Privacy policy

1. Data controller

The data controller is ITDATA TELECOM SRL ("we"), Romania. You can contact us about any privacy matter at gdpr@syncdesk.ro. Full company identification details (registered office, tax ID) are available on request.

2. What data we process

• Account data (if you create an account in the panel): name, email address and, optionally, the organization you belong to.
• Device data, reported by the app so that it can work: SyncDesk identifier (ID), device name (hostname), operating system, general hardware specifications (CPU, memory), app version, IP address and online/offline status.
• Connection (audit) logs: the initiating ID and the controlled ID, date/time, session duration, IP address and file transfer metadata (file name and size). These serve security and traceability.
• Address books / groups: the entries you add manually (IDs, tags).
• Session recordings, only if the organization the device belongs to turns them on: the controlled device records the screen image for the duration of the session and sends the recording to our servers or to the storage server chosen by the organization. The feature only starts after the organization confirms that it has informed its employees, as required by Romanian law (Law 190/2018).

3. Purposes and legal basis

• Providing the remote access service and the panel - basis: performance of a contract (Art. 6(1)(b) GDPR).
• Security, auditing and abuse prevention - basis: legitimate interest (Art. 6(1)(f)).
• Support and operational communications - basis: legitimate interest / performance of a contract.
• Measuring visits to the public website - basis: legitimate interest (Art. 6(1)(f)); you can object at any time from the cookie button.

We do not use data for advertising and we do not sell personal data. The mobile app contains no advertising and no analytics libraries.

4. Where data is stored. Third parties

Data is hosted on infrastructure operated by ITDATA TELECOM SRL. Account data, device address books and audit logs are stored in Romania. The relay nodes a session may pass through are also operated by us and are located in the European Union; they forward encrypted packets without storing them. Infrastructure (hosting) providers process data only as processors, on our instructions.

On the public website we also use the services listed in our cookie policy. None of them is used in the app.

5. How long we keep data

Account data is kept while the account is active. Audit logs are kept for security and traceability; on request we delete them together with the account or device they refer to. Session recordings are kept for as long as the organization that turned them on decides and are deleted together with its account. How to request deletion is explained on the page Delete your account and data.

6. Mobile app permissions

The Android app may request permissions needed to work as a remote access tool, including: screen capture (MediaProjection), the accessibility service (to let a remote person control the device with mouse and touch, only when you enable it explicitly), microphone (to transmit sound during a session), camera (only for the camera view feature, when you allow it), notifications, running in the background and file access (for file transfer). These permissions are used exclusively to provide remote control and file transfer, at your initiative. The accessibility service reads only the active text field, to type into it what the remote person sends; it does not otherwise read the content of other apps and sends nothing elsewhere.

7. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw consent where processing is based on it. You can exercise your rights by writing to gdpr@syncdesk.ro; for erasure, the steps are on the page Delete your account and data. You also have the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP, dataprotection.ro) or with the authority in your country.

8. Security

We apply technical and organizational measures to protect data: end-to-end encryption of sessions, secure transport and role-based access in the panel.

9. Children

SyncDesk is intended for professional/adult users and is not directed at children under 16.

10. Changes

We may update this policy. The current version is always published at this address, with the date of the last update shown above. If the English and Romanian versions differ, the Romanian version prevails.