SyncMint BV

This page explains why SyncMint relies on Legitimate Interest (LI) as the legal basis for two specific data processing activities related to EdgeACR. For all other processing — including audience creation, ad measurement, and service operation — we rely on your consent, which you can withdraw at any time via your TV privacy settings.

Who We Are

SyncMint BV is a Dutch company (Vijzelstraat 68, 1017 HL Amsterdam, The Netherlands) that develops EdgeACR — an advertisement recognition technology embedded into smart TVs by manufacturers. EdgeACR detects when advertisements are playing on your TV and sends a small event record to our servers. No audio is ever recorded or transmitted.

Contact: privacy@syncmint.ai

What Is Legitimate Interest and When Do We Use It?

Legitimate Interest (LI) is one of the legal bases under GDPR Article 6(1)(f) that allows a company to process personal data without asking for consent, provided the company's interests are not overridden by the individual's rights and freedoms. Before relying on LI, we are required to carry out a Legitimate Interest Assessment (LIA) — a formal three-step test that documents why the processing is necessary and proportionate.

We use Legitimate Interest for two processing activities only. For everything else, we ask for your consent.

The Two Purposes for Which We Rely on Legitimate Interest

Special Purpose 1 — Fix and Prevent Errors

Why we rely on Legitimate Interest

Diagnosing and fixing errors in a networked service cannot meaningfully be made subject to user consent. Errors occur without warning and cannot be anticipated. Requiring consent before diagnosing a problem would prevent us from maintaining a functioning service for all users — including those who have consented to other purposes. SP1 is designated as a Special Purpose under TCF 2.3 precisely for this reason.

What data is used and why

• IP address — transmitted to our network/cloud infrastructure to diagnose connection errors and identify anomalous ingestion patterns. Retained for up to 3 months for diagnostic purposes then deleted. This is separate from, and shorter than, the IP address retention under your consent for measurement and audience purposes.
• Device OS, model, and type — used to attribute errors to specific firmware versions and device configurations. Cannot be replaced by less specific data.
• Session and event identifiers — used to detect duplicate or anomalous events. Required at this granularity for accurate deduplication.

Our balancing assessment

We assessed whether our interest in error diagnosis is outweighed by your privacy interests. Our conclusion is that it is not, for the following reasons: the IP address is retained only for a short diagnostic window (3 months) before deletion; device metadata is technical in nature and does not identify individuals; no profiling or targeting takes place under SP1; and data is not shared with third parties for SP1 purposes. We incorporated residual risks from our Data Protection Impact Assessment into this assessment.

Your right to object

You can opt out of SP1 processing at any time via the SP1 toggle in your TV privacy settings. You may also object under GDPR Article 21 by contacting privacy@syncmint.ai. Note that if you object, data already retained within the active 3-month diagnostic window will be held until that window expires — it cannot be deleted earlier without undermining the diagnostic purpose.

Special Purpose 3 — Save and Communicate Privacy Choices

Why we rely on Legitimate Interest

Storing your consent decision is necessary to honour it across sessions and device restarts. Without this processing, EdgeACR cannot remember that you have opted out — meaning it could restart data collection after each reboot. This processing exists entirely to serve your privacy choices, not to serve our commercial interests. It is confirmed as a legitimate interest by the Belgian Data Protection Authority (Feb 2022) and is required under TCF 2.3 following the CJEU ruling of 7 March 2024 (C-604/22), which established that consent records constitute personal data.

What data is used and why

• Consent state and timestamps — stored on your device to enforce your choice between sessions. Each field is necessary: the state for enforcement, timestamps for validity checks.
• Consent audit log — an append-only record of consent transitions, retained for up to 3 years to meet our GDPR Article 5(2) accountability obligations. Required to demonstrate that consent was valid if challenged by a regulator.
• Server-side consent backup — transmitted to consent.syncmint.cloud as a backup in case device storage is lost during a factory reset.

Our balancing assessment

The data processed under SP3 is your own privacy choices — it contains no behavioural data, no content data, and no advertising identifiers. Processing it benefits you directly by ensuring your choices are respected without requiring you to re-confirm them on every session. The EDPB's Guidelines on Dark Patterns specifically discourage repeated prompting as a privacy harm. SP3 avoids that harm.

Your right to object

SP3 exists to remember and act on your privacy choices — objecting to it would mean the system cannot remember your objection. The practical mechanism for ceasing all EdgeACR processing, including SP3, is to withdraw consent via your TV privacy settings. You may also request deletion of your consent history records under GDPR Article 17 by contacting privacy@syncmint.ai. Where deletion is requested, we will balance it against our accountability obligation to retain consent records for up to 3 years.

Contact and Further Information

Full Privacy Policy: syncmint.ai/privacy

Legitimate Interest Assessment (full document, available to regulators on request): privacy@syncmint.ai

General privacy enquiries: privacy@syncmint.ai

Post: SyncMint BV, Vijzelstraat 68, 1017 HL Amsterdam, The Netherlands

You have the right to lodge a complaint with your national data protection authority at any time: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en