Synastria Privacy Notice

How we handle personal data when your team uses Synastria

Last updated: 28 October 2026

This notice explains how O'Rourke Studios Ltd handles personal data when a team uses Synastria, our team-development instrument delivered as a managed service. It sits alongside our main website privacy and cookie policy.

Who we are

O'Rourke Studios Ltd, provider of Synastria, is registered in England and Wales (company number 17244257). Registered address: Suite E, Ground Floor, Profile West, 950 Great West Road, Brentford, TW8 9ES, United Kingdom.

For the Synastria service, your organisation is the data controller and O'Rourke Studios Ltd acts as data processor on its instructions. We are registered with the Information Commissioner's Office (C2027138).

Our data protection contact is Rebekah O'Rourke, Director: rebekah@orourkestudios.com.

What personal data we process

To produce your team's Synastria picture we process written material from your team's working conversations, supplied by your organisation. We do not request or accept audio or video recordings. We replace names and other identifying details with placeholders before analysis, and we produce team-level findings only. We produce no individual-level or speaker-level measures, scores, rankings or profiles.

Synastria does not seek special category data (such as health, or political or religious views). Meeting conversation may occasionally touch on such matters; we minimise this.

How we collect it

Your organisation provides this material, from conversations held with everyone's knowledge, through a secure, restricted upload. We do not record anything ourselves and we do not use questionnaires.

Why we process it, and our lawful basis

We process this data solely to produce your team's reports and support your development. Your organisation, as controller, determines the lawful basis for this processing and informs participants; we support this with a short description of the processing.

How we use it

We use your data only to produce and support your Synastria reports. Our reports describe the team as a whole and must not be used for decisions about individuals (such as recruitment, promotion, pay, discipline, termination, task allocation or performance evaluation); our agreement with your organisation prohibits this.

We re-use data for research and development only with your organisation's written agreement. We never sell it, never share it with other clients, and never use it to train AI models.

AI-assisted analysis

We use AI to help analyse pseudonymised material. A trained analyst reviews every result before it reaches you. No decisions about individuals are made by automated means.

Who we share it with

We use a small number of carefully chosen service providers for secure storage and processing. They act only on our written instructions under contract, and they receive pseudonymised data only, never names. We keep a current list, available to client organisations on request, and give notice before adding a provider. We do not otherwise share your data.

Security and international transfers

Your data is encrypted in transit and at rest, and is held on our own encrypted equipment in the United Kingdom. Access is restricted to named individuals under confidentiality, is protected by two-factor authentication, and is recorded. Identifying details are replaced before any cloud processing, and no re-identification key is kept. We have written procedures for personal data breaches, requests for access from public authorities and business continuity, and we review our security regularly. If a personal data breach affects your data, we notify your organisation within 24 hours of becoming aware of it.

Some of our providers process data outside the UK, including in the United States. Where this happens we rely on appropriate safeguards: UK and EU adequacy decisions where they apply, otherwise our providers' data processing terms with standard contractual clauses, together with pseudonymisation before transfer, encryption and short retention. A transfer impact assessment is maintained and available on request.

How long we keep it

Material as supplied to us is deleted once pseudonymised, and no later than 30 days after upload. Pseudonymised material, analysis data and reports are deleted within 30 days after the engagement ends, or earlier on request. We can confirm deletion on request.

Team-level only

Synastria is collective by design. It describes the team as a whole and produces no individual-level or speaker-level measures, scores, rankings or profiles.

Your rights

You have the right to access your data; to have it corrected or erased; to restrict or object to processing; and to data portability where it applies. To exercise any of these, contact rebekah@orourkestudios.com. As your own organisation is the controller, you may also raise requests with them.

Complaints

If you have a concern, please contact us first at rebekah@orourkestudios.com. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

Changes to this notice

We may update this notice from time to time. The current version and its date are shown at the top.