Privacy Notice 

(Last updated: September 14, 2026) 

This privacy notice provides information, pursuant to Article 13 of the General Data Protection Regulation (GDPR), on the processing of personal data in connection with the use of the website www.syn2core.com (hereinafter “Website”) by Syn2core GmbH as the controller. Syn2core GmbH processes personal data strictly to the extent necessary for the provision, security, and operation of the Website and its services, adhering to the principle of data minimization. “Personal data” within the meaning of Article 4(1) GDPR refers to any information relating to an identified or identifiable natural person (data subject), such as name, address, telephone number, date of birth, email address, or IP address. Information that cannot be linked to a specific individual, for example as a result of anonymization, is not considered personal data. 

1. Controller 

The controller for the processing of personal data on the website within the meaning of the General Data Protection Regulation (GDPR) is: 

Syn2core GmbH 

Tegernseer Landstr. 103 

81539 München 

E-Mail-Adresse 

For data protection inquiries or to exercise your data subject rights, please contact privacy@syn2core.com. 

2. Data Protection Officer 

The following person has been appointed as Data Protection Officer: 

Kertos GmbH 

Brienner Straße 41 

80333 Munich 

Germany 

Email: dsb@kertos.io 

3. Data Processing on Our Website 

3.1 Provision of the Website 

Purpose of processing: 

We process your data in order to 

  • ensure the reliable operation of the website 
  • provide user-friendly access to our website 
  • and maintain IT security 

Recipients: Bluehost Inc., 10 Corporate Drive, Suite 300, Burlington, MA 01803, USA 

Data processed: 

  • IP address of the requesting device 
  • Method (e.g., GET, POST), date and time of the request 
  • Address of the accessed website and path of the requested file 
  • if applicable, previously accessed or requested website/file (HTTP referer) 
  • Information regarding the browser and operating system used 
  • Version of the HTTP protocol, HTTP status code, size of the delivered file 
  • Request information such as language, content type, content encoding, character encodings 

Legal basis: Article 6(1)(f) GDPR. The processing of the specified data is necessary to provide the website and to ensure secure and user-friendly operation. 

Retention period: The collected data will be deleted as soon as it is no longer required for the operation of the website, but no later than 30 days, unless a statutory retention obligation applies. 

Further information: https://www.bluehost.com/privacy-policy 

3.2 Contact 

Purpose: To process and respond to your inquiry. 

Data processed: 

  • Name 
  • Email address 
  • Content of your message 

Legal basis: Article 6(1)(f) GDPR (legitimate interest in communicating with you). If your inquiry is aimed at concluding or performing a contract, processing is carried out on the basis of Article 6(1)(b) GDPR. 

Retention period: Your data will only be stored for as long as necessary to fully process your inquiry. 

4 International Data Transfers 

Personal data is primarily processed within the EU/EEA. Transfers to so-called “third countries” only occur in compliance with the requirements of the GDPR and where suitable safeguards are in place. Before data is transferred to a service provider in a third country, the level of data protection is assessed. A transfer only takes place if sufficient protection mechanisms exist. All service providers must enter into a data processing agreement. For providers outside the EEA, additional measures are required. Pursuant to Articles 44 et seq. GDPR, a transfer is only permitted if at least one of the following requirements is met: 

  • The European Commission has determined that an adequate level of data protection exists. 
  • Standard Contractual Clauses have been concluded with the recipient. 
  • Other appropriate safeguards pursuant to Article 46 GDPR are in place. 
  • In certain exceptional cases as set out in Article 49 GDPR. 

5 Recipients 

Personal data collected by us will only be disclosed if: 

  • you have given us your explicit consent pursuant to Article 6(1)(a) GDPR; 
  • the disclosure is necessary to safeguard our legitimate interests or for the establishment, exercise, or defence of legal claims, and there is no reason to assume 

that your interests or fundamental rights and freedoms which require the protection of personal data override those interests (Article 6(1)(f) GDPR); 

• we are legally obliged to disclose the data (Article 6(1)(c) GDPR); or 

• such disclosure is lawful and necessary for the performance of a contract with you or for the implementation of pre-contractual measures at your request (Article 6(1)(b) GDPR). 

Possible recipients include: 

• Processors: Group companies or external service providers (e.g., for technical infrastructure and processing, maintenance, payment processing) that are carefully selected and monitored. Processors may only process data in accordance with our instructions. 

• Public authorities: Government agencies and public institutions (e.g., tax authorities, public prosecutors, courts) to whom we are required to transfer personal data, for example to comply with legal obligations or to protect legitimate interests. 

6 Data Security and Safeguards 

We implement appropriate technical and organizational measures to ensure the security and confidentiality of your personal data. These measures are designed to protect against unauthorized access, manipulation, loss, or misuse. Our security measures are regularly reviewed and adapted to reflect technological advancements and current industry standards. 

Please note that despite extensive protective measures, data transmission over the internet may involve security vulnerabilities. In particular, unencrypted communication (e.g., standard email) carries the risk that data may be accessed by third parties. We have no influence over the actions of external parties. We therefore recommend that you use encryption or other protective measures when transmitting sensitive information electronically to minimize potential risks. 

4. Retention and Erasure/Blocking of Data 

Personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Further storage will only take place if required by European Union or national legal provisions to which the controller is subject. Data will also be deleted or blocked once a statutory retention period expires, unless continued storage is necessary for the performance of a contractual relationship. 

