This Privacy Policy explains how SynCRM (“SynCRM”, “we”, “us”) collects, uses, discloses and safeguards personal information when an estate agency (“Customer”) and its authorised users use the SynCRM real estate customer relationship management platform (the “Service”). It is written with the Cyber and Data Protection Act [Chapter 11:12] of Zimbabwe in mind, alongside general good-practice data protection principles.
1. Who is responsible for your data
The Customer (the estate agency that creates an account) is the data controller for the client, lead, contact and property information it enters into the Service. SynCRM acts as a data processor, handling that information on the Customer’s behalf and in accordance with this policy and our agreement with the Customer. For account-level data about the Customer’s own users, SynCRM acts as controller.
2. Information we collect
- Account information: organisation name, user full name, email address, role and authentication credentials (passwords are stored only as salted hashes, never in plain text).
- CRM content entered by users: contact and lead details (names, phone numbers, email addresses, budgets, notes), property listings, viewings, tasks, activities and deal records.
- Usage and technical data: log records such as sign-in events, device and browser information, and timestamps necessary to operate and secure the Service.
- Acceptance records: the version of this policy and the Terms & Conditions you accept, with the time of acceptance.
3. How we use information
- To provide, maintain and improve the Service.
- To authenticate users and protect against unauthorised access.
- To send operational communications such as task reminders and account notices.
- To generate reports and analytics for the Customer about its own data.
- To comply with legal obligations and enforce our agreements.
We do not sell personal information, and we do not use Customer CRM content for advertising.
4. Lawful basis
We process personal information where it is necessary to perform our contract with the Customer, where we have a legitimate interest in operating and securing the Service, where you have consented, or where processing is required to comply with the law.
5. Sharing and sub-processors
We share information only with service providers that help us run the Service (for example cloud hosting, database, email delivery and, where enabled, AI-assistant providers). These providers act on our instructions under confidentiality obligations. We may also disclose information where required by law or to protect rights and safety.
6. AI assistant
Where the Customer enables the AI Copilot, queries and the relevant CRM records needed to answer them are sent to our AI provider solely to generate a response for the user. This content is not used to train third-party models.
7. Data retention
We retain personal information for as long as the Customer’s account is active and as needed to provide the Service. When an account is closed, we delete or anonymise data within a reasonable period unless retention is required by law.
8. Security
We use technical and organisational measures including encryption in transit, hashed credentials, access controls scoped to each organisation, and audit logging. No system is perfectly secure, but we work to protect information against loss, misuse and unauthorised access.
9. Your rights
Subject to applicable law, individuals may request access to, correction of, or deletion of their personal information. Because the Customer controls CRM content, such requests for client and lead data should be directed to the relevant agency; we will assist the Customer in responding.
10. International transfers
Some sub-processors may store or process data outside Zimbabwe. Where this occurs we take steps to ensure an appropriate level of protection for the information.
11. Changes to this policy
We may update this policy from time to time. When we make material changes we will update the version above and may require renewed acceptance.
12. Contact
For privacy questions, contact your organisation administrator or SynCRM support at the address provided in your service agreement.