[Synt World / Security audit](https://synt.world/)

# Privacy notice

How we handle personal data on this website, in enquiries, in outreach and in audit engagements.

## Company and contact

The company operating this service is Synt World DOO BEOGRAD, RUŽE JOVANOVIĆ 43, 11050 Beograd, Serbia. Privacy questions can be addressed to [privacy@synt.world](mailto:privacy@synt.world) .

This notice applies under the Serbian Law on Personal Data Protection and, for people in the European Union, the GDPR. We have not appointed a data protection officer; privacy@synt.world is read by our management. Legal bases are cited from the GDPR; the corresponding bases in Article 12(1) of the Serbian law apply in the same way unless stated otherwise.

## Information you choose to send

The enquiry form asks for your name, work email, company or website and a description of the desired audit scope. Call requests also include your preferred date, time and time zone. Entries are composed into an email draft on your device, addressed to ceo@synt.world and cbo@synt.world. This website does not submit the form to a backend or save its contents in browser storage.

If you send the draft, your email provider and the recipient’s mail service process the message. You can also reach us by Telegram, WhatsApp or phone. We use what you send to answer you and to discuss a possible engagement, as steps you request before a contract (GDPR Art. 6(1)(b)) or, when you write for a company, on the basis of our legitimate interest in answering business enquiries (Art. 6(1)(f)). We keep enquiries in our mailbox and CRM for up to 24 months after our last contact.

## Information to leave out

Do not send credentials, access tokens, production datasets or sensitive vulnerability evidence through this initial contact form. Arrange an appropriate channel with the team before sharing audit materials.

## If we contacted you first

We may contact people at companies whose work contact details are publicly available, for example on a company website or LinkedIn, about security testing. We do this on the basis of our legitimate interest in business-to-business outreach (GDPR Art. 6(1)(f)). We store your name, work email, role, company and where we found these details in our CRM for up to 24 months after our last contact. You can object at any time by replying “unsubscribe” or writing to privacy@synt.world; we then stop contacting you and keep only a suppression entry so that we do not contact you again.

## Clients and audit engagements

When your organisation engages us, we process the business contact details of your team and the engagement documents to perform the contract (GDPR Art. 6(1)(b)). We keep accounting records because Serbian law requires it (a legal obligation under Article 12(1)(3) of the Serbian law); under the GDPR this rests on our legitimate interest in meeting that obligation (Art. 6(1)(f)). Contract documents are kept for the duration of the engagement plus three years, accounting records for the period required by Serbian law.

During testing we may encounter personal data in your systems. We process it only on your instructions, as your processor, and delete audit materials automatically one month after the report, or earlier or later at your request. Access to test credentials, evidence and client information is limited to the people who need it for the engagement.

Our testing product uses large language model providers. Personal data is removed before anything is sent to them, and they work under zero-data-retention terms.

## Website delivery and security

Cloudflare delivers and protects this website, including its firewall and rate limiting. To do so it processes connection data such as your IP address, browser and the requested page, on the basis of our legitimate interest in a secure and available website (GDPR Art. 6(1)(f)). Cloudflare may set a strictly necessary security cookie when it checks suspicious traffic. Fonts and website assets are served from this website; your browser does not contact Google Fonts. We do not use advertising cookies.

## Who receives your data

Processors acting on our behalf: Cloudflare, Inc. (website delivery, security and identifier-free counters), PostHog, Inc. (optional analytics in its EU Cloud, Frankfurt), HubSpot, Inc. (CRM for enquiries, outreach and client contacts) and Namecheap, Inc. (email hosting). Telegram, WhatsApp (Meta), your own email provider and phone operators process messages under their own terms. Accountants, lawyers and authorities receive data only when the law or a contract requires it. We do not sell personal data.

## International transfers

We are based in Serbia. Several of these providers are based in the United States or may access data from there. Where personal data leaves Serbia or the European Economic Area, we rely on the safeguards in the providers’ data processing terms, such as standard contractual clauses. We are completing data processing agreements with each provider; ask privacy@synt.world for their current status.

