Legal
Privacy Policy
This policy explains what personal data Sylora collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It is written to be read, not to be endured.
Last updated 13 August 2026
01Who we are
Sylora (“Sylora”, “we”, “us”, “our”) is an email marketing agency. We work with direct to consumer brands across Europe, the United Kingdom and North America.
For personal data collected through this website and through our business correspondence, Sylora is the data controller. Where we work inside a client’s email platform, we normally act as a data processor on that client’s instructions (see section 5).
- Business name: Sylora
- Registered address: Kneza Miloša 50, Svilajnac, Serbia
- Contact for privacy matters: stevans93@gmail.com
We are established in Serbia. Because we offer services to people and businesses in the European Economic Area and the United Kingdom, we apply the EU General Data Protection Regulation (Regulation 2016/679) and the UK GDPR to that processing, alongside Serbia’s Law on Personal Data Protection (“Zakon o zaštiti podataka o ličnosti”).
We have not appointed a representative in the EU under Article 27 GDPR. Our processing of personal data relating to people in the EEA is occasional, is limited to business contact details and website analytics, does not involve special category data or criminal offence data, and is unlikely to result in a risk to rights and freedoms, so we rely on the exemption in Article 27(2) GDPR. You can always reach us directly at stevans93@gmail.com.
02Data we collect
We keep this deliberately small. We only collect what we need to answer you and to run the business.
Data you give us
- Contact and enquiry data - your name, business email address, company name, role, website, the platform you use, and whatever you choose to tell us about your email programme. This reaches us by email; this website has no contact form.
- Correspondence - the emails, messages, call notes, proposals and documents exchanged while we talk or work together.
- Contract and billing data - the details needed to invoice a client and keep proper accounting records, such as company name, billing address, tax identifiers and payment references. We do not receive or store card numbers.
Data collected automatically
- Technical data - IP address, browser and device type, operating system, referring page, and pages viewed. Our hosting provider processes this in server logs in order to serve the site securely and to detect abuse.
- Analytics data - aggregated usage statistics, and only if you consent to analytics cookies. See section 4.
We do not knowingly collect special category data (such as health, political or religious information), and we ask you not to send it to us. We do not buy personal data, and we do not scrape contact lists.
03Why we use it, and our legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Replying to your enquiry and preparing a proposal | Contact, enquiry, correspondence | Steps prior to entering a contract, Art. 6(1)(b); or legitimate interests in responding to business enquiries, Art. 6(1)(f) |
| Delivering our services and managing the engagement | Contact, correspondence, contract | Performance of a contract, Art. 6(1)(b) |
| Invoicing, accounting and tax records | Contract and billing | Legal obligation, Art. 6(1)(c); performance of a contract, Art. 6(1)(b) |
| Keeping the site available, secure and free of abuse | Technical data | Legitimate interests in security, Art. 6(1)(f) |
| Understanding how the site is used, so we can improve it | Analytics data | Consent, Art. 6(1)(a), and ePrivacy consent for cookies |
| Establishing, exercising or defending legal claims | Whatever is strictly relevant | Legitimate interests, Art. 6(1)(f) |
Where we rely on legitimate interests, we have considered your rights and interests and concluded that our processing is limited and expected. You can object at any time (see section 10).
We do not use automated decision-making or profiling that produces legal effects for you, and we do not sell personal data. We do not send marketing emails to people who have not asked to hear from us.
05Data we handle for clients
When we work inside a client’s email platform, we may access personal data belonging to that client’s subscribers and customers, such as names, email addresses, phone numbers, order history and engagement events. For that data the client is the controller and Sylora is a processor.
In that role we:
- act only on the client’s documented instructions;
- enter into a written data processing agreement, including the European Commission’s Standard Contractual Clauses where they are needed;
- access the minimum data required, and export or copy subscriber data out of the client’s platform only where a task genuinely requires it;
- keep confidentiality obligations in place, use named individual accounts with multi-factor authentication where the platform supports it, and return or delete access on request or at the end of the engagement;
- support the client in answering data subject requests and in meeting their own obligations.
If you are a subscriber of a brand we work with and you want your data corrected or deleted, please contact that brand directly, as they control it. You can also write to us and we will pass your request on.
07International transfers
We are based in Serbia, and some of our providers are based in the United States or elsewhere outside the European Economic Area. That means personal data may be transferred outside the EEA and the United Kingdom.
Serbia is not currently covered by an EU adequacy decision. Where data is transferred to us or to a provider in a country without adequacy, the transfer is protected by appropriate safeguards under Chapter V GDPR, normally the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where UK data is involved), together with additional technical and organisational measures such as encryption in transit and at rest and strict access control. Serbia’s own data protection law recognises the Standard Contractual Clauses adopted by the Serbian Commissioner for equivalent transfers.
You can ask us for a copy of the safeguards that apply to a particular transfer by writing to stevans93@gmail.com.
08How long we keep data
- Enquiries that do not become clients - up to 24 months from our last exchange, then deleted.
- Client correspondence and project files - for the duration of the engagement and up to 5 years afterwards, so we can answer questions and defend claims.
- Invoices and accounting records - for the period required by Serbian accounting and tax law, which is generally 10 years.
- Consent records - your cookie choice is stored in your own browser and is set to expire after 12 months, after which we ask again.
- Server logs - short retention periods set by our hosting provider, typically measured in weeks.
When a retention period ends we delete the data, or anonymise it so it can no longer identify anyone.
09Security
This site is served over HTTPS. We use reputable providers, individual accounts with strong and unique passwords, multi-factor authentication where it is available, encrypted devices, and access on a need-to-know basis. We keep the number of people who can see your data as small as it sounds: two.
No system is perfect. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours where required, and tell you without undue delay where the risk is high.
10Your rights
Subject to the conditions in the applicable law, you have the right to:
- Access a copy of the personal data we hold about you.
- Rectification of data that is inaccurate or incomplete.
- Erasure of data where we no longer have a lawful reason to keep it.
- Restriction of processing while a dispute is resolved.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Data portability for data you provided, where processing is based on consent or contract.
- Withdraw consent at any time, without affecting processing already carried out.
Write to stevans93@gmail.com and we will respond within one month. We will not charge you, and we will not make it difficult. We may need to confirm your identity before releasing data.
11Complaints
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to a supervisory authority:
- EEA - the data protection authority of the country where you live or work, or where the issue arose. The list is published by the European Data Protection Board.
- United Kingdom - the Information Commissioner’s Office.
- Serbia - the Commissioner for Information of Public Importance and Personal Data Protection.
12Children
Our services are business to business. This site is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, contact stevans93@gmail.com and we will delete it.
13Changes to this policy
We may update this policy as the business or the law changes. The date at the top always shows the current version. Where a change materially affects how we use your data, we will take reasonable steps to tell you, and where consent is required we will ask for it again.
14Contact
Privacy questions, requests and complaints all go to the same place, and a person reads them: stevans93@gmail.com.
Sylora, Kneza Miloša 50, Svilajnac, Serbia.