Data protection at Seatti

Seatti is a trademark of Seatti GmbH, a German company (Imprint). We respect and value the protection of personal data, both for our customers and for ourselves, and are constantly striving to fully comply with the European GDPR regulations and in particular the GDPR regulations. This document describes our comprehensive program to not only comply with the law, but to assure every user of Seatti Services that their data is secure. If you have any further questions regarding compliance with the GDPR, data security and data protection rights, please contact us at compliance@seatti.co.

• Services
• Privacy by Design
• Commissioned data processing
• Privacy Policy Website

Services

We offer a paid service to businesses and other organisations who wish to use our services as an integrated professional tool, which can also be integrated with third-party tools to enhance the user experience for our users. For this, we have a data processing agreement that sets out how we process personal data as a data processor on behalf of a client.

‍

Privacy by Design

At Seatti, we make a point of designing our services in such a way that the rights of users are already protected in the best possible way by the way they are implemented. Consequently, our services are built according to the requirements of Privacy by Design (also called data protection by design), which are also laid down in Art. 25 of the European GDPR. This means that appropriate technical and organisational measures to ensure data protection are already taken into account when determining the means of data processing. This is manifested in a set of principles on how we set up our infrastructure and how we collect and process data, and are an integral part of our data processing agreement as a data processor.

Data minimization

We only store and process as much data as necessary to provide our core functionalities and a great user experience. We actively avoid storing data solely for the purposes of marketing, data accumulation or other purposes that are not related to a smooth experience for our users. Personal data, specifically only a user ID and email is stored, while any other association data is only added directly to the customer system and is neither stored nor visible in our systems.

Data storage and processing within the EU

To ensure full transparency, familiarity and compliance with regional regulations and the GDPR, we store and process data as often as possible on servers located on the territory of the European Union. As of now, all data processing of personal data takes place on servers of our service provider. See the list of sub-processors for more details.

‍

Security infrastructure

Our infrastructure and internal security boundaries should meet the highest security standards to preventively avoid any kind of data breach. This concerns the security policies of our team, e.g. the way we collaborate and communicate sensitive data or how access rights are distributed among team members and their roles, but also the selection of service providers and sub-processors. Our main Azure processor is built on the principles of Security by Design and provides a variety of services that we have implemented to ensure data security. These and other security measures are detailed in our Technical and Organizational Measures, which are also part of our data processing agreement as a contractor.

Commissioned data processing

Download the Seatti data processing agreement as PDF

We use a data processing agreement to maintain all the protections of current legislation. We have also ensured that we have data processing agreements in place with all our sub-processors to ensure full vertical data protection.

‍
The data processing agreement is concluded and signed individually with each client for whom we act as contractor.

Subcontractors

Below you will find a list of all our subcontractors and the data processing agreements concluded with them. In particular, due to the invalidation of the EU/US Privacy Shield, we try to process all personal data in EU territory. We have also selected servers located exclusively in the EEA for our main infrastructure provider Azure. Even after the invalidation of the Privacy Shield, the standard contractual clauses approved and regulated by the EU offer a level of data protection that complies with the GDPR. These clauses are anchored in Azure's Data Processing Addendum, which can be downloaded below.

Only in exceptional cases, if the provider landscape requires it, do we use providers outside the EU.

Provider name: Microsoft Ireland Operations Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland

• Service for Seatti GmbH: Provision of data center infrastructure, hosting, e-mail dispatch
• Server location: EU (Germany, Ireland and Netherlands)