Privacy policy
Last updated: 2026-07-31
1. Data controller
Synelys Biotech SAS, Toulouse, France, hello@synelysbiotech.com. We process your data as controller within the meaning of article 4(7) of Regulation (EU) 2016/679 (GDPR). Our activity falls under none of the cases in article 37 GDPR, so we have not appointed a data protection officer; any request about your data is handled at the address above.
2. Data collected, purposes and legal bases
We only collect the data you deliberately enter into our forms. No profile is built from your browsing.
| Processing | Data | Legal basis |
|---|---|---|
| Quote, purchase order, invoicing | company, contact name, role, e-mail, telephone, VAT number, billing and delivery addresses, order reference | performance of the contract, art. 6(1)(b) |
| Free sample request | name, work e-mail, company, delivery address, standard concerned | steps prior to a contract, art. 6(1)(b) |
| Technical enquiry, contact | name, e-mail, company, content of the message | legitimate interest in replying, art. 6(1)(f) |
| Accounting and tax obligations | order and invoice records | legal obligation, art. 6(1)(c) |
| Quality traceability of delivered batches | order reference, batch shipped, recipient | legitimate interest in quality follow-up, art. 6(1)(f) |
Fields marked with an asterisk in our forms are necessary to handle your request. Without them we can neither issue a quote nor ship an order. The remaining fields are optional.
3. What we do not do
We do not sell or rent your data. We do not use it for targeted advertising. This site uses no advertising cookie and no third-party profiling tool; audience measurement is described in section 8. No automated decision within the meaning of article 22 GDPR is taken about you: a quote, a discount or a credit limit is decided by a person.
4. Recipients and processors
Your data is disclosed only to the parties needed to perform your order:
- Site host.
- E-mail provider, which carries and stores the exchanges relating to your request.
- Carrier, for the recipient's name, address and telephone, for delivery only.
- Payment provider, for card payments. We neither receive nor store any card number.
- Accountant, for accounting records, bound by professional secrecy.
- Google Fonts, which serves the site's typefaces. That request passes your IP address to a Google server.
- Cloudflare (Cloudflare Web Analytics), which counts page views without a cookie.
- PostHog (United States), our audience measurement tool, which records browsing sessions (section 8).
The name of each of these providers is available on request. We do not pass your data on for marketing purposes.
5. Transfers outside the European Union
Hosting, e-mail and order handling take place in the European Union. Two exceptions are known. Typefaces are loaded from Google Fonts, which may involve a server outside the EU and therefore a transfer of your IP address; that request is not necessary to read the site, and a third-party request blocker removes it with no loss of function. Audience measurement data is processed by PostHog in the United States. Both transfers are covered by the European Commission's standard contractual clauses.
6. Retention periods
| Data | Period |
|---|---|
| Accounting records: invoices, purchase orders | 10 years from the end of the financial year, art. L. 123-22 French Commercial Code |
| Active customer file: contacts, quotes, history | 3 years from your last contact |
| Sample or quote request with no follow-up | 3 years from the request |
| Technical enquiry with no order | 12 months |
| Audience measurement (PostHog) | 1 year; browsing recordings: 30 days |
| Delivered-batch traceability, batch record | 5 years after the batch expiry date |
At the end of those periods, data is deleted or anonymised. Data kept purely to meet a legal obligation is archived with restricted access and is no longer used to contact you.
7. Security
The site is served over HTTPS only. Access to order data is limited to the people who need it and protected by authentication. Card payments are handled by our provider, with no card number passing through our systems. Should a breach be likely to create a risk to your rights, we will notify the CNIL within 72 hours and inform you under the conditions of article 34 GDPR.
8. Local storage and audience measurement
Your cart and language preference are kept in your browser's local storage, on your device only. This information is not transmitted to us, and you can remove it by clearing the site's data. It is strictly necessary to the function you asked for and therefore requires no consent under article 82 of the French Data Protection Act.
We measure how the site is used with PostHog, which sets a cookie and records browsing sessions (pages, clicks, scrolling) to help us improve the site. What you type into form fields is masked and never recorded. Cloudflare Web Analytics also counts page views, without a cookie. This rests on our legitimate interest in improving the site (art. 6(1)(f) GDPR), and you can object at any time: stop recording my visits.
9. Your rights
Under articles 15 to 22 GDPR you have rights of access, rectification, erasure, restriction, objection and portability. To exercise them, write to hello@synelysbiotech.com, stating what your request concerns. We reply within one month, extendable by two months for a complex request. Proof of identity will be asked for only where there is reasonable doubt as to who you are.
If our answer does not satisfy you, you may lodge a complaint with the French supervisory authority, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
10. Changes to this policy
This policy may be updated to reflect a change in the site or in the law. The update date appears at the top of this page. Substantial changes will be notified to active customers by e-mail.