## How long we keep data

Enquiries and outreach contacts: up to 24 months after our last contact. Client contract documents: the engagement plus three years; accounting records: as long as Serbian law requires. Audit materials: one month after the report. Optional analytics: events up to one year, recordings one month. Identifier-free counters: 30 days at Cloudflare, daily totals up to one year in PostHog. Your consent choice: 180 days.

## Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing and to data portability. Where we rely on consent, you can withdraw it at any time; this does not affect processing before the withdrawal. You can object to outreach at any time.

To exercise a right, write to [privacy@synt.world](mailto:privacy@synt.world) . We answer within 30 days and may ask you to confirm your identity.

You can also complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs) or, in the European Union, to the data protection authority of your country (listed at edpb.europa.eu).

## Other information

You do not have to give us personal data to browse this website; we need your contact details only to answer an enquiry or to perform a contract. We do not make decisions about you based solely on automated processing. We update this notice when our processing changes. Last updated: 5 October 2026.

## Optional website analytics

With your consent (GDPR Art. 6(1)(a)), Synt World uses PostHog Cloud EU (Frankfurt) to measure page and section views, active time, scroll depth, navigation, contact-button clicks, click and pointer positions for heatmaps (including mouse movement), JavaScript errors (script file and line) and website performance. A sample of visits may be recorded if you also allow recordings. We record that a form was started or an email draft prepared, never what you typed; forms and the animated mascot are excluded from recordings. We do not send URL query strings or precise location; IP geolocation is disabled and PostHog discards IP addresses. Clicking an email button indicates an opened draft, not a sent message.

Analytics uses a random identifier in session storage (synt_analytics), not your name or email. It lasts for the browser tab session. Your consent choice is stored in local storage (synt_privacy_choice, used for 180 days, and PostHog’s own flag synt_sdk_consent until you change your choice) and in the synt_measurement cookie described below. PostHog processes analytics on our behalf in its EU region. Analytics events are retained for up to one year and recordings for one month, subject to the provider’s deletion processing time. These periods are separate from the one-month policy for audit materials.

Consent is optional and can be changed or withdrawn at any time through Privacy settings in the footer. Withdrawal stops future collection and clears the local analytics identifier; it does not automatically erase events already received. Your rights, including deletion, and how to complain are described above.

## Regional rules and limited statistics

Cloudflare selects our rule using the connection country, which can be inaccurate with a VPN. We never store IP or country in our counters. Unless you refuse, server page-delivery counts operate in the EEA, Serbia, Kazakhstan, the United States, United Kingdom, Switzerland and Turkey. Anonymous browser audience measurement also operates in the US, UK, France, Italy, Netherlands, Switzerland and Turkey. It runs before a choice; in Turkey, where PostHog stays disabled, it also continues after you accept. Other countries and failed lookups wait for consent. Detailed PostHog analytics stays disabled for Turkey and Kazakhstan while transfer arrangements are unverified; elsewhere it requires consent and a successful country lookup.

These identifier-free statistics rely on our legitimate interest in improving the site (GDPR Art. 6(1)(f)) and on national exemptions for audience measurement. Server counts record only a published page and a daily total, not people; bots and repeat requests may count. Browser measurement adds section views and active seconds solely to improve this site, without IDs, fingerprints, form values or individual histories. Cloudflare immediately aggregates increments and retains counters for 30 days. Completed daily page groups with at least five deliveries or views may be exported as totals to PostHog EU for up to one year, never joined to visitor profiles. Refusal, GPC or DNT stops optional measurement; received totals cannot be selectively erased. Your choice is stored for 180 days in localStorage and in a Secure first-party synt_measurement cookie containing only on/off, so the server can honor it on later requests. Existing local-only choices are synchronized when the page loads. Essential hosting and security processing continues separately. If you pause the homepage animation, only that preference is stored in localStorage (synt_motion) until you play it again; it contains no identifier.