Data Processing Agreement
Last updated: October 27, 2026
This Data Processing Agreement (the “Agreement”) governs the processing of personal data carried out by sincrona on behalf of a Workshop in connection with the provision of the sincrona service.
This Agreement forms part of the contractual terms applicable to Workshops’ use of sincrona and shall be interpreted in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and any other applicable personal data protection legislation.
1. Parties and purpose of the Agreement
1.1. Data Controller
The data controller (the “Controller”) is the natural or legal person that uses sincrona to manage personal information relating to its customers in the course of its bicycle workshop business (the “Workshop”).
The Workshop determines the purposes and essential means of processing personal data relating to its customers and is responsible for ensuring that such processing has a valid legal basis and complies with applicable law.
1.2. Data Processor
The data processor (the “Processor”) is:
- Legal holder: Pablo Caraballo Llorente.
- Address: Madrid, Spain.
- Email: hola@sincrona.cc.
- Service: sincrona, accessible through the domains sincrona.cc and app.sincrona.cc, and its associated services.
The Processor provides a digital service designed to help bicycle workshops manage customers, bicycles, cycling activities and maintenance services.
1.3. Purpose
The purpose of this Agreement is to establish the conditions under which the Processor will process personal data on behalf of the Controller to provide the sincrona service, in accordance with Article 28 of the GDPR.
This Agreement applies exclusively to processing activities for which the Workshop acts as Controller and sincrona acts as Processor. It does not alter either party’s status as an independent controller in respect of other processing activities carried out for its own purposes.
2. Acceptance and duration
2.1. Acceptance
This Agreement becomes binding when the Workshop accepts sincrona’s Terms and Conditions incorporating this Agreement by reference, or when both parties expressly execute it in writing.
The Agreement must have been accepted before the Processor begins processing personal data relating to the Workshop’s Riders on its behalf.
The Workshop must not invite actual Riders or enter their personal data into the service until this Agreement has taken effect.
2.2. Duration
This Agreement shall remain in force for the entire duration of the contractual relationship during which the Processor processes personal data on behalf of the Controller.
Termination of this Agreement shall not release either party from obligations that, by their nature or by operation of law, must survive termination, including obligations relating to confidentiality, security, and the deletion or return of data.
3. Description of the processing
In accordance with Article 28(3) of the GDPR, the processing has the following characteristics.
3.1. Subject matter and nature
The processing includes the operations necessary to host, organize, access, record, modify, synchronize, technically analyze, use and, where appropriate, delete personal data associated with Riders and their relationship with the Workshop.
These operations are carried out through the functionalities available in sincrona, including those used to manage bicycles, record maintenance services, access cycling activities imported from external providers, and generate maintenance estimates or notifications.
3.2. Purpose
The purpose of the processing is to enable the Workshop to manage its relationship with Riders and provide bicycle maintenance services through sincrona.
In particular, processing may be necessary to:
- Manage the relationship between the Workshop and its Riders.
- Maintain Riders’ contact information.
- Record and access bicycles associated with each Rider.
- Import and access cycling activities from Connections with external Providers.
- Record Services performed on bicycles, including related documents and attachments.
- Calculate usage, wear and maintenance indicators.
- Generate service-related alerts and notifications.
- Maintain Riders’ communication preferences.
- Provide technical support, ensure security and maintain the operation of the service.
The Processor shall not use personal data processed on behalf of the Controller for purposes incompatible with the Controller’s documented instructions.
3.3. Types of personal data
The personal data subject to processing may include:
- Identification and contact data: first name, last name, email address, telephone number and international dialing code.
- Bicycle-related data: information associated with bicycles linked to a Rider, including identifiers, name, type, components and technical characteristics.
- Cycling activity data: dates, distances, duration, the bicycle associated with each activity and other technical data imported through a Connection with a Provider.
- Maintenance data: Services performed, dates, mileage, components, observations, notes, and related documentation, images or other attachments.
- Communication preferences: enabled channels, notification preferences and data necessary to manage those preferences.
- Technical service data: account or relationship identifiers and operation logs necessary to provide, maintain and protect the contracted functionalities, where linked to an identified or identifiable person.
The specific data processed will depend on the functionalities used and the information entered or enabled by the Controller.
The Controller shall not enter unnecessary personal data or special categories of personal data into notes, observations or attachments. If processing special categories of personal data is exceptionally necessary, the Controller must ensure that a valid condition under Article 9 of the GDPR applies and that the processing is duly authorized and protected.
3.4. Categories of data subjects
The data subjects whose personal data may be processed are the Riders who have a relationship with the Workshop and whose data is managed by the Workshop through sincrona.
Data relating to the Workshop’s representatives, employees or other contacts does not fall within this category where sincrona processes such data to manage its own contractual relationship with the Workshop.
