Loading...
How we collect, use, and protect your personal data.
Last updated: March 4, 2026
Welcome to Sydcup ("we," "us," "our," or the "Company"). Sydcup is a software development and IT outsourcing company registered in the Republic of Estonia. We are committed to protecting the privacy of all individuals who interact with our website, services, and business operations.
This Privacy Policy ("Policy") explains how we collect, use, disclose, retain, and protect your personal data when you visit our website at sydcup.com (the "Website"), communicate with us, use our services, or otherwise interact with our business. This Policy applies to all personal data we process regardless of the medium or method of collection.
This Policy is designed to comply with the following data protection laws and regulations, among others:
By accessing our Website, submitting information through our contact forms, engaging our services, or otherwise providing personal data to us, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described in this Policy, please do not use our Website or provide us with your personal data.
This Policy does not apply to third-party websites, applications, or services that may be linked from our Website. We encourage you to read the privacy policies of any third-party services you access.
For the purposes of applicable data protection laws, the data controller responsible for your personal data is:
Company Name: Sydcup
Registered Address: Sepapaja tn 6, Lasnamae, Tallinn, Harju county, 15551, Estonia
Email: [email protected]
Website: sydcup.com
As the data controller, Sydcup determines the purposes and means of processing your personal data. We are responsible for ensuring that your personal data is processed in accordance with applicable data protection legislation.
If you have any questions about this Privacy Policy, our data processing activities, or wish to exercise your data protection rights, please contact us using the details provided above or in Section 14 of this Policy.
For purposes of the UK GDPR, where we process personal data of individuals located in the United Kingdom, Sydcup acts as the controller. Although we are established in Estonia (within the European Economic Area), we comply with UK GDPR requirements when processing UK residents' data.
For purposes of the LGPD, Sydcup acts as the controlador (controller) when we determine the purposes and means of processing personal data of data subjects located in Brazil.
For purposes of POPIA, Sydcup acts as the "responsible party" in relation to personal information of data subjects located in South Africa.
For purposes of PIPEDA, Sydcup is the "organization" responsible for personal information under its control.
We collect and process various categories of personal data depending on how you interact with us. Below is a detailed description of the types of information we collect:
When you voluntarily submit information to us, we may collect the following:
When you visit our Website, certain information is collected automatically through technical means:
We use cookies, web beacons, pixels, and similar tracking technologies to collect certain information about your browsing activities. For detailed information about our use of cookies, please see Section 6 of this Policy.
We may receive personal data about you from third-party sources, including:
We do not intentionally collect or process sensitive personal data (also known as "special categories of data" under the GDPR), such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life or sexual orientation. If you voluntarily provide such data to us (for example, in the body of a message), we will treat it with the highest level of care and in accordance with applicable law.
Under the General Data Protection Regulation (GDPR), we are required to identify a lawful basis for each processing activity involving personal data of individuals in the European Economic Area (EEA), the United Kingdom, and Switzerland. We rely on the following legal bases as set out in Article 6(1) of the GDPR:
Where we process your personal data based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. We rely on consent for the following processing activities:
We process personal data where it is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. This includes:
We process personal data where it is necessary for our legitimate interests or the legitimate interests of a third party, provided that such interests are not overridden by your fundamental rights and freedoms. We have conducted a balancing test for each of the following processing activities to ensure our interests do not disproportionately impact your rights:
We process personal data where it is necessary for compliance with a legal obligation to which we are subject. This includes:
For processing activities involving personal data of individuals located in jurisdictions outside the EEA and UK, we rely on the equivalent legal bases provided by applicable local law, including but not limited to:
We use the personal data we collect for the following purposes:
We will not use your personal data for purposes that are materially different from or incompatible with the purposes described above without providing you with prior notice and, where required by law, obtaining your consent.
Our Website uses cookies and similar tracking technologies to enhance your browsing experience, analyze Website traffic, and understand how visitors interact with our Website. This section explains what cookies are, what types of cookies we use, and how you can manage your cookie preferences.
