Privacy Policy

For your account, profile, billing and platform usage data, Syntax of Life (Pvt) Ltd is the data controller.

For project content exchanged on the marketplace — RFQ details, sample metadata, reports and deliverables — the Customer is the controller and Syntax, together with the engaged Provider, acts as a processor handling that data on documented instructions. Where we process personal data as a processor, a Data Processing Agreement (DPA) is available on request and forms part of the contract.

• Account & identity — name, organisation, role, email, phone, credentials (hashed), TOTP second-factor enrolment.
• Profile & verification — capabilities, instruments, accreditations, addresses, submitted verification documents.
• Marketplace activity — RFQs, quotes, awards, project stages, QC verdicts, milestone invoices, payment records, reviews and in-platform messages.
• Uploaded files — documents, reports and receipts you attach to projects (≤25 MB each).
• Technical & usage — log data, IP address, device and browser type, feature usage, security and audit events.
• Communications — support requests, consultations and correspondence.

Genetic and health data are special category data under GDPR Article 9 and equivalent provisions elsewhere — they receive heightened protection. The Gateway is designed so that this data mostly never reaches us:

• No raw genomic hosting. FASTQ, BAM, CRAM and comparable raw sequence files are never stored on our systems; they move directly between Customer and Provider.
• De-identification required. Project attachments must not contain direct identifiers of research participants or patients. Customers must de-identify or pseudonymise personal data in uploaded documents — for HIPAA-covered customers, consistent with 45 C.F.R. §164.514.
• No re-identification. Any attempt to re-identify de-identified or pseudonymised data, or to match it against external datasets, is a material breach of our Terms.
• Processor position. Where special-category data legitimately appears in project content, the Customer warrants it has a lawful basis — consent, ethical approval or another Article 9 condition — and we process it only on documented instructions under heightened access controls.

• Marketplace counterparties — Providers see RFQ content; Customers see awarded quote details; identity is unmasked only as the project requires (see Terms §5).
• Service vendors — cloud hosting, payment processing and transactional email under contract and appropriate safeguards.
• Professional advisers & authorities — auditors, counsel, and regulators or courts where required by law.
• Corporate events — a merger or acquisition counterparty under equivalent confidentiality.

We do not sell personal data. We do not share quote contents between competing providers. We do not use project content to train public AI models.

Our infrastructure may process data in data centres outside Pakistan. Where personal data subject to GDPR or UK GDPR is transferred internationally, we rely on recognised transfer mechanisms — adequacy decisions or Standard Contractual Clauses — and contractual equivalents for other jurisdictions. Transfers of project content between parties happen under their own agreements.

• Accounts — kept while active; deleted or anonymised within 12 months of closure unless a longer period is legally required.
• Financial & transaction records — retained per applicable tax and company law (typically up to 7 years).
• Project records & files — retained for the project lifetime and the contract's stated period; deleted on valid request subject to legal holds.
• Security & audit logs — 12–24 months for security investigations and compliance.
• Backups — deleted content may persist in encrypted backups for a limited rotation period before being purged.

We apply layered technical and organisational controls aligned with ISO/IEC 27001 principles: encryption in transit and at rest, role-isolated access (customers, providers, suppliers and operations each see only their scope), least-privilege staff access, mandatory two-factor authentication for privileged operations, database-level separation of sealed quotes, and an audit log across privileged actions. No system is perfectly secure; we maintain incident-response procedures and will notify affected parties and regulators of reportable breaches within required timelines.

Where GDPR, UK GDPR or equivalent law applies, you may exercise:

• Access — confirmation and a copy of your personal data;
• Rectification — correction of inaccurate data;
• Erasure — deletion subject to legal retention duties;
• Portability — a structured, machine-readable export;
• Restriction & objection — limit or object to processing, including marketing;
• Withdraw consent — where processing rests on consent;
• Complain — to your supervisory authority.

Send requests via contact. We respond within one month (GDPR) or the locally applicable period. For project content where a Customer or institution is the controller, we will refer you to that party as required.

We use strictly-necessary cookies for session integrity, security and preferences. Optional analytics cookies, where used, are non-identifying and can be disabled without affecting core functionality. We do not run third-party advertising trackers.

The Gateway is a professional B2B service, not directed at children. We do not knowingly collect personal data of minors; where research participant data concerns minors it is governed by the submitting organisation's ethics approvals and consent framework.

We do not make solely automated decisions with legal or similarly significant effect. RFQ routing matches declared capabilities — a form of sorting, not a decision about you.

Material changes are posted here with a new effective date and notified to registered accounts. Privacy questions, rights requests and DPA enquiries: contact the platform team.