The General Data
Protection Narrative

Where we act as processor of personal data on behalf of a client, if a request is received directly from a data subject, we will contact the controller client for instructions on dealing with the request.

1.7 Privacy and Data Protection Impact Assessments

Where we, as controller, process personal data that is considered high risk, or when we process such information in a new way requiring new tools, assessments are carried out to comply with article 35 requirements of the GDPR. These assessments allow us to implement appropriate technical and organizational measures and integrate the necessary safeguards into the processing in order to meet the requirements of this regulation and protect the rights of data subjects. As a processor we will, on request, assist our controller clients with their own data protection impact assessments relating to the services we provide to them.

1.8 Breach Management

Under our procedures for incident management, we ensure that we have safeguards and measures in place to detect, assess, investigate and report any personal data breach at the earliest possible time. All employees have been made aware of the reporting lines and steps to follow if confidential information is lost or compromised or suspected of being lost or compromised. Governance is in place to ensure that following an incident appropriate root cause analysis is conducted and remediation plans are developed to address any risks identified and prevent recurrence. Where we are a processor for personal data, we will notify controller clients without undue delay of any personal data breach relating to personal data we process for them.

1.9 Location of Information and Data Transfers

Seerist, Inc., is headquartered in the United States and is comprised of the following affiliate companies (collectively, “Seerist Affiliates”): Seerist North America, Inc., Seerist UK, Ltd., Seerist Federal, and Geospark Analytics, Inc. During the provision of services, personal data may be transferred outside of a client’s home country and may be stored in and accessed from multiple countries. We have put organizational procedures in place to secure, encrypt and maintain the integrity of any personal data that is transferred to countries outside the European Economic Area (“EEA”) (or in the case of UK GDPR outside the UK). If the country does not have adequacy status, we rely on the European Commission’s Standard Contractual Clauses, including for transfers of personal data to the US.

1.10 Sub-Processors

Where we are a processor, we sometimes use sub-processors to process personal data for the purposes of providing services. We have set out details of those sub-processors and the location of the processing (https://seerist.com/privacy-policy/), in compliance with article 28 of the GDPR.

1.11 Special Categories of Personal Data

We do not process special category personal data under any circumstances.

1.12 Information Security and Accountability

We have an Information Security Management System that runs from company headquarters audited and certified to SOC 2. Our security measures which safeguard the confidentiality, integrity and availability of information include organizational policies; screening and training of Seerist’s people; defined and audited processes; and technological controls such as, encrypted hard drives, segmented data stores, encrypted data backups, firewalls, network and communication security, two-factor authentication, and continuous monitoring. Only necessary limited personnel in Seerist have access to the personal data. In addition, we have an auditor who checks adherence to company policies, to meet or exceed international standards.

Our third party service providers are expected, to the extent applicable, to provide the equivalent technical and organizational controls as Seerist to protect the security and confidentiality of personal data and to commit to appropriate contract terms to ensure compliance with applicable data protection law.

1.13 Data Retention and Deletion

We have a company Data Retention, Archiving and Destruction Policy which sets out retention periods for storing information. Where we are the controller, personal data is retained for no longer than the minimum time needed, as required by applicable laws and regulations, as agreed upon contractually, or for the purposes for which it was collected. At the end of the defined period, personal data is permanently destroyed. Where we act as processor, clients may provide us with instructions to save data for or destroy or return data within, a specific period.

2. Key Services

2.1 Seerist and Seerist Essentials

Personal data is collected direct from a data subject – who is typically part of the client’s personnel – when they create their own profile and account for the purpose of accessing Seerist Platform content through the website. Personal data is limited and may include personal details such as name, location, job function, job seniority and contact details (such as telephone and email address). We may also process other personal data which a data subject includes in an inquiry. In creating the user’s profile, the data subject is made aware of our privacy policy, the rights are summarized and their consent must be given to any marketing.

In relation to contact information referred to above which is collected in connection with creation of profiles and accounts, Seerist acts as controller. Seerist also collects personal data from its websites for its own uses such as service improvement, data analytics and to use for marketing purposes. In relation to Seerist collection of personal data for these purposes, Seerist is also a controller.

2.2 Seerist Experts Services (Seerist Acts as Processor)

Seerist offers a variety of consulting services including enhancing client’s readiness for, response to and recovery from a wide yet specific range of critical events. Seerist uses information provided by the client to offer advice on a defined scope. Seerist only uses information as instructed by the client.