Your rights over your data

Who should receive your request?

For your nodulz account, licences, subscription or communications with Seapalm, contact Seapalm using the details below.

If your data is in a company’s or another organisation’s workflow, that organisation is generally the controller. Send it your request. When acting as a processor, Seapalm forwards received requests to it and helps it respond under its instructions.

Access - Article 15

You may learn whether your data is processed, receive a copy, and obtain information about purposes, categories, recipients, retention and transfer safeguards. Copies also respect others’ rights and freedoms: they do not automatically provide access to another user’s secrets or personal data.

Rectification - Article 16

You may have inaccurate information corrected and incomplete information completed. Editable profile fields can be updated in the portal; for other data, identify the corrections in your request.

Erasure - Article 17

You may request erasure where data is no longer necessary, consent is withdrawn without another lawful basis, or in other cases provided by the GDPR. Exceptions apply, including legal obligations and the defence of legal claims.

Account closure, subscription cancellation and erasure of workflow data are separate operations. Deletion does not automatically cancel amounts due. Deleted data leaves backups when their 30-day cycle expires; legally necessary archives remain separate.

Restriction - Article 18

You may request that certain uses are suspended, for example while disputed accuracy or an objection is checked. Data may then be retained, but other processing is limited to circumstances authorised by the GDPR. You are informed before the restriction is lifted.

Portability - Article 20

For automated processing based on consent or a contract, you may obtain data you provided in a structured, commonly used and machine-readable format. You may request direct transmission to another controller where technically feasible.

Portability does not automatically cover every inferred analysis, internal record or item processed on another lawful basis. It must not adversely affect other people’s rights.

Objection - Article 21

For reasons relating to your particular situation, you may object to processing based on legitimate interests. The controller considers these reasons and must stop unless it demonstrates overriding compelling legitimate grounds or processing needed for legal claims.

You may object to direct marketing at any time without giving reasons; this includes profiling related to that marketing.

Withdrawal of consent - Article 7

You may withdraw consent at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of earlier operations or stop processing based on another lawful basis.

Revoking a connector’s access stops the relevant future access, but does not necessarily remove copies already sent to a third party. A separate erasure request to that recipient may be needed.

Automated decisions - Article 22

You benefit from protections against solely automated decisions producing legal or similarly significant effects. Where such a decision is authorised, safeguards apply, including human intervention, expressing your viewpoint and contesting the decision in the cases provided by the GDPR.

The organisation designing the workflow remains responsible for its use of automation or AI concerning you.

Instructions after death

Under the conditions of the French Data Protection Act, you may specify instructions for the retention, erasure and disclosure of your data after death. Contact Seapalm for data it controls; identification safeguards and other people’s rights apply.

How to make a request

Email the contact below with the subject “GDPR - nodulz”. Specify the right requested, the address linked to your account and information useful for identifying the relevant data. Requests may also be mailed to Seapalm’s registered office.

Do not send passwords or API keys. An identity document is not routinely required: proportionate additional information may be requested only where there is reasonable doubt about your identity. The response uses a channel appropriate to the confidentiality of the data.

Deadlines, costs and limits

The controller responds within one month of receiving your request. An extension of up to two additional months is possible because of complexity or the number of requests; you are informed within the first month with reasons for the extension.

Exercising rights is normally free. Manifestly unfounded or excessive requests may be refused or incur reasonable fees under statutory conditions; the controller must justify this. A refusal explains the reasons and available remedies.

Where required, recipients of disclosed data are informed of rectification, erasure or restriction, unless impossible or disproportionate. You may request the identity of these recipients.

Complaints and remedies

You may complain to the CNIL using the link below or to the competent supervisory authority in your country. Judicial remedies under the GDPR are also available. Contacting Seapalm first may help resolve an issue but is not a condition for your right to complain.