising or tracking, and only the cookies SynCaps needs to work. Studies are never used to train software.
Participants' rights
A participant sends their completion code to the address the researcher gives. The researcher can then find, download and delete that participant's sort themselves, at any time and at no cost; if they cannot, we do it within 7 days of being asked.