7 Data Subject Rights 

You have the following rights with regard to your personal data: 

  1. Right of access (Article 15 GDPR, Section 34 BDSG): You may request information as to whether and which personal data we process, for what purpose, to whom or to which categories of recipients the data is disclosed, and how long it is stored. 
  2. Right to rectification (Article 16 GDPR): You may request the immediate rectification of inaccurate personal data or the completion of incomplete personal data. 
  3. Right to erasure (Article 17 GDPR): You may request the erasure of your personal data, in particular if it is no longer necessary, you withdraw your consent, or the data has been unlawfully processed. 
  4. Right to restriction of processing (Article 18 GDPR): You may request the restriction of the processing of your data, for example if the accuracy of the data is contested. 
  1. Right to data portability (Article 20 GDPR): You have the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request the transfer of this data to another controller, where technically feasible. 
  2. Right to withdraw consent (Article 7(3) GDPR): You may withdraw any consent given at any time with effect for the future. The lawfulness of processing up to the point of withdrawal remains unaffected. 

Right to object (Article 21 GDPR): You may object at any time to the processing of your personal data for reasons relating to your particular situation, especially in the context of direct marketing or any related profiling. 

Right to lodge a complaint with a supervisory authority (Article 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection regulations. 

8 Privacy Notice Section: Syn2core Mobile Application

X. Data Processing in Connection with the Syn2core Stream Mobile Application

This section provides information on the processing of personal data in connection with the Syn2core Stream mobile application (hereinafter “App”). The App is distributed exclusively to enterprise customers of Syn2core GmbH via managed Google Play and is operated on company-managed Android devices in production environments.

X.1 Purpose and Functioning of the App

The App acts as a gateway between smart glasses and a backend system operated by the respective enterprise customer. The smart glasses are connected to the Android device via USB-C cable. The App transmits the data captured by the smart glasses over an encrypted connection (WebRTC) via WiFi to the customer’s backend system, where it is analyzed for the purpose of real-time detection of errors and anomalies in the production process.

The App transmits data while running in the background. Active transmission is indicated on the Android device by a persistent notification and by the status displays “Connected & Glasses Ready” and “Streaming” within the App. No video, audio, or sensor data is stored on the Android device itself. The App does not access or use the camera or microphone of the Android device; all recordings originate exclusively from the connected smart glasses.

X.2 Data Processed

  • Video recordings captured by the connected smart glasses. These show the wearer’s field of view and may include other persons present in the production environment.
  • Audio recordings captured by the connected smart glasses. These may include the voices of the wearer and of other persons present.
  • Motion and orientation data (IMU sensor data) from the smart glasses.
  • Device identifiers of the smart glasses and/or the Android device, used to attribute the data stream to the correct device.
  • Configuration and usage events relating to the streaming connection (for example, changes to streaming parameters such as bitrate), together with the associated device identifier.
  • Connection metadata technically required to establish and operate the streaming connection (e.g., IP address, session information, timestamps).

Prior to storage, recordings are processed to substantially reduce the identifiability of persons: faces appearing in video recordings are automatically masked, and segments containing human voice are removed from audio recordings.

X.3 Recipients

The data is transmitted directly to the backend system operated by (or on behalf of) the respective enterprise customer for whose deployment the App is used. 

X.4 Roles and Legal Basis

The App is deployed on behalf of our enterprise customers. The respective enterprise customer, typically the employer of the persons using the App, is the controller within the meaning of Article 4(7) GDPR for the personal data processed through the App. Syn2core GmbH acts as a processor pursuant to Article 28 GDPR on the basis of a data processing agreement concluded with the customer.

For information on the legal basis of the processing, applicable retention periods, and the exercise of your data subject rights in relation to this processing, please refer to the privacy information provided by your employer or the respective controller.

X.5 Retention Period

Recordings and associated data are stored on the backend system of the respective enterprise customer following analysis. The retention period is determined by the respective enterprise customer as controller. No data is retained on the Android device. Connection and operational data processed by Syn2core GmbH is retained only as long as required for operating and securing the service and is deleted routinely thereafter.

X.6 International Data Transfers

The backend system is operated on-premise by the respective enterprise customer at its own facilities. Data processed through the App therefore remains within the country or region of the respective deployment and is not transferred by Syn2core GmbH to third countries. Any transfer to third countries by the enterprise customer as controller is the responsibility of that customer.

X.7 Persons Present in the Production Environment

The smart glasses capture the wearer’s field of view. Persons present in the production environment may therefore appear in video and audio recordings. The respective enterprise customer, as operator of the production facility and controller, is responsible for informing persons present about the use of the system in accordance with Articles 13 and 14 GDPR.

X.8 Data Subject Rights

The rights set out in Section X.7 of this privacy notice apply. As Syn2core GmbH acts as a processor, please direct requests concerning data processed through the App to the respective controller (your employer or the operator of the deployment). You may also contact us at privacy@syn2core.com; we will forward your request to the responsible controller without undue delay and support its handling in accordance with Article 28(3)(e) GDPR.

Change history Date Version Reason 
06.10.2025 1.0 First version of the revised privacy notice in the new format. 
14.09.20261.1Additional section on mobile app