3.5. Documented instructions
The Controller’s instructions are established by this Agreement, the accepted Terms and Conditions, the functionalities contracted or enabled, the configuration maintained by the Workshop, and any additional instructions communicated by the Controller in writing.
The Processor shall process personal data in accordance with those instructions unless it is required to do so by applicable European Union or Member State law. In such cases, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such disclosure on important grounds of public interest.
The Processor shall inform the Controller if it considers that an instruction infringes the GDPR or another applicable personal data protection provision.
4. Processor obligations
The Processor undertakes to comply with the obligations set out in Article 28 of the GDPR and, in particular, the following.
4.1. Confidentiality
The Processor shall ensure that persons authorized to process personal data are bound by an appropriate duty of confidentiality, whether by contract or by law.
Access to data shall be limited to persons who need it to provide, maintain, secure or support the service, in accordance with their assigned responsibilities.
4.2. Security of processing
The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing.
These measures shall be established in accordance with Article 32 of the GDPR and may include, as appropriate:
- Access controls and authentication mechanisms.
- Restriction of permissions according to the principle of least privilege.
- Protection of communications and systems used to provide the service.
- Measures to preserve the confidentiality, integrity, availability and resilience of systems.
- Procedures to restore access to data following a physical or technical incident.
- Measures to detect, investigate and manage security incidents.
- Separation of identity data and operational information where appropriate.
- Periodic assessment of the effectiveness of security measures.
The Processor shall review and update these measures when necessary to maintain an appropriate level of protection. These measures do not guarantee that every security incident can be prevented.
4.3. Assistance to the Controller
The Processor shall provide reasonable assistance to the Controller in fulfilling its legal obligations relating to processing, taking into account the nature of the processing and the information available to the Processor.
In particular, the Processor shall assist the Controller with:
- Responding to data subject rights requests.
- Compliance with the security obligations under Articles 32 to 34 of the GDPR.
- Data protection impact assessments where required.
- Prior consultations with supervisory authorities where applicable.
- Providing information reasonably necessary to demonstrate compliance with this Agreement.
Where a Rider exercises a right directly with the Processor in relation to data processed on behalf of the Controller, the Processor shall forward the request to the Controller without undue delay and, where possible, within five business days of receipt. The Processor shall not respond on behalf of the Controller unless authorized to do so or required by applicable law.
Assistance shall be provided in light of the available functionalities and the information accessible to the Processor. Where a request requires extraordinary work outside the ordinary service, the parties may agree in advance on its scope and cost, without prejudice to any applicable legal obligations.
4.4. Personal data breaches
The Processor shall notify the Controller of any personal data breach affecting personal data processed on the Controller’s behalf as soon as possible and, where feasible, no later than 48 hours after becoming aware of the breach.
The notification shall include, to the extent the information is available:
- The nature of the breach and, where possible, the categories and approximate number of data subjects affected.
- The categories and approximate number of personal data records affected.
- The likely consequences of the breach.
- The measures taken or proposed to contain, investigate and mitigate its effects.
- Contact details for obtaining further information.
If all the information cannot be provided at the same time, the Processor shall provide it progressively and without undue delay as it becomes available.
The Processor shall reasonably cooperate with the Controller in investigating, containing and resolving the incident.
The Controller shall be responsible for determining and making, where required, the notifications to supervisory authorities and communications to data subjects under Articles 33 and 34 of the GDPR, with the Processor’s assistance.
4.5. Records and compliance
The Processor shall maintain the documentation and records required of it under the GDPR and shall provide the Controller with information reasonably necessary to demonstrate compliance with the obligations established in this Agreement.
4.6. Prohibition of other uses and artificial intelligence functionalities
The Processor shall not sell personal data processed on behalf of the Controller or use such data for its own purposes that are incompatible with the documented instructions.
The Processor shall not use personal data processed on behalf of the Controller to train artificial intelligence models or optimize algorithms using such data.
Certain service functionalities may use external artificial intelligence providers to process non-personal technical information. In particular, the bicycle classification functionality may transmit a bicycle’s name to Google Gemini to obtain its type or category.
This functionality is designed to use bicycle names and does not require the transmission of Riders’ personal data. The Processor shall not intentionally send Riders’ identification or contact details, cycling activities or maintenance history to this provider for that classification purpose.
The use of these providers shall be limited to the technical purposes intended for each functionality and shall be subject to the applicable contractual terms and safeguards. If a future functionality requires personal data to be transmitted to an artificial intelligence provider on behalf of the Controller, the Processor shall first assess the data protection implications and implement the applicable safeguards.
