GDPR Compliance

How SeerDesk protects your personal data in accordance with the General Data Protection Regulation (EU) 2016/679.

Last updated: October 16, 2026

Our commitment

Seer SAS is committed to protecting the privacy and personal data of its customers, their employees and their end users. As a company based in Rennes, France, we apply the General Data Protection Regulation (GDPR) and the French Data Protection Act. We only process the data needed to provide the service and host it exclusively in the European Union.

Data controller

Seer SAS

3 Rue du Pré du Bois, 35000 Rennes, France

Email: contact@seerdesk.com

Data protection contact: contact@seerdesk.com

Legal bases for processing

We only process personal data when we have a legal basis under Article 6 GDPR. Here are the bases we rely on and the data associated with each.

Art. 6(1)(b)

Performance of contract

Processing necessary to perform the contract between SeerDesk and your organization, or to take pre-contractual steps at your request.

- User accounts: username, email address, hashed password
- Machine registration: name, hostname, IP address, MAC address, Ed25519 public key
- Session management: session tokens with 24-hour expiry
- Invitations: email address, assigned role, organization
- Contact form: name, email, company, message content

Art. 6(1)(f)

Legitimate interest

Processing necessary for our legitimate interests (security, abuse prevention, service quality), balanced against your rights. You can object to it.

- Audit log: actions, author's email, IP address, browser, timestamp
- Rate limiting: IP addresses (200 requests/minute/IP)
- Session quality telemetry and crash reports (objection available in the app's Settings)
- Server technical logs: IP address, browser, request

Art. 6(1)(c)

Legal obligation

Processing required by law.

- Billing: legal name, SIREN, VAT number, address and billing contact
- Keeping invoices for 10 years (Article L123-22 of the French Commercial Code)

Data minimization

We follow the data minimization principle of Article 5(1)(c) GDPR: we only collect the data needed for the purposes described above.

- Session content stays off our servers: screen, sound and input travel directly between peers over encrypted WebRