This policy explains how SynNotate collects, uses, stores and protects personal information. SynNotate is developed and provided by Celagenix Business Advisory (Pty) Ltd (t/a Celagenix Agency), registration number 2015/359792/07, VAT number 4690296332, of 4th Floor West Wing, Nelson Mandela Square, Sandton, Johannesburg, 2196. It is part of the Celagenix group and owned by Celagenix Holdings (Pty) Ltd. In this policy “we”, “us” and “our” refer to Celagenix Business Advisory (Pty) Ltd, the responsible party for the personal information processed through SynNotate.
Our Information Officer is Martin Louw and our Deputy Information Officer is Johann Koen. For any privacy question or request, contact popi@celagenix.com or +27 12 755 5528.
Information we collect
- Account information: the email address you register with, and authentication data managed by our authentication provider (passwords are stored only as salted hashes, which we never see; if you enable two-factor authentication, the associated factor is stored by that provider).
- Workspace content you create: the entities, projects, tasks, ideas, leads, notes, launcher tiles and any files you upload. This content is yours; we process it only to provide the service to you and your workspace.
- Technical and security data: information needed to operate the service securely and reliably, such as session and request data and an audit record of changes made within your workspace.
SynNotate does not use third-party advertising or marketing trackers, and we do not sell personal information.
How we use your information
- To provide, maintain and secure the SynNotate service and your workspace.
- To authenticate you, including optional two-factor authentication, and to send account and security emails (for example password resets and email confirmation).
- To respond to your requests and provide support.
- To meet our legal, tax and accounting obligations.
Lawful basis for processing
We process personal information where it is necessary for the performance of our contract with you, with your consent, in our legitimate interests in operating and securing the service, and to comply with our legal obligations, in each case as permitted by the Protection of Personal Information Act, 2013 (POPIA).
How your information is stored and protected
SynNotate is a multi-tenant service, and separation between workspaces is enforced at the database level so one workspace cannot read another’s data. We rely on measures that include:
- logical isolation of each workspace’s data at the database level;
- encryption of data in transit;
- optional two-factor authentication and role-based access within a workspace;
- an audit log of changes, and private, access-controlled file storage.
These are the reasonable technical and organisational measures required by section 19 of POPIA. No system is perfectly secure, but we work to protect your information appropriately to its sensitivity.
Service providers
We use a small number of trusted providers to run the service. They process personal information on our behalf, under contract, only to provide their part of the service:
- Supabase: database, authentication and file storage.
- Vercel: application hosting and content delivery.
- An email-delivery provider for account and security notifications.
Some of these providers process and store data on infrastructure outside South Africa. Where personal information is transferred across borders, we rely on the transfer provisions of POPIA and on the safeguards offered by these providers.
How long we keep your information
We keep your information for as long as your account and workspace are active, plus any further period required by South African tax and accounting law or otherwise permitted by law. When you delete content it is first removed from view and then purged; you can also export your workspace data at any time from within the app.
Your rights
Under POPIA you may, subject to the Act:
- access the personal information we hold about you (s.23);
- request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s.24);
- object to processing on reasonable grounds (s.11(3));
- withdraw consent where processing is based on consent (s.11(2)(b));
- lodge a complaint with the Information Regulator.
To exercise any of these, contact popi@celagenix.com.
Lodging a complaint
You may lodge a complaint with the Information Regulator (South Africa):
- Complaints: POPIAComplaints@inforegulator.org.za
- General enquiries: enquiries@inforegulator.org.za
- Phone: 010 023 5200 · toll-free 0800 017 160
- Current postal and physical addresses are published at www.inforegulator.org.za
Cookies and local storage
SynNotate uses only the storage necessary to keep you signed in and to run the app securely. See our Cookie Notice for detail.
Changes to this policy
We may update this policy as the service evolves or the law changes. When we make a material change we will update the date above and, where appropriate, notify you.
Contact us
Celagenix Business Advisory (Pty) Ltd · popi@celagenix.com · +27 12 755 5528 · 4th Floor West Wing, Nelson Mandela Square, Sandton, Johannesburg, 2196.