Cookies are small text files that are placed on your device (computer, tablet, or mobile phone) when you visit a website. Cookies are widely used to make websites function properly, operate more efficiently, and provide information to website operators. Cookies can be "session cookies" (which are erased when you close your browser) or "persistent cookies" (which remain on your device for a set period or until you delete them).
These cookies are essential for the operation of our Website. They enable core functionality such as page navigation, access to secure areas, and basic Website features. The Website cannot function properly without these cookies. These cookies do not collect personal data for marketing purposes and do not require your consent under applicable law.
These cookies allow us to recognize and count the number of visitors and to see how visitors move around our Website. This helps us improve the way our Website works by, for example, ensuring that users can easily find what they are looking for. We may use services such as Google Analytics to collect and process this data. The information collected by these cookies is typically aggregated, though individual-level data may be processed. Where required by law, we obtain your consent before placing these cookies.
These cookies enable our Website to provide enhanced functionality and personalization, such as remembering your preferences (e.g., language selection, region) and providing you with a more personalized experience. If you do not allow these cookies, some or all of these features may not function properly.
If we use advertising or remarketing services in the future, these cookies may be set through our Website by our advertising partners. They may be used to build a profile of your interests and show you relevant advertisements on other websites. They work by uniquely identifying your browser and device. If you do not allow these cookies, you will not experience targeted advertising from us. As of the date of this Policy, Sydcup does not engage in behavioral advertising.
Some cookies on our Website are placed by third-party service providers. These third parties may use cookies to collect information about your online activities over time and across different websites. We do not control the cookies placed by third parties, and their use is governed by their respective privacy policies. Third-party services that may place cookies on our Website include:
In addition to cookies, we may use web beacons (also known as tracking pixels, clear GIFs, or pixel tags) in our emails and on our Website. Web beacons are small, transparent images that allow us to track whether an email has been opened and which links have been clicked. This information helps us measure the effectiveness of our communications and improve our Website and marketing efforts.
You can manage your cookie preferences in the following ways:
In accordance with the ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC) and applicable local implementations, we obtain your prior consent before placing non-essential cookies on your device when you are located in the EEA, the United Kingdom, or Switzerland. Strictly necessary cookies are exempt from this consent requirement.
We value your privacy and do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with third parties only in the following circumstances and for the purposes described below:
We engage trusted third-party companies and individuals to perform services on our behalf ("service providers" or "data processors"). These service providers have access to your personal data only to the extent necessary to perform the specific tasks we have engaged them for and are contractually obligated to protect your personal data in accordance with applicable data protection laws. Our service providers may include:
All data processing agreements with our service providers include appropriate data protection clauses as required by Article 28 of the GDPR and equivalent provisions under other applicable data protection laws.
In the event of a merger, acquisition, reorganization, sale of assets, bankruptcy, or similar corporate transaction, your personal data may be transferred to the acquiring entity or successor organization. In such cases, we will ensure that the receiving party agrees to process your personal data in a manner consistent with this Privacy Policy and applicable data protection laws. We will notify you of any such transfer and any changes to the processing of your personal data as required by law.
We may disclose your personal data to third parties if we believe in good faith that such disclosure is necessary to:
We may share your personal data with third parties when you have given us your explicit consent to do so. You may withdraw your consent at any time, and we will cease sharing your data with the relevant third party upon receipt of your withdrawal request, subject to any legal obligations that may require continued processing.
We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you with third parties for research, analysis, benchmarking, and other lawful purposes. Such data is not considered personal data under applicable data protection laws.
Sydcup does not sell personal data, as defined by the CCPA/CPRA, the LGPD, or any other applicable data protection law. We do not exchange personal data for monetary consideration. We also do not "share" personal data for cross-context behavioral advertising purposes as defined by the CPRA.
As a company registered in Estonia, a member of the European Union and the European Economic Area (EEA), Sydcup processes personal data primarily within the EEA. However, due to the global nature of the internet and our business operations, your personal data may be transferred to, stored in, or processed in countries other than the country in which it was originally collected.
Personal data transferred between countries within the EEA is protected by the uniform data protection standards established by the GDPR. No additional safeguards are required for intra-EEA transfers.
