Workflow data and processing roles

Establishing the roles

The customer deciding why and how data is used in a workflow acts as controller, or may itself be a processor for another organisation. Seapalm is a processor or subprocessor only for operations performed on its behalf.

Selling a licence for an instance operated exclusively by the customer does not automatically make Seapalm the processor of all instance data. Support access, hosting or maintenance involving data access must be assessed separately.

Agreement and service description

Before personal data is entrusted to Seapalm for hosting or support involving access, a written agreement compliant with Article 28 must govern the service. This page describes the framework; it does not replace an agreement and annexes specific to the ordered service.

Annexes specify the subject, duration, nature of operations, purposes, categories of people and data, customer rights and obligations, processing locations, recipients, security measures and return procedures. Data may include inputs and outputs, files, secrets, histories and strictly necessary diagnostics.

Instructions and confidentiality

Seapalm processes entrusted data under documented customer instructions, including for transfers. A legal obligation requiring a different operation is disclosed where the law permits. Instructions appearing contrary to data protection rules are brought to the customer’s attention.

People authorised to access data must be subject to confidentiality obligations. Access is limited to duties needed for the service. Entrusted data is not reused for an independent purpose, including model training or marketing, without a separate appropriate legal framework.

Service security

Technical and organisational measures are appropriate to risk and documented in security annexes. They must address access, secrets and permissions, communications, backups, availability, restoration and evaluation of safeguards.

The customer configures organisational access, connectors, data recorded in histories and verification of automated actions. It checks that the service is suitable for sensitive or regulated data. No certification or sector-specific assurance follows from this page.

Subprocessors and connectors

Providers entrusted by Seapalm with part of the processing must be identified, with operations, locations and safeguards, in an up-to-date list supplied to the customer. Their involvement requires the specific or general written authorisation set out in the agreement. Under general authorisation, changes are announced so the customer can object under the agreed procedure.

Equivalent protection obligations are imposed on subprocessors; Seapalm remains accountable to its customer for their compliance. Portal payment tools and providers directly selected by the customer do not automatically constitute this workflow subprocessor list.

Customers separately assess APIs, databases, AI tools and MCP assistants: data sent, purposes, access, countries, retention, possible training and revocation options. European infrastructure does not make every workflow recipient European.

Assistance, rights and risk assessments

Considering the nature of processing and available information, Seapalm helps customers respond to individual requests and meet security, notification and, where necessary, impact assessment and prior consultation obligations.

Customers remain responsible for lawfulness, transparency, minimisation, lawful bases and special conditions for sensitive data. An impact assessment must be considered where processing is likely to create high risk, including certain profiling or automated decision uses.

Breaches and cooperation

Seapalm informs customers of a breach of entrusted data without undue delay after becoming aware. Available information includes the incident’s nature, affected data and people, possible consequences, measures taken or proposed and a follow-up contact; information may be supplemented progressively.

Notification to the authority and, where necessary, affected people is the controller’s responsibility. Contact and escalation arrangements are specified in the agreement.

Transfers and processing locations

Seapalm’s infrastructure is located in Europe. The agreement specifies countries and any remote access. Transfers outside the EEA require instructions and safeguards under Chapter V GDPR, including necessary supplementary measures.

Customers must also address transfers they trigger themselves through connectors and third-party tools. Information about disclosable safeguards may be requested from Seapalm.

Retention, return and service termination

For Seapalm-operated services, routine logs and histories are retained for up to 30 days and backups follow a 30-day cycle. Instructions for shorter retention are addressed under the agreement’s limitations and arrangements.

At service termination, customers choose return or deletion of entrusted data. Data and copies are deleted within 30 days, including through backup cycle expiry, unless a legal obligation requires otherwise. Export format and delivery are agreed before closure. Restoration must not permanently reintroduce previously deleted data.

For self-hosting, customers apply their own retention, purge and backup rules. Disabling a licence does not itself delete data from their infrastructure.

Documentation and audits

Seapalm makes information available to demonstrate compliance with processor obligations and contribute to audits, including inspections, under the agreement. Practical arrangements protect secrets, security and other customers’ data without neutralising this right.

To prepare a service, request the data processing agreement, security annexes, subprocessor list and processing locations using the contact below.