Privacy policy

1.1 Who is responsible

The data controller is PrimeFocus, a French simplified joint-stock company with a sole shareholder (SASU) with a share capital of 1,000 euros, registered with the RCS of Paris under number 988 608 055, whose registered office is at 46 rue Blanche, 75009 Paris, France. PrimeFocus publishes the SeamSet website until the SeamSet company is created. In this policy, “we” means PrimeFocus.

Contact for anything about your data: privacy@seamset.com.

We have not appointed a data protection officer. We are not required to, given what the site does. [Lawyer to confirm, GDPR Article 37(1).]

1.2 What we collect, why, and on what basis

a. The contact form (“Talk to us”)

What you enter: first name, last name, work email, company, your role, whether you are a company that runs NetSuite or a NetSuite partner or consultant, and your answers to the questions about your NetSuite account and your first request. Some fields are optional and marked as such.

We use it for two purposes:

1. To answer your request: reply by email, set up a call and prepare it.
2. To check who the request comes from: we compare your email domain with a list of personal email providers, which the form does not accept, and with a list of NetSuite partner email domains built from Oracle’s public partner directory, so we know before the call whether you are a partner or consultant.

Legal basis: our legitimate interest (GDPR Article 6(1)(f)). For purpose 1, our interest is to answer the people who write to us. For purpose 2, it is to know who we are talking to and to prepare the call for a company that runs NetSuite or for a partner.

You do not have to fill in the form: no law or contract requires it. Without the required fields we cannot send your request or answer it. You can also write to privacy@seamset.com.

When the form refuses a personal email address, nothing is sent and we keep nothing. [Design requirement, to confirm with the implementation.]

We do not use your data for newsletters or marketing emails, we do not sell it, and we do not share it with anyone other than the providers listed in section 1.4. If we ever want to use it for another purpose, we will tell you first.

We take no decision about you based solely on automated processing that has legal effects on you or similarly significantly affects you (GDPR Article 22). [Lawyer to confirm that refusing personal email domains, with another way to reach us, is outside Article 22.]

a bis. Booking the call

After you send the form, you can book the call on our Google Calendar booking page, which opens on Google’s site. There you enter your name and email address again and pick a time. Google handles the booking for us as part of Google Workspace: the booking and the calendar event it creates are kept with the same purposes, legal basis and retention as the contact form. When you are on Google’s page, Google’s own terms and cookies apply to that page. [Lawyer to confirm that the booking page, used for our account, is covered by the Google Workspace processor terms.]

b. Emails you send us

When you write to an address at seamset.com, or reply to us, we receive your name, email address, the content of your message and its attachments. Same purposes and legal basis as the contact form.

c. Server logs

Like any website, our host records technical data when a page is requested: typically the IP address, the date and time, the page requested, the browser and device type, and the referring page [exact fields to be verified with the host]. Purpose: keep the site running and secure, and investigate an incident. Legal basis: our legitimate interest in a secure, working site (GDPR Article 6(1)(f)).

d. Audience measurement (no cookies)

This site places no cookies on your device: no advertising cookies, no social network cookies, and none for measurement.

We count visits to improve the site: pages visited, clicks on links and buttons (such as the use cases), time spent on a page, the domain of the site you came from, browser and device type, and whether a request was sent through the contact form, never its content. We use PostHog, provided by PostHog, Inc. (United States), from its European Union cloud hosted in Frankfurt, Germany. It sets no cookie and stores nothing in your browser. To count visits, PostHog’s servers compute a code from your IP address, your browser’s user agent, this site and a secret that changes every day and is then deleted, so the code changes every day too. Your IP address itself is not stored, and no location is derived from it. It does not record what you type in the contact form. We read only statistics, not individual visits. We do not combine them with anything else, including what you send us through the contact form, and they do not follow you on other sites. PostHog processes this data only on our behalf and for no purpose of its own. How long it is kept: section 1.3. PostHog, Inc. is based in the United States: section 1.5 explains how your data is protected.

Legal basis: our legitimate interest in knowing which pages are read and improving the site (GDPR Article 6(1)(f)). Under these conditions this measurement does not need your consent (French Data Protection Act, Article 82, as applied by the CNIL) [lawyer to confirm for PostHog’s server-side code: cookies draft, question 1].

You can object at any time. Do not measure my visits. Your browser then keeps a small record of your choice, which is the only thing this site stores on your device, and the measurement service no longer loads. If you clear your browser data, or use another browser, click the link again. For any question: privacy@seamset.com.

1.3 How long we keep it

If you ask us to delete your data, we delete it sooner, unless we must keep it to comply with the law or to establish, exercise or defend a legal claim.

1.4 Who handles it

Inside PrimeFocus: only the people who work on SeamSet and need it to answer you.

Our providers (processors), who act only on our instructions, under a contract that meets GDPR Article 28:

We will update this table before we add a provider.

1.5 Transfers outside the European Union

Google Workspace may process your data outside the European Union, including in the United States. These transfers rely on:

• the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework of 10 July 2023 (Implementing Decision (EU) 2023/1795), to which Google LLC is certified;
• and the standard contractual clauses adopted by the European Commission, which Google includes in its Cloud Data Processing Addendum for Google Workspace.

You can check Google LLC’s certification on the official Data Privacy Framework list (dataprivacyframework.gov) and read the clauses in Google’s Cloud Data Processing Addendum (cloud.google.com/terms/data-processing-addendum), or ask us for a copy.

Our audience measurement provider, PostHog, Inc., is a US company. The data is stored in its European Union cloud in Frankfurt, Germany, but PostHog, Inc., its UK subsidiary and its network provider Cloudflare (global edge locations, data in transit) may process it outside the EU to run the service. These transfers rely on:

• the same adequacy decision for the EU-U.S. Data Privacy Framework, to which PostHog, Inc. is certified [participant 2915, shown as active on 2026-09-24; to be checked again on launch day];
• and the standard contractual clauses adopted by the European Commission, which PostHog includes in its data processing agreement (posthog.com/dpa).

[Lawyer to confirm which safeguard applies, and the basis for the UK subsidiary (UK adequacy decision, to be verified) and for Cloudflare’s edge network: cookies draft, question 2.]

[Host: no transfer outside the EU if an EU provider is chosen, to be confirmed in phase 12. If not, add the transfer and its safeguard here.]

1.6 Your rights

You can, at any time:

• access your data and get a copy (GDPR Article 15);
• have it corrected (Article 16);
• have it deleted (Article 17);
• restrict its use (Article 18);
• object to its use, on grounds relating to your particular situation (Article 21);
• set instructions for what happens to your data after your death (French Data Protection Act, Article 85).

The right to data portability (Article 20) applies to data processed on the basis of consent or a contract. We rely on legitimate interest, so it does not apply here.

To use these rights, write to privacy@seamset.com. We answer within one month; for a complex request, we may extend this by two more months and tell you why (GDPR Article 12(3)). We may ask you to confirm your identity if we have a reasonable doubt about it.

If you think we have not respected your rights, you can lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés), online at cnil.fr/fr/adresser-une-plainte or by post: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. You can also complain to the authority of the EU country where you live or work.

1.7 When the SeamSet company is created

PrimeFocus runs the site until the SeamSet company exists. When it does, it will take over the site and this policy will name it. We will tell you before your data moves to it, and you can object. [Lawyer to confirm the legal basis and the notice needed for the change of controller.]

1.8 Changes to this policy

We update this page when what the site does changes, and before any new use of your data. The date below shows the last change.

Last updated: [date of go-live]