Approx. 9 minute read

Top

Key Points

Executive legal summary for procurement, security, and compliance stakeholders.

  • Data Controller / Processor Roles: Seamium Ltd acts as a controller for website, prospect, and marketing data. For customer-configured service data, Seamium generally operates as a processor pursuant to applicable contracts and data processing terms.
  • Security Program: Our administrative, technical, and organizational controls include role-based access, monitoring, encryption in transit, and encryption at rest where supported. Additional details appear in Section 9.
  • No Sale of Personal Data: Seamium does not sell personal data. Disclosures are limited to legitimate business operations, legal compliance, or other lawful bases described in this Policy.
  • Rights and Requests: Subject to applicable law, individuals may request access, correction, deletion, portability, objection, or restriction. Fulfillment procedures are outlined in Section 11.

For business customers, the governing Master Services Agreement, Data Processing Addendum, and order documents control service data handling in the event of any conflict with this webpage policy.

1. Introduction

This Privacy Policy describes how Seamium Ltd and its affiliates process personal data in connection with our website, product information pages, sales and partnership activities, customer support operations, and related business communications. This Policy is intended to provide transparent, operationally practical disclosure for individuals, business customers, and procurement teams.

This Policy applies unless a separate privacy notice, data processing agreement, or customer contract governs a specific service context. If another controlling document applies, that document governs the relevant processing activities for that service context.

2. Definitions

  • Personal Data: Information that identifies, relates to, describes, or can reasonably be linked to an identified or identifiable individual.
  • Sensitive Personal Data: Personal data that receives additional legal protections under applicable law, such as certain government IDs, precise geolocation, financial details, or account credentials when used for authentication.
  • Processing: Any operation performed on personal data, including collection, organization, storage, use, analysis, transmission, disclosure, deletion, or anonymization.
  • Controller: The organization that determines why and how personal data is processed.
  • Processor: A service provider that processes personal data on behalf of a controller and under documented instructions.
  • Service Data: Data submitted to or generated through customer use of Seamium services under a customer agreement.
  • Applicable Law: Privacy, data protection, cybersecurity, and sector-specific laws that apply to the relevant processing activity.

3. Information We Collect

3.1 Information you provide directly

We may collect identifiers, professional details, account details, support content, and commercial information you submit when you contact us, request access, subscribe to updates, register for services, attend events, or engage in procurement and contracting workflows.

3.2 Information collected automatically

We collect technical and usage information such as IP address, browser type, operating system, referral source, pages viewed, session activity, approximate location inferred from IP, timestamps, and diagnostic events used for security, performance, and reliability analysis.

3.3 Information from third parties

We may receive business contact information, lead enrichment data, fraud and security signals, and service integration data from public sources, channel partners, analytics vendors, identity providers, and other lawful third-party sources.

3.4 Sensitive data handling

We do not intentionally request sensitive personal data unless necessary for a legitimate business purpose, legal requirement, or specific service functionality. Where sensitive data is processed, we apply additional access controls and safeguards appropriate to the data category and legal requirements.

4. How We Use Personal Data

  • Service delivery: Operate our website, provide requested information, onboard customers, administer accounts, and deliver support.
  • Security and trust: Authenticate users, monitor for misuse, prevent fraud, protect systems, and enforce contractual and acceptable use requirements.
  • Business operations: Manage billing support, vendor management, legal workflows, audits, and internal governance functions.
  • Product and service improvement: Evaluate usage trends, improve reliability and user experience, and inform roadmap decisions using aggregated, de-identified, or pseudonymized data where practical.
  • Communications: Send service notices, respond to inquiries, and provide marketing communications subject to applicable consent and opt-out rules.
  • Compliance: Satisfy legal obligations, respond to lawful requests from authorities, and maintain required records.
  • Corporate transactions: Support due diligence and transition planning for financing, merger, acquisition, reorganization, or asset transfer activities.

5. Legal Bases

Where required by GDPR, UK GDPR, and similar regimes, we process personal data under one or more lawful bases:

  • Contract: Processing needed to take steps at your request or perform obligations under a contract.
  • Legitimate interests: Processing for business operations, security, and service improvements where those interests are not overridden by rights and freedoms of individuals.
  • Legal obligation: Processing required to comply with applicable laws, regulations, judicial process, or lawful regulatory requests.
  • Consent: Processing based on consent, including certain marketing or non-essential cookie uses where required.
  • Vital interests or public interest: Processing in limited situations recognized by applicable law.

Where consent is the legal basis, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

6. Cookies and Similar Technologies

We use cookies, local storage, SDK events, and related technologies to enable core functionality, support security controls, understand website performance, and remember user preferences. Certain technologies are required for essential site operations and cannot be disabled without impacting functionality.

For non-essential technologies, we provide consent tools where required by law. Browser settings can also be used to control cookie behavior. Blocking cookies may affect page features, sign-in continuity, and personalization preferences.

Learn more: Detailed categories and retention details are available in our Cookies Policy.