5. Sub-processors
5.1. General authorization
The Controller authorizes the Processor to engage sub-processors as necessary to provide the service, provided they comply with the conditions established in this section.
The Processor shall impose on each sub-processor, through a binding contract or other legal act, data protection obligations substantially equivalent to those set out in this Agreement, particularly regarding confidentiality, security, assistance, data deletion or return, and audits.
The Processor shall remain liable to the Controller for the performance of its sub-processors’ data protection obligations, as provided for in Article 28(4) of the GDPR.
5.2. List of sub-processors
The following providers support certain sincrona functionalities and may process personal data on behalf of the Controller, depending on the functionalities used and the service configuration.
| Provider | Purpose | Location |
|---|---|---|
| Auth0 | User identity management and authentication. | Tenant located in the European Union. |
| Brevo | Sending transactional emails and service-related communications. | Data hosted in the European Union. |
| Meta Platforms / WhatsApp | Sending notifications and communications through WhatsApp when the channel is enabled. | Data hosted in the European Union. |
| Google Gemini | Technical classification of bicycles based on their names, where the relevant functionality is used. | Data hosted in the European Union. |
The above list identifies the providers currently contemplated for these functions. Their inclusion as sub-processors applies exclusively to operations in which they act on behalf of the Processor and process personal data covered by this Agreement.
In particular, the bicycle classification functionality using Google Gemini is designed to transmit bicycle names and receive their type or category, without requiring the transmission of Riders’ personal data.
Strava and Garmin Connect may be used as external providers from which cycling activities are imported through a Connection, with read-only access to the Rider's data. Their use does not, by itself, mean that Strava or Garmin is a sub-processor of sincrona. Information imported from them may subsequently constitute personal data processed by the Processor on behalf of the Controller. Each party shall be responsible for the processing activities it carries out within its own sphere of responsibility.
The Processor shall keep this list updated when sub-processors are added, replaced or removed, in accordance with the procedure established in Section 5.3.
5.3. Addition and replacement of sub-processors
The Processor may add, replace or remove sub-processors when necessary to maintain or improve the service, provided that it complies with the conditions of this Agreement.
The Processor shall notify the Controller of any planned addition or replacement at least 15 calendar days in advance, using an appropriate electronic means, which may include an email notification or an announcement within the service.
The notification shall identify the provider, describe the purpose of the processing, and provide available information regarding the location of processing and applicable transfer safeguards.
The Controller may raise reasoned objections on personal data protection grounds within that period. Any objection must explain the specific risk that the new sub-processor may pose to GDPR compliance.
The parties shall attempt to resolve objections in good faith. The Processor shall consider reasonable alternatives where available. If no solution can be reached, either party may terminate the affected functionalities or contractual relationship in accordance with the applicable Terms and Conditions, without prejudice to its legal obligations.
Where a change must be implemented urgently for security, service continuity or legal reasons, the Processor shall inform the Controller as soon as reasonably possible and explain the reasons for the urgency.
6. International data transfers
The Processor shall use the providers and configurations described in Section 5.2, which contemplate data hosting within the European Union for the specified services.
Where processing involves access to personal data from a country outside the European Economic Area, disclosure to a recipient located in such a territory, or any other transfer subject to Chapter V of the GDPR, the Processor shall ensure that a valid transfer mechanism is in place.
Applicable safeguards may include, as appropriate:
- An adequacy decision adopted by the European Commission.
- Standard contractual clauses approved by the European Commission.
- Other appropriate safeguards under Article 46 of the GDPR.
- The derogations under Article 49 of the GDPR, only where applicable and where their requirements are met.
Where necessary, the Processor shall assess the circumstances of the transfer and implement appropriate supplementary measures to ensure a level of protection essentially equivalent to that required under European Union law.
Upon reasonable request, the Processor shall provide the Controller with information about the transfer mechanisms applicable to the processing covered by this Agreement.
A provider’s EU-based tenant or data hosting location does not necessarily mean that all support, remote access or processing activities by other providers take place within the European Economic Area. The Processor shall take these circumstances into account when assessing the applicable safeguards.
7. Data subject rights
The Controller shall be responsible for receiving, assessing and responding to requests from Riders to exercise their rights under the GDPR, including the rights of access, rectification, erasure, restriction, objection and data portability, where applicable.
The Processor shall provide the available functionalities and reasonably necessary assistance to enable the Controller to respond to such requests within the applicable legal deadlines.
The Processor shall not disclose personal data processed on behalf of the Controller to third parties or respond to access or deletion requests from persons other than the Controller, unless authorized to do so or required by law.
If the Processor receives a request from a Rider, it shall forward the request to the Controller in accordance with Section 4.3. If it receives a request from a competent authority, it shall act in accordance with applicable law and inform the Controller where legally permitted.
