Privacy Policy

1. Data controller

The controller responsible for personal data is Glyxthorghol.world, trading under the Synvera brand, with its contact address at Rotuaari 5, 90100 Oulu, Finland. The primary email address for privacy requests is chat@glyxthorghol.world. For formal correspondence you may also use the postal address above. We will verify identity where needed before disclosing or deleting records.

2. Scope of this Policy

This document applies to personal data processed through websites, landing pages, inquiry forms, customer service channels, checkout flows, newsletters where you opt in, and analytics or marketing tools that read or store identifiers on your device. It does not govern third-party platforms that we link to unless those platforms act as our processor under a written agreement.

What is not covered

Anonymous statistics that cannot be linked to an identifiable person, purely public information you publish elsewhere, and processing by social networks when you interact with their embedded widgets under their own terms are outside the detailed scope here, though we summarize cookie interactions in the Cookie Policy.

3. Categories of personal data

Depending on how you interact with us, we may process:

• Identity and contact data: name, email address, phone number if provided, delivery address for physical orders.
• Transaction data: order identifiers, product selections, payment status as reported by payment providers (we do not store full card numbers on our servers when a PSP tokenizes them).
• Communication content: free-text messages you send through forms or email threads.
• Technical data: IP address, approximate location derived from IP, browser type, operating system, device model where available.
• Usage data: pages viewed, referring URL, timestamps, scroll or click events if analytics cookies are accepted.
• Marketing preferences: opt-in records, unsubscribe timestamps, campaign identifiers.

4. Purposes and legal bases

We process personal data only when a legal basis under Article 6 GDPR applies. The table below summarizes typical situations.

Website delivery and security

We log limited technical information to operate TLS, prevent abuse, and debug outages. Legal bases: legitimate interests (Article 6(1)(f)) in secure infrastructure, supplemented where necessary by legal obligations.

Contractual fulfillment

When you purchase Synvera products, we use your data to process payment, ship goods, provide invoices, and handle warranty or statutory claims. Legal basis: performance of a contract (Article 6(1)(b)).

Pre-contractual inquiries

Messages sent through contact forms are processed to respond and, if you proceed to order, to prepare a contract. Legal basis: steps at your request prior to entering a contract (Article 6(1)(b)).

Legal compliance

Accounting, tax, and consumer law may require retention of certain records. Legal basis: legal obligation (Article 6(1)(c)).

Analytics and marketing

Non-essential cookies and similar technologies are activated only after you give consent through our banner where required by ePrivacy rules. Legal basis: consent (Article 6(1)(a)), withdrawable at any time without affecting prior lawful processing.

5. Retention periods

We keep data no longer than necessary for the purposes collected. Indicative periods:

• Marketing consents and mailing lists until you withdraw consent or we retire the list, subject to suppression records.
• General inquiry emails up to twenty-four months unless a dispute requires a longer period.
• Order and accounting records for the duration mandated by Finnish bookkeeping law, commonly six to ten years for relevant documents.
• Security logs on a rolling basis, typically not exceeding twelve months unless investigating an incident.
• Cookie lifetimes as listed in the Cookie Policy for each category.

6. Recipients and processors

We share personal data with categories of recipients such as hosting providers, email delivery services, payment service providers, logistics partners, and professional advisers bound by confidentiality. Each processor receives only the data required for their task and must implement GDPR Article 28 terms. A current list of sub-processors is available on request.

7. International transfers

Where data is processed outside the European Economic Area, we rely on an adequacy decision under Article 45 GDPR or appropriate safeguards such as standard contractual clauses approved by the European Commission, together with supplementary measures where required by case law.

8. Security measures

We implement organizational and technical measures including role-based access, encryption in transit, vendor due diligence, incident response procedures, and staff training. No online transmission is completely risk-free; we continually review controls as threats evolve.

9. Your rights

Subject to applicable conditions, you may exercise the rights of access, rectification, erasure, restriction, portability, and objection. You may withdraw consent for processing based on consent at any time. To exercise rights, email chat@glyxthorghol.world describing your request. We may need to confirm your identity before acting.

10. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you in the context of this website.

11. Children

Our services are directed at adults. We do not knowingly collect personal data from children without appropriate parental authority as required by law.

12. Changes to this Policy

We may update this Policy to reflect legal, technical, or business developments. Material changes will be highlighted on this page. The dynamic date in the banner shows when you loaded the page in your browser; archived versions may be available on request.

13. Contact

For all privacy matters: chat@glyxthorghol.world
Postal address: Glyxthorghol.world, Rotuaari 5, 90100 Oulu, Finland