Syntrio-Leader in Compliance Training, Comprehensive Ethics Hotlines and Employee Reporting
Syntrio-Leader in Compliance Training, Comprehensive Ethics Hotlines and Employee Reporting

Privacy Policy

July 2023 (v9)

Syntrio, Inc. Privacy Policy

July 2023 (v9)

This updates Syntrio, Inc.’s privacy policy.

Introduction

Syntrio has provided eLearning content and anonymous hotline services/products to its customers for over twenty years. This Privacy Policy covers all products/services offered by Syntrio and its divisions. Any reference to “Syntrio” represents Syntrio and its divisions.

This Policy relates to Personal Information (i.e., information that identifies a specific individual) and related data that Syntrio, Inc. (“Syntrio”) collects or otherwise receives, through its website, directly from customers, and through other means. It does not include Syntrio Human Resources information.

The Federal Trade Commission has jurisdiction over Syntrio’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

Notice

Syntrio collects and otherwise receives the following types of Personal Information and related data:

  • Customer Service: Syntrio receives directly from business customers Personal Information related to their employees and third parties through its learning management system (LMS) and online courses. This data may include: name, email, employee number, department, function, and other non-sensitive Personally Identifiable Information (PII) pertaining to an employee’s demographic characteristics. In addition, Syntrio records certain education information such as employee course completion, course bookmark, course quiz score, course review, and other data that enables the customer to understand their employees’ performance and to help Syntrio improve its course quality.
  • Syntrio receives and processes anonymous hotline reports. The information contained on an anonymous hotline report may contain PPI. Anonymous hotline report information can contain name, email, employee information, and complainant details regarding the incident being reported.
  • Customers may directly input PII, including Sensitive PII, into the Case Management System at their own discretion. Syntrio does not collect this information on behalf of the customer. Syntrio staff may access this information for technical maintenance purposes only. This staff has signed confidentiality agreements with respect to protection and non-disclosure of this information.
  • Marketing: Syntrio subscribes to various services that provide individuals’ names, titles, business email addresses, and other contact information of prospective and current customers for marketing purposes. Syntrio gathers customer and prospect names, telephone numbers, email addresses, and related contact information at trade shows and other events. Syntrio gathers the above contact information from visitors to our website when these individuals provide this data to us directly.

Syntrio complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Syntrio has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Syntrio has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) compliance not resolved by any of the other mechanisms. The following link provides additional information regarding binding arbitration:

https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2

Onward Transfers of Data

Syntrio provides Personal Information to the following types of third parties for the identified purposes to:

A. Business partners, serving as sub-processors, to assist us in delivering our products and services to customers. This data is not accessible by the third party under contract.

In transferring Personal Information to these parties as sub-processors, we:

      • Only provide data for limited and specific purposes related to delivering our products and services or other Company operations;
      • Ascertain that the sub-processor’s policies maintain a commensurate level of compliance regarding this data.
      • Take reasonable steps to ensure the sub-processor effectively processes this data in a manner consistent with our duties under the Principles;
      • Require the sub-processor to notify us if it makes a determination that it can no longer meet obligation commensurate with the Principles; upon such notice, we take reasonable steps to stop and remediate unauthorized processing;
      • Will provide a summary or a representative copy of relevant privacy provisions of our contract with that agent to the U.S. Department of Commerce upon request.

B. Business partners for co-marketing purposes (where we market to their customers and they market to our customers).

In transferring Personal Information to these parties as data controllers, we seek to:

      • Only transfer data for limited and specified purpose;
      • Determine that the organization is obligated to provide at least the same level of privacy protection as is required of Syntrio;
      • Take reasonable steps to ensure the organization effectively processes Personal Information in a manner consistent with Syntrio’s data privacy duties;
      • Expect the organization to notify us if it makes a determination that it can no longer meet its data protection obligation; upon notice, take reasonable steps to stop and remediate unauthorized processing;
      • Provide a summary or a representative copy of relevant privacy provisions of our contract with that organization or our third-party partners’ policies to the U.S. Department of Commerce upon request.

Syntrio does not provide its third-party Processors with personal information. However, Syntrio remains liable under the Data Privacy Frameworks if Syntrio’s third-party Processor onward transfer recipients process relevant Personal Data in a manner inconsistent with the Data Privacy Frameworks’ Principles, unless Syntrio proves that it is not responsible for the event giving rise to the damage.

Choice

Individuals from whom Syntrio collects and for whom it maintains Personal Information may limit use and disclosure of this Personal Information through the following:

  • To be disclosed to a third party, other than as an agent, or
  • To be used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by the individuals.

Syntrio provides opt-out mechanisms in related communications that allows individuals to remove themselves from future or unrelated communications. Individuals can always contact us directly to exercise their choice regarding these communications. Specifically, we provide an opt-out mechanism where we intend to share an email address with a third-party for a purpose other than that for which the Personal Information was collected.

Note that Syntrio must process certain Personal Information to provide its products and services to its customers. For example, Syntrio may need to provide product/service update information to fulfill the terms of its service. In such situations, no opt-out mechanism is available, other than cancelling the product or service.

For Sensitive Personal Information: If Syntrio collects Sensitive Personal Information, such as personal information specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual, we will provide an opt-in mechanism before using it or sharing it with third parties if such use would be for a purpose other than what it was intended for when initially collected.

