Privacy Policy

1. Controller

Seaberry Oy is the controller of the personal data described in this policy and operates the Seaberry service.

Business ID: 3558526-4
Registered address: Hämeentie 10 A 4, 00530 Helsinki, Finland
Privacy contact: privacy@seaberry.io

Privacy questions and requests concerning the rights described in section 9 go to the address above.
‍

2. Scope of this policy

This policy covers personal data Seaberry processes as a controller through this website and through sales, marketing, and general business contact.

Where Seaberry processes personal data on behalf of a customer when delivering its services, the customer is the controller and Seaberry acts as a processor. A separate data processing agreement governs that processing, not this policy.
‍

3. Personal data Seaberry collects

Data you provide

Through the contact form:

• First name and last name
• Company name
• Work email address
• Phone number, if you choose to give one
• Your message, if you choose to write one

Phone number and message are optional.

Through direct contact by email, phone, LinkedIn, or at events: your name, contact details, employer, role, and the content of your message.
‍

Data collected automatically

Standard server log data is recorded when you visit the site: IP address, browser and device type, operating system, referring page, pages requested, and timestamps. The hosting platform generates this data as part of delivering the website.

Seaberry does not run website analytics, does not use tracking pixels, and does not build visitor profiles.
‍

Data from other sources

Publicly available business information, for example a company website or a public register, where Seaberry uses it to assess whether an organisation may need managed cloud operations services.

Seaberry does not collect special categories of personal data through this website and does not knowingly collect data from children.

‍

4. Purposes and legal bases

Answering a contact request and taking steps toward a possible service agreement

Data: Name, company, email, phone if given, message content
Legal basis: Steps prior to entering a contract, GDPR Article 6(1)(b). Where no agreement follows, legitimate interest, Article 6(1)(f)
‍

Business-to-business communication about Seaberry's services

Data: Name, company, email, phone if given
Legal basis: Legitimate interest, GDPR Article 6(1)(f). Direct marketing to organisations and their representatives is permitted under section 200 of the Finnish Act on Electronic Communications Services, subject to your right to object
‍

Operating and securing the website, preventing misuse, and diagnosing faults

Data: Server log data
Legal basis: Legitimate interest, GDPR Article 6(1)(f)

Meeting legal obligations, including accounting and responding to authorities

Data: As required by the obligation
Legal basis: Legal obligation, GDPR Article 6(1)(c)
‍

Legitimate interest and your choices

Where Seaberry relies on legitimate interest, that interest is operating a business-to-business service company: answering inquiries and reaching organisations that may need managed cloud operations. Seaberry has assessed this against your rights and limits the processing to business contact details used in a professional context. If you object to receiving communications from Seaberry, Seaberry stops.

Providing your details through the contact form is voluntary. Without a name, company, and email address Seaberry cannot answer your request.
‍

5. Recipients

Seaberry does not sell personal data and does not disclose it for advertising.

Personal data is disclosed to the following service providers, which act as processors on Seaberry's behalf under data processing agreements:

• Webflow, Inc.
  Role: Website hosting and contact form submissions
  Processing location: United States
• Microsoft Ireland Operations Ltd.
  Role: Email, productivity, and internal storage
  Processing location: European Union, under Microsoft's EU Data Boundary

Where this site embeds video hosted by Vimeo.com, Inc., Vimeo decides for itself how it uses the technical data collected through its player. For that data Vimeo acts as a separate controller rather than as Seaberry's processor, and its own privacy policy applies. Vimeo stores data in the United States.

Personal data may also be disclosed to advisors, auditors, or authorities where law requires it, and to an acquirer in the event of a business transfer.
‍

6. Transfers outside the EEA

Webflow processes personal data in the United States on Seaberry's behalf, and Vimeo stores data in the United States as a separate controller. Both are active participants in the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection for personal data transferred from the EEA to certified organisations in the United States. You can verify both certifications on the Data Privacy Framework list at dataprivacyframework.gov. Webflow's data processing addendum additionally incorporates the EU Standard Contractual Clauses.

Microsoft processes data within the European Union under its EU Data Boundary commitment. Where Microsoft transfers limited data outside the EU for support or security purposes, it relies on its own Data Privacy Framework certification and on Standard Contractual Clauses.

If any provider's certification lapses, Seaberry relies on Standard Contractual Clauses approved by the European Commission.

You can request details of the safeguards applied by contacting Seaberry at the address in section 1.
‍

7. Retention

• Contact requests that do not lead to an agreement
  Retention period: 24 months from the last contact
• Sales and marketing contact records
  Retention period: Until you object, or 24 months without interaction
• Customer contract and accounting records
  Retention period: The statutory period under Finnish accounting law, at least six years from the end of the financial year
• Server log data
  Retention period: Generated and retained by the hosting platform under its own retention schedule. Seaberry does not keep a separate copy

Personal data is deleted or anonymised once it is no longer needed for the purpose it was collected for.
‍

8. Cookies

This website uses only cookies that are strictly necessary to deliver the site and operate the contact form. These are set by the hosting platform and are exempt from the consent requirement under section 205 of the Finnish Act on Electronic Communications Services. The site therefore does not display a cookie consent banner.

Seaberry does not use analytics cookies, advertising cookies, or tracking pixels, and does not use cookies to profile visitors.
‍

Embedded video

Where this site embeds video hosted by Vimeo, the player is configured with tracking disabled and does not set tracking cookies. Vimeo processes the technical data needed to deliver the video, including your IP address, under its own privacy policy.
‍

Managing cookies

You can block or delete cookies in your browser settings. Blocking necessary cookies may prevent parts of the site, including the contact form, from working.
‍

9. Your rights

Under the GDPR you have the right to:

• Obtain access to the personal data Seaberry holds about you
• Have inaccurate data corrected
• Have your data erased where the conditions for erasure apply
• Restrict processing while a request is being resolved
• Object to processing based on legitimate interest. Where you object to direct marketing, Seaberry stops without exception
• Receive your data in a portable format where processing is based on consent or on a contract
• Withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal
  ‍

Making a request

To exercise a right, contact Seaberry at the address in section 1. Seaberry responds within one month of receiving your request. Where a request is complex or where several requests are made, Seaberry may extend that period by up to two further months and will tell you if it does. Seaberry may ask for information needed to verify your identity before acting.
‍

Lodging a complaint

If you consider that your personal data has been handled unlawfully, you can lodge a complaint with the Finnish supervisory authority.

Office of the Data Protection Ombudsman
Tietosuojavaltuutetun toimisto

Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: PO Box 800, 00531 Helsinki
Email: tietosuoja@om.fi
Switchboard: +358 29 566 6700
Registry: +358 29 566 6768
Website: tietosuoja.fi
‍

10. Security

Seaberry protects personal data with access controls, multi-factor authentication on internal systems, and encryption of data in transit. Access to contact requests is limited to the Seaberry personnel who handle them.
‍

11. Changes to this policy

Seaberry updates this policy when its processing changes. The current version is published on this page with its update date. Where a change materially affects how personal data is processed, Seaberry communicates it to the individuals concerned where required by law.