Privacy Policy

Last updated: 2026-03-29

This policy describes how BIModular EIRL (“we”, “us”) processes personal data when you use the BOMSync platform. It is designed to meet transparency requirements under the GDPR (EU) and, where applicable, the UK GDPR.

1. Controller

BIModular EIRL, 75007 Paris France, privacy@BOMSync.com, is the data controller for personal data processed via BOMSync.

2. What we collect

• Account data: name, email, company, role.
• Usage/technical data: logs, device/browser info, IP address (security, fraud prevention, and service operation).
• Customer Data: project/BOM content you or your organization upload (processed under your instructions when you are the controller).
• Communications data: email/SMS/chat metadata (timestamps, delivery status, sender/recipient) when we send notifications primarily via Azure Communication Services (“ACS”). Legacy SMTP may apply only when ACS is not configured (for example, some local development setups).

3. Purposes & legal bases (GDPR / UK GDPR)

• Provide and secure the service (Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interests in security).
• Account management, support, billing (Art. 6(1)(b)).
• Transactional communications (password resets, invitations, security alerts) via ACS in production, or SMTP only when ACS is not configured (Art. 6(1)(b),(f)).
• Improve features and analytics using aggregated or pseudonymised data where possible (Art. 6(1)(f)).
• Legal compliance and enforcement (Art. 6(1)(c) legal obligation; Art. 6(1)(f)).

4. Sharing

We share personal data with processors under contract (Article 28 GDPR), including:

• Microsoft Azure & Azure Communication Services (EU regions where feasible; global fallback) for hosting, storage, logging, and email/SMS/chat delivery.
• Stripe for payment processing, subscriptions, and Checkout (see DPA Schedule B).
• Other support or monitoring tools as necessary (listed in our Data Processing Addendum sub-processor schedule).

We do not sell personal data.

5. International transfers

Where personal data is transferred outside the EEA or UK, we rely on appropriate safeguards under GDPR Chapter V and UK law (e.g., EU Standard Contractual Clauses, UK International Data Transfer Agreement / Addendum, adequacy decisions). Details of sub-processors and safeguards are described in the DPA.

6. Retention

We retain personal data only as long as needed for the purposes above or to meet legal obligations. Communications metadata may be retained for deliverability, fraud prevention, and audit.

7. Your rights

If the GDPR or UK GDPR applies, you may request access, rectification, erasure, restriction of processing, data portability, and may object to certain processing. You may lodge a complaint with a supervisory authority—for example, the CNIL in France or the ICO in the United Kingdom, depending on your place of residence.

To exercise rights: privacy@BOMSync.com.

8. Security

We maintain appropriate technical and organizational measures (encryption in transit and at rest where appropriate, access controls, logging). No method of transmission or storage is completely secure.

9. Cookies & similar technologies

We use necessary cookies for authentication and session management. Where we use optional analytics or non-essential cookies, we do so in line with applicable consent requirements.

10. Sub-processors

Our current sub-processors are listed in the Data Processing Addendum and include Microsoft Azure, Azure Communication Services, Syncfusion, Stripe, and others as updated on that page.

11. Children

The service is not directed to children under 16.

12. Changes

We may update this policy; material changes will be notified in-app or by email where appropriate.

13. Contact

privacy@BOMSync.com · BIModular EIRL, 75007 Paris France.