When we transfer personal data to countries outside the EEA or the United Kingdom that have not been deemed to provide an adequate level of data protection by the European Commission or the UK Secretary of State (as applicable), we implement appropriate safeguards to ensure that your personal data receives an equivalent level of protection. These safeguards include:
In accordance with the requirements established by the Court of Justice of the European Union in Schrems II (Case C-311/18) and guidance from the European Data Protection Board (EDPB), we conduct transfer impact assessments (TIAs) when transferring personal data to third countries using Standard Contractual Clauses. These assessments evaluate the legal framework of the recipient country to ensure that the level of protection afforded to personal data is not undermined by the laws or practices of that country.
For transfers of personal data governed by data protection laws other than the GDPR and UK GDPR, we comply with the applicable requirements of those laws:
You may obtain a copy of the relevant safeguards we have implemented by contacting us using the details provided in Section 14 of this Policy.
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting requirements. When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the data, and whether we can achieve those purposes through other means, as well as applicable legal, regulatory, and contractual requirements.
Where specific retention periods are not prescribed by law, we determine the appropriate retention period based on the following criteria:
When personal data is no longer required for the purposes for which it was collected and there is no legal basis for its continued retention, we will securely delete or anonymize the data. Anonymized data, which cannot be used to identify you, may be retained indefinitely for analytical, statistical, or research purposes.
If you request the deletion of your personal data, we will comply with your request subject to any legal obligations that require us to retain certain data. We will inform you if we are unable to fully comply with a deletion request and explain the reasons for any continued retention.
Depending on your location and the applicable data protection laws, you may have various rights with respect to the personal data we hold about you. We are committed to facilitating the exercise of your rights and will respond to any valid request in accordance with applicable law.
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the GDPR (or UK GDPR, as applicable):
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
To exercise your CCPA/CPRA rights, please submit a verifiable consumer request by contacting us at [email protected]. We will verify your identity before processing your request by matching information you provide with information we have in our records. For additional California-specific disclosures, please see Section 15 of this Policy.
If you are located in Brazil, you have the following rights under the Lei Geral de Proteção de Dados (LGPD), as set out in Article 18:
If you are located in another jurisdiction with applicable data protection laws, you may have similar or additional rights. We will respect and facilitate the exercise of your rights in accordance with the laws of your jurisdiction. Key rights under other applicable laws include:
To exercise any of the rights described above, please contact us at [email protected] with a clear description of your request. We may need to verify your identity before processing your request. We will respond to your request within the timeframes required by applicable law:
If we are unable to comply with your request (in whole or in part), we will explain the reasons for our decision and inform you of your right to challenge our response or lodge a complaint with the relevant supervisory authority.
Our Website and services are not directed at children, and we do not knowingly collect personal data from children. For the purposes of this section:
Our services are designed for businesses and professionals, and we do not market to or intentionally solicit information from children. If we become aware that we have inadvertently collected personal data from a child without appropriate parental or guardian consent where required by law, we will take prompt steps to delete the data from our systems.
If you are a parent or guardian and believe that your child has provided personal data to us without your consent, please contact us immediately at [email protected], and we will take appropriate steps to investigate and address the matter, including deleting the data if appropriate.
Sydcup takes the security of your personal data seriously. We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, destruction, loss, or accidental damage. These measures are designed to provide a level of security appropriate to the risk associated with the processing of your personal data, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks to your rights and freedoms.
While we take extensive measures to protect your personal data, the security of information transmitted over the internet cannot be guaranteed. We encourage you to take steps to protect your personal information, including:
If you become aware of any security incident involving your personal data, please notify us immediately at [email protected].
We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable laws, or regulatory guidance. When we make changes to this Policy, we will revise the "Last Updated" date at the top of this page.
If we make material changes to this Privacy Policy that significantly affect how we collect, use, or share your personal data, we will provide you with prominent notice through one or more of the following methods:
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Where material changes require your consent under applicable law (for example, changes to the purposes of processing for which we rely on consent), we will obtain your consent before implementing such changes.
If you would like to review prior versions of this Privacy Policy, please contact us at [email protected], and we will provide you with the relevant version.
Your continued use of our Website or services after the posting of changes to this Privacy Policy constitutes your acknowledgment of the changes. However, where your consent is required for specific processing activities, we will not rely on continued use as a basis for consent and will seek your affirmative consent as required by applicable law.
