Data processing terms.

01Roles

• You are the controller of the personal data in the documents and records you put into the platform (for example, bills, invoices, fuel-card statements and site details).
• We are your processor. We process that data only to provide the services you have engaged us for.

02What we process

• Purpose: Recording, checking and reporting your organisation's carbon emissions, including preparing Carbon Reduction Plans and related compliance documents.
• Nature: Storage; reading of uploaded bills by an AI model to propose values for a person to confirm; verification by a second person; calculation and reporting.
• Types of personal data: Names, business or site addresses, account numbers, meter and card references, and similar details that appear on your documents; the names and email addresses of your users.
• Data subjects: Your staff and users; individuals named on your bills and invoices, including your suppliers' staff and sole traders.
• Duration: For the term of the agreement, then as set out in section 6.

03Our commitments

We will:

• process the data only on your documented instructions, including these terms and your use of the platform, unless UK law requires otherwise, in which case we'll tell you before processing, unless that law forbids it;
• ensure everyone who processes it is under a duty of confidentiality;
• keep appropriate security measures in place, including: your uploaded data held in London; access limited to members of your organisation and authorised seer. staff, and enforced in the database; files kept private and served only through short-lived links; every AI call logged; no AI-proposed value used until a person has confirmed it and a second person has verified it;
• use sub-processors only as set out in section 4;
• help you respond to requests from individuals exercising their rights, so far as the platform allows (see section 6);
• help you meet your obligations on security, breach notification and data protection impact assessments;
• at the end of the agreement, delete or return the data as set out in section 6;
• give you the information you reasonably need to show compliance with Article 28, and allow for audits on reasonable notice.

We will tell you without undue delay, and within 48 hours of becoming aware of it, if a personal data breach affects your data.

We will tell you straight away if we believe an instruction from you breaks data protection law.

04Sub-processors

You give general authorisation for the sub-processors below. We will give you at least 30 days' notice of any addition or replacement, and you may object. If you object and we can't reasonably resolve it, you may end the affected services. We impose data protection obligations on each sub-processor that are no less protective than these terms.

• Supabase: database, file storage and sign-in. Processed in London (eu-west-2). Transfer safeguard: UK (data stored in London); Supabase's Data Processing Addendum with the UK Addendum.
• Vercel: hosting and server functions. Server functions in London; requests first reach Vercel's nearest network location, which may be outside the UK. Transfer safeguard: Standard Contractual Clauses with the ICO's UK Addendum.
• Google Cloud: AI reading of uploaded bills. Processed in London (europe-west2) only. Transfer safeguard: UK; Google's Cloud Data Processing Addendum.
• Google Workspace: business email and correspondence. Processed as set by Google's data location settings. Transfer safeguard: Google's Data Processing Addendum, including its UK transfer terms.
• Resend: sending account and notification emails. Processed in the United States. Transfer safeguard: Standard Contractual Clauses with the UK Addendum; EU-U.S. Data Privacy Framework and its UK Extension.

Supabase and Vercel run on Amazon Web Services in its London region; AWS is their sub-processor, covered by their own data processing agreements.

Google may keep a request in an in-memory cache for up to 24 hours, and, only where its automated checks flag a request, a log for up to 90 days which authorised Google staff may review. Google does not use the data to train its models.

05International transfers

We do not transfer your personal data outside the UK except as shown in section 4, and only with the safeguard named there.

06Retention, deletion and the limits of the ledger

• We keep your data for 7 years from the end of the agreement, except as set out next, because buyers, auditors and procurement teams may ask for the evidence behind a published plan years after it was issued.
• Free organisations that were never used for a paid plan. If your organisation has never had a paid plan and has never signed a Carbon Reduction Plan, the 7-year period doesn't apply. When nobody in it has signed in or used it for 12 months, we email its owners. If nobody signs in within 30 days of that email, we delete all of its data at our next quarterly clean-up, including its ledger entries, files, audit trail and the sign-in accounts of members who belong to no other organisation. We keep only a record that the deletion happened, with no personal data in it.
• On request, or at the end of that period, we delete the stored files (bills, evidence and imports), invitations, completed verification requests and the sign-in accounts of your members and former members who belong to no other organisation on seer., except your last owner and anyone we can't confirm belonged only to your organisation. We follow a documented and tested procedure, and we send you a record of what was deleted and what was kept.
• What we keep: the confirmed figures, each file's digital fingerprint (SHA-256) and the audit trail, so that a published plan can still be proved. Signed plans are kept unless you ask us to delete them.
• A current limit, stated plainly: some personal text recorded inside verified ledger entries and the audit trail (for example, a supplier or site name) cannot yet be removed, because the ledger is built so that verified records cannot be altered. We intend to add a way to redact it, and will tell you when it is available.
• Copies in backups expire on the backup provider's normal schedule.

07Your responsibilities

You confirm that you have a lawful basis to give us the personal data in your documents, and that you have told the people concerned, where required, that their data will be processed for these purposes.

08Changes to these terms

If we change these terms we will publish a new version on this page, with its number and date, and ask an owner of your organisation to accept it. The record of the version you accepted is kept.

Contact for data protection matters: admin@seerconsult.com