7. How We Share Personal Data

We may disclose personal data to the following categories of recipients for legitimate business purposes and as allowed by applicable law:

  • Infrastructure and hosting providers that support compute, storage, delivery, and continuity.
  • Security and operations providers that support monitoring, logging, incident handling, and abuse prevention.
  • Communications and support providers used for email, ticketing, customer support, and relationship management.
  • Professional advisors such as legal, audit, insurance, and compliance consultants under confidentiality duties.
  • Payment and commercial operations providers where relevant for invoicing, reconciliation, or fraud controls.
  • Corporate affiliates and successors when necessary for business administration or transaction continuity.
  • Public authorities and counterparties where disclosure is required or permitted to comply with law, protect rights, or address disputes.

Seamium does not sell personal data for monetary consideration. We also do not share personal data for third-party direct marketing in a manner that is inconsistent with this Policy and applicable law.

8. International Data Transfers

Personal data may be processed in countries other than your country of residence. Where transfer restrictions apply, we use recognized transfer mechanisms such as adequacy decisions, contractual safeguards, and supplementary security controls proportionate to transfer risk.

Transfer assessments are reviewed periodically, including vendor controls, jurisdictional risk factors, and technical protections. Where required, we implement contractual commitments and operational measures to protect transferred data.

9. Data Security

We maintain a risk-based information security program intended to protect confidentiality, integrity, and availability of data. Controls are designed in line with business context, threat landscape, and regulatory obligations.

  • Identity and access management with role-based permissions and least privilege principles.
  • Network and endpoint controls, vulnerability management, and patch governance.
  • Encryption for data in transit and at rest where technically and operationally appropriate.
  • Security logging, monitoring, alerting, and incident response workflows.
  • Vendor due diligence, contractual safeguards, and periodic control reviews.
  • Workforce confidentiality obligations and role-based privacy and security training.

No environment can guarantee absolute security. We continuously evaluate and update safeguards in light of evolving threats and operational requirements.

10. Data Retention

We retain personal data for as long as needed to satisfy the processing purposes described in this Policy, including contractual performance, legitimate operations, legal compliance, dispute resolution, security investigations, and recordkeeping requirements.

Retention periods are based on data category, sensitivity, legal obligations, business need, and risk profile. At the end of an applicable retention period, data is deleted, anonymized, or aggregated in accordance with our retention standards and technical capabilities.

11. Your Rights and Choices

Depending on your location and applicable law, you may have rights that include access, correction, deletion, portability, restriction, objection, and withdrawal of consent. You may also have rights related to targeted advertising, profiling, or certain automated processing.

How to submit a request

You may submit privacy requests using the contact details in Section 16. We may take reasonable steps to verify identity, authority, and request scope before fulfilling a request. Authorized agents may submit requests where legally permitted and where authority can be validated.

Request handling

We respond within applicable legal timelines. In limited cases, we may deny or limit a request where exemptions apply, including legal privilege, security concerns, rights of others, or legal obligations requiring continued processing.

12. Region-Specific Disclosures

EEA and United Kingdom

Individuals may have rights under GDPR or UK GDPR, including rights to object to certain processing based on legitimate interests and rights to lodge a complaint with a supervisory authority in their habitual residence, workplace, or place of alleged infringement.

United States

Residents of states with comprehensive privacy laws may have rights to know, access, correct, delete, and obtain portability of personal data, and to opt out of certain profiling, targeted advertising, or data sharing activities as defined by state law. Non-discrimination protections apply as required by law.

California notices

California residents may request additional information regarding categories of personal information collected, sources, business purposes, recipient categories, and retention criteria, subject to statutory exceptions and verification requirements. We honor applicable global privacy controls where legally required and technically supported.

13. Children’s Privacy

Our website and services are designed for business and professional audiences and are not directed to children. We do not knowingly collect personal data from children below the age threshold defined by applicable law. If we become aware of such collection, we take appropriate steps to investigate and address the data in accordance with legal requirements.

14. Third-Party Links and Services

Our website may include links to third-party websites, plugins, resources, and integrations. Third-party services operate under their own terms and privacy notices. Seamium is not responsible for third-party content, security, availability, or privacy practices. You should review relevant third-party notices before sharing personal data.

15. Changes to This Privacy Policy

We may update this Policy to reflect legal, technical, operational, or business developments. The revised version becomes effective on the date posted unless a different date is stated. For material changes, we may provide additional notice through website posting, product notices, or direct communication where appropriate or legally required.

16. Contact

For privacy questions, rights requests, or concerns regarding this Policy, contact us using the details below. Enterprise customers may also use designated trust, security, or contractual channels documented in their customer agreements.

Email
[email protected]
Company
Seamium Ltd
Address
Registered address available upon request

17. Governing Law

This Policy is interpreted in a manner consistent with applicable data protection and privacy law. Contractual governing law terms in customer agreements and Terms of Service apply to the extent permitted by law and subject to mandatory local rights that cannot be waived.