Hotline Services

Related to the company’s hotline services, Syntrio collects information from clients’ employees and other related parties to report ethics and compliance violations. Information can be submitted to Syntrio via web form, facsimile, mail, email, text message, and telephonically. Syntrio may collect information from users automatically when they contact us, which may include the name of the domain and host from which the users access the Internet; the Internet protocol (IP) address of their computer; the type of browser and software operating system being used; web log data, including the date and time of access to our website; the Internet address of the website from which the user linked to our site; and the phone number which the user called from.

For most communications with Syntrio regarding its hotline services, we do not require PII. There are opportunities where the user will be given the option to provide PII. The information that may be provided by the user may include name, email address, telephone number, and address. Depending on the request and other circumstances, other information may also be collected. It is the user’s discretion and determination whether to provide such information.

Syntrio may disclose aggregated data and statistics in order to describe the use of our services to our prospective and existing clients, partners, and other third parties, and for other lawful purposes. Syntrio may disclose part or all of a user’s PII when Syntrio believes, in good faith, that the law requires such disclosure. Additionally, Syntrio is required to disclose PII in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

In most cases, Syntrio does not require a user to provide PII to use our services. By choosing to provide PII, the user agrees to the terms of this Privacy Policy.

Syntrio does not share any specific user information outside of Syntrio.

Anonymous Website Data

Syntrio uses tracking technologies on its website to provide our visitors with certain features, to better understand how visitors use our website, and to advertise to visitors, sometimes through relationships with third parties, such as Google or Yahoo. Our website visitors are able to control certain tracking technologies through their own browsers they use to visit our website.

External Links

Syntrio’s website may provide links to other organizations’ websites. Syntrio is not responsible for these organizations’ privacy practices or their website content

Security

Syntrio takes reasonable and appropriate measures to protect Personal Information that it creates, maintains, uses, or disseminates from loss, misuse, and unauthorized access, disclosure, alteration, and destruction, taking into due account the risks involved in the processing and the nature of the personal data.

Data Integrity and Purpose Limitation

Data Processing

Personal Information is limited to information that is relevant for the purposes of processing.

Syntrio strives not to process personal information in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by the individual. To the extent necessary for those purposes, Syntrio takes reasonable steps to ensure that Personal Information is reliable for its intended use, accurate, complete, and current. Syntrio adheres to the Principles for as long as it retains such information.

Data Retention

Syntrio retains Personal Information in a form identifying or making identifiable the individual only for as long as it serves the purpose of processing. Syntrio takes reasonable and appropriate measures in complying with this provision.

Syntrio seeks to maintain the accuracy, completeness, and relevance of Personal Information it maintains. It provides individuals subject to this data with an opportunity to review their Personal Information, upon request, to ensure that it is accurate, complete, current, timely, and reliable for its intended use. The Company will work with these individuals to ensure Personal Information meets these objectives.

Access

Syntrio provides individuals with Personal Information that the Company maintains with an opportunity to review their Personal Information, upon request, to ensure that it is accurate, complete, current, timely, and reliable for its intended use, and make corrections, as warranted. In certain instances, the Company may charge a fee for this service, provided that the fee is not excessive.

Individuals also can raise any complaints regarding the Company’s data privacy practices as follows. The Company will respond within a reasonable time to any request or complaint, not to exceed 45 days. Individuals can contact the following regarding any questions or complaints regarding their Personal Information: · https://www.syntrio.com/success-center/

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Syntrio commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Syntrio at: https://www.syntrio.com/success-center/

Policy Changes

Syntrio may change this policy to remain consistent with governing law and other good practices of data privacy protection. When changes are made to this Policy, the company will communicate these changes to all employees, update it on the Company’s website and maintain a copy of the previous privacy policies. The Company will also notify customers of any material changes to this policy to allow them to make any choices of how we will use their Personal Information going forward.

Recourse, Enforcement, and Liability

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Syntrio commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to Judicial Arbitration and Mediation Services, Inc., an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit www.jamsadr.com for more information or to file a complaint. The services of Judicial Arbitration and Mediation Services, Inc. are provided at no cost to you.

Syntrio may be required to disclose Personal Information in response to a lawful request by public authorities, including to meet national security or law enforcement requirements.

Syntrio has further committed to refer unresolved privacy complaints to an independent dispute resolution mechanism provided above.

If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit the independent dispute resolution service provide listed above for more information and to file a complaint.

Self-Certification

Syntrio will assess its adherence to its privacy policies annually. This assessment will include the following:

  • A review of Syntrio privacy policies for ongoing conformance with applicable law.
  • Review of the Personal Data that Syntrio collects and means of collecting this data.
  • Inclusion of mechanisms, and related communications, so that individuals can review their Personal Data, correct it, ask questions, or file a complaint.
  • Training for Syntrio employees, based on their degree of involvement with Personal Data.

Business Transfer

If Syntrio should undergo a business transfer, such as a merger, acquisition, divestiture, or other such action, that will likely lead to Personal Information being transferred to a new entity, the Company will provide a notification on our website of any change in ownership or uses of this Personal Information, as well as any choices related parties may have regarding this Personal Information.

Syntrio Inc. complies with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom (and Gibraltar), and Switzerland to the United States. Syntrio Inc. has certified to the U.S. Department of Commerce that it adheres to these Data Privacy Framework Principles. If there is any conflict between the terms in this privacy policy and these Data Privacy Framework Principles, the Data Privacy Framework Principles shall govern. To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/s/

This Privacy Policy supersedes a prior Privacy Policy dated May 2021. You can contact Syntrio to learn more about updates included in this Privacy Policy.

Enter your keyword