If you have any questions, concerns, or requests regarding this Privacy Policy, our data processing practices, or the exercise of your data protection rights, please contact us:
Sydcup
Address: Sepapaja tn 6, Lasnamae, Tallinn, Harju county, 15551, Estonia
Email: [email protected]
Website: sydcup.com
We aim to respond to all inquiries and requests within the timeframes required by applicable law. If your inquiry relates to a data protection right, please provide sufficient information for us to verify your identity and process your request.
If you are not satisfied with our response to your inquiry or believe that we are processing your personal data in a manner that violates applicable data protection laws, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. Key supervisory authorities include:
We encourage you to contact us directly before filing a complaint with a supervisory authority, as we are committed to resolving any concerns you may have in a timely and satisfactory manner. However, lodging a complaint with a supervisory authority is your right, and you may do so at any time without first contacting us.
If we are unable to resolve your complaint, you may also have the right to seek a judicial remedy before a competent court in accordance with applicable law.
This section provides additional disclosures required under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) for California residents. This section supplements the information provided elsewhere in this Privacy Policy.
In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA/CPRA (Cal. Civ. Code Section 1798.140):
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Name, email address, IP address, company name | Yes |
| B. Personal information categories listed in Cal. Civ. Code Section 1798.80(e) | Name, address, telephone number | Yes |
| C. Protected classification characteristics | Age, gender, race, etc. | No |
| D. Commercial information | Records of services purchased or considered | Yes |
| E. Biometric information | Fingerprints, faceprints, voiceprints, etc. | No |
| F. Internet or similar network activity | Browsing history, search history, interaction data | Yes |
| G. Geolocation data | Approximate location derived from IP address | Yes |
| H. Sensory data | Audio, visual, or similar information | No |
| I. Professional or employment-related information | Job title, company name, professional background | Yes |
| J. Non-public education information | Education records | No |
| K. Inferences drawn from other personal information | Profiles reflecting preferences or behavior | No |
| L. Sensitive personal information | Social Security number, financial account information, precise geolocation, etc. | No |
We collect personal information from the following categories of sources:
We collect and use personal information for the business and commercial purposes described in Section 5 of this Privacy Policy, including:
Sydcup does not "sell" personal information as defined by the CCPA/CPRA. Sydcup does not "share" personal information for cross-context behavioral advertising purposes as defined by the CPRA. We have not sold or shared personal information in the preceding 12 months.
In the preceding 12 months, we may have disclosed the following categories of personal information to our service providers for business purposes:
We retain each category of personal information for the periods described in Section 9 of this Privacy Policy. The specific retention period depends on the purpose of collection and applicable legal requirements.
California residents may exercise their rights under the CCPA/CPRA as described in Section 10.2 of this Privacy Policy. You may submit a request by contacting us at [email protected].
You may designate an authorized agent to make a request on your behalf. If you use an authorized agent, we may require you to provide written authorization to the agent and verify your identity directly with us, or the agent must provide a power of attorney executed pursuant to California Probate Code sections 4000 to 4465.
Under California Civil Code Section 1798.83, California residents who have provided personal information to a business with which the individual has established a business relationship may request information about whether the business has disclosed personal information to any third parties for the third parties' direct marketing purposes. As stated in this Policy, we do not disclose personal information to third parties for their direct marketing purposes. If you have questions about this practice, please contact us at [email protected].
In accordance with CCPA/CPRA requirements, we compile and disclose annual metrics regarding the number of requests to know, delete, and opt out that we receive from California residents, as well as our response times, upon request. You may request this information by contacting us at [email protected].
This section provides supplemental information for individuals located in specific jurisdictions, in addition to the information provided elsewhere in this Privacy Policy.
If you are located in the United Kingdom, the following supplemental provisions apply:
If you are located in Switzerland, the following supplemental provisions apply:
If you are located in Australia, the following supplemental provisions apply:
If you are located in Brazil, the following supplemental provisions apply:
If you are located in South Africa, the following supplemental provisions apply:
If you are located in Canada, the following supplemental provisions apply: