Privacy Policy
This Privacy Policy explains how Syott Limited ("Syott", "we", "us") handles personal data when you visit syott.co, get in touch with us, apply for a job with us, or manage a customer account. It also explains the choices and rights you have.
Who we are
Syott Limited is a company registered in Ireland (CRO No. 808411), with its registered office at Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland.
For the personal data described in this policy, Syott is the controller. You can contact us about privacy at privacy@syott.co.
Data inside our products
Syott HR, Syott Recruit and Syott Company OS (currently in private beta) are used by organisations to manage their own people and hiring. The personal data an organisation puts into its Syott account is controlled by that organisation, and we process it on its behalf under our agreement with it. This policy doesn't cover that data.
If you're an employee or candidate of an organisation that uses Syott, please contact that organisation about your data. If you contact us instead, we'll refer your request to it and help it respond.
What we collect and why
When you browse our website
Our servers record technical details of each request: your IP address, browser and device type (user agent), the page requested, the referring page, and the date and time. We use them to deliver the site, keep it secure, prevent abuse and fix problems. We also use Dash0 to monitor the performance and errors of our servers, and the request data it receives can include the same details.
We also use a few cookies to remember your preferences, such as your language and the country or region you picked. See our Cookie Policy.
Legal basis: our legitimate interests in running a secure website that works properly.
When you contact us, book a demo or talk to sales
When you use our contact form or the "Talk to sales" and "Book a demo" forms, we collect your name, email address, company, company size, the reason you're getting in touch, your message (and, if you're applying for a job, the role), and the page and language you sent the form from. We also record the IP address and browser details the form was sent from, so we can detect spam and abuse. We keep this in our own customer relationship management (CRM) system.
We use it to reply to you, arrange a demo or pilot, follow up on your enquiry and keep a record of our conversation. The required fields are needed to handle your enquiry; the others are optional. We don't add you to marketing mailing lists unless you sign up for them.
Legal basis: our legitimate interests in responding to and following up on business enquiries; and, where you ask about becoming a customer, taking the steps you've asked for before entering into a contract.
When our forms check that you're not a bot
Our forms are protected by Cloudflare Turnstile, which loads when you start filling a form in. It checks signals such as your IP address, browser details and TLS fingerprint to tell people apart from automated abuse. Cloudflare also uses these signals to improve Turnstile, as described in its Turnstile Privacy Addendum.
Legal basis: our legitimate interests in protecting our forms and systems from spam and abuse.
When you apply for a job
If you apply through our website, by email or through a recruiter working with us, we collect the information you choose to share — typically your name, contact details, CV, the role you're interested in and your message — together with notes and results from interviews and assessments. If someone refers you, we receive your details from them. If you tell us about a health condition or disability so that we can make an adjustment, we use that information only for that purpose.
We use this information to assess your application, communicate with you and make hiring decisions. There is more detail in our Application Terms.
Legal basis: taking steps at your request before entering into an employment contract; our legitimate interests in recruiting; and our legal obligations, for example checking your right to work.
When your organisation is a Syott customer
We use the business contact details of the people who manage a customer account — such as account administrators and billing contacts — to provide our services, send service and security messages, invoice and take payment (payments are processed by Stripe), and provide support.
Legal basis: performing our contract with the customer; our legitimate interests in managing the customer relationship; and our legal obligations, such as keeping accounting records.
When you use our support chat
If you allow support chat, our website loads the Intercom Messenger. Once loaded, it receives information about your browser, device, approximate location and the pages you view. If you start a conversation, Intercom also processes your messages and anything you share in them. Intercom stores this data in the United States.
Legal basis: your consent to load the chat; and our legitimate interests in answering your questions.
Analytics and session recordings
If you allow them, we use:
- PostHog for analytics: pages viewed, clicks, scroll depth, device and browser type, and approximate location based on your IP address. This data is sent through our own domain (a.syott.co) to PostHog's EU cloud.
- Dash0 to measure how quickly pages load in your browser and whether errors occur.
- PostHog session replay and Microsoft Clarity to record how visitors move through our pages — mouse movements, clicks and scrolling — and to create heatmaps. These tools are set up to mask what you type into form fields. Microsoft processes Clarity data in the United States and also uses it for its own purposes, as described in the Microsoft Privacy Statement.
We look at this information in aggregate to understand how our website is used and to improve it. We don't use it to identify you. Not every tool is necessarily active at any given time; the consent panel lists the tools in use.
Legal basis: your consent. In regions where these tools may be switched on by default (see our Cookie Policy), our legitimate interests in improving our website — you can switch them off at any time.
When you make a cookie choice
When you make or change a cookie choice, we record a random consent ID, the categories you chose, the version of the banner you saw, whether you chose in the banner or in Cookie Settings, your language, the type of privacy rules that apply where you are, and the date and time. The record doesn't include your name or email address. We keep it so that we can show we asked for, and respected, your choice.
Legal basis: our legal obligation to be able to demonstrate consent.
Complaints, requests and security reports
If you make a complaint, exercise your data protection rights or report a security issue, we use what you tell us to deal with it and to keep a record of how we handled it.
Legal basis: our legal obligations, and our legitimate interests in resolving issues and defending legal claims.
How long we keep it
| Data | How long we keep it |
|---|---|
| Server logs (IP address, browser details, pages requested) | 6 months |
| Server performance monitoring data (Dash0) | 30 days |
| Contact, sales and demo enquiries | Up to 24 months after our last contact with you, unless you become a customer |
| Job applications | 12 months after the hiring process ends, unless you agree to us keeping yours for future roles |
| Customer account and billing records | For the duration of the customer relationship and up to 6 years after it ends |
| Support chat conversations | Up to 24 months after the conversation ends |
| Analytics data and session recordings | Up to 13 months |
| Cookie consent records | 6 months |
| Complaints | 6 years after the complaint is closed |
| Data protection requests and security reports | 3 years after they are closed |
When a period ends, we delete the data or anonymise it so that it no longer identifies you. We may keep data for longer if the law requires it or if we need it for a legal claim.
Who we share it with
We share personal data only where we need to:
- Service providers that host our website and systems or provide the tools described above. They act on our instructions, under contracts that protect your data. The current list is on our Subprocessors page.
- Professional advisers, such as lawyers, accountants and insurers, who are bound by confidentiality.
- Authorities, regulators and courts, where the law requires it or where we need to establish, exercise or defend legal claims.
- A buyer or investor, if Syott or its business is reorganised, sold or financed, subject to confidentiality.
We don't sell personal data. We don't use advertising networks or social media tracking pixels on our website.
International transfers
We host our website and our own systems with Amazon Web Services in Ireland. Some of our providers process data outside the European Economic Area (EEA): Microsoft Clarity and Intercom in the United States, and Cloudflare on its global network. Other providers keep data in the EU but belong to groups based outside the EEA.
Where personal data leaves the EEA, we rely on an adequacy decision of the European Commission (for example, the EU-US Data Privacy Framework, for providers certified under it) or on the Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for more information about these safeguards.
How we protect it
We use technical and organisational measures appropriate to the risk, including encryption in transit, access limited to the people who need it, and monitoring of our systems. No system is completely secure, so if you think something is wrong, please tell us at security@syott.co.
Your rights
You have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate or incomplete data corrected;
- have your data erased;
- restrict how we use your data;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- receive the data you gave us in a portable format;
- withdraw your consent at any time, without affecting processing that took place before you withdrew it; and
- not be subject to decisions based solely on automated processing that significantly affect you. We don't make decisions of this kind.
To use these rights, see GDPR Data Requests or email privacy@syott.co. We respond within one month. You can change your cookie choices at any time through Cookie Settings in the footer of our website.
You also have the right to complain to a data protection authority. Our lead supervisory authority is the Data Protection Commission in Ireland (www.dataprotection.ie), and you can also contact the authority where you live or work. We would appreciate the chance to deal with your concern first.
If you live in the United States, see US Privacy Rights.
Children
Our website and products are designed for businesses and aren't directed at children. We don't knowingly collect personal data from anyone under 16. If you think a child has given us personal data, please contact us and we'll delete it.
Changes to this policy
We update this policy when our practices change. The date at the top of this page shows when it was last updated. If we make significant changes, we'll also highlight them on our website.
Contact
Syott Limited, Privacy, Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland. Email: privacy@syott.co.