8. Audits and demonstration of compliance
The Processor shall make available to the Controller the information reasonably necessary to demonstrate compliance with the obligations established in Article 28 of the GDPR and shall allow audits and inspections by the Controller or an independent auditor authorized by the Controller, subject to the safeguards in this section.
Audits shall:
- Be requested at least 30 calendar days in advance, except where a relevant security incident, legal obligation or exceptional circumstance justifies a shorter notice period.
- Be conducted during normal business hours and within a scope proportionate to the processing covered by this Agreement.
- Respect the confidentiality of other customers’ information, trade secrets and system security.
- Avoid unnecessary disruption to service continuity and security.
- Be limited to information and systems relevant to verifying compliance with this Agreement.
Where reasonably sufficient, the Processor may provide security documentation, policies, certifications, supplier audit reports or other available evidence instead of an on-site or technical inspection.
The Controller shall bear the costs of its audits, unless a material breach attributable to the Processor is identified or applicable law provides otherwise.
Nothing in this section shall limit the investigative or inspection powers of competent supervisory authorities.
9. Controller obligations
The Controller undertakes to comply with the obligations applicable to it under the GDPR and, in particular, to:
- Determine the purposes and means of the processing carried out through sincrona.
- Ensure that a valid legal basis exists for processing personal data and making it available to the Processor.
- Provide data subjects with the information required under Articles 13 and 14 of the GDPR, as applicable.
- Ensure that personal data entered is adequate, relevant and limited to what is necessary.
- Maintain the accuracy of the data it enters and correct inaccurate data where appropriate.
- Respect data subjects’ rights and handle the requests for which it is responsible.
- Refrain from entering special categories of personal data or unnecessary information in notes, observations or attachments.
- Use the functionalities and configure communication preferences in accordance with applicable law.
- Inform the Processor of relevant processing instructions and any circumstances that may affect the lawfulness or security of processing.
- Cooperate with the Processor where necessary to comply with this Agreement.
The Controller shall be responsible for decisions relating to its relationship with Riders and for the obligations applicable to it as data controller.
10. Return and deletion of data
Upon termination of the services involving the processing of personal data on behalf of the Controller, the Controller may request the return of its personal data in a reasonably available format, provided that the return is technically feasible and compatible with the service functionalities.
Following termination of the contractual relationship, the Processor shall, at the Controller’s choice, delete or return the personal data processed on its behalf and delete existing copies, unless European Union or Member State law requires their retention.
If the Controller does not communicate its choice, the Processor may proceed to delete the personal data after a reasonable period for requesting its return has elapsed and the operations necessary to terminate the service have been completed.
Deletion shall take place within a reasonable period and, as a general rule, within a maximum of 30 calendar days from the effective termination date and completion of any applicable data return operations. Backup copies that cannot be selectively deleted may be retained until the end of the ordinary backup rotation cycle, with access restricted and without being reused for other purposes, until their deletion.
The Processor may retain data that it is legally required to keep or that is necessary to establish, exercise or defend legal claims. In such cases, processing shall be restricted to those purposes for the applicable retention period.
Deletion under this Agreement does not prevent the Processor from retaining information that has been effectively anonymized and can no longer identify data subjects, provided that its retention and use are lawful. Pseudonymization alone does not constitute anonymization.
11. Liability and cooperation
Each party shall be responsible for complying with the legal obligations applicable to it according to its role and the processing activities it carries out.
The parties shall cooperate in good faith to resolve matters relating to personal data protection and shall take reasonable measures necessary to comply with this Agreement.
The parties’ liability towards data subjects and supervisory authorities shall be determined in accordance with the GDPR and applicable law. Nothing in this Agreement shall exclude or limit any rights or obligations that cannot lawfully be excluded or limited.
12. Amendments to the Agreement
The Processor may update this Agreement where necessary to reflect changes to the service, processing operations, providers, security measures or applicable law.
Where an amendment materially affects the parties’ obligations or data protection safeguards, the Processor shall take reasonable steps to notify the Controller sufficiently in advance.
Amendments requiring express acceptance shall be subject to the applicable acceptance procedure. The Processor shall not use an update to this Agreement to reduce mandatory legal safeguards.
The current version of the Agreement shall be available on the relevant sincrona webpage.
13. Applicable law
This Agreement shall be governed by the GDPR, Spanish data protection legislation and any other applicable provisions.
Contractual matters not specifically addressed in this Agreement shall be governed by sincrona’s Terms and Conditions, to the extent that they are compatible with this Agreement and applicable data protection law.
14. Contact
For questions, instructions or communications relating to this Agreement, the Controller may contact the Processor at:
Pablo Caraballo Llorente
Email: hola@sincrona.cc
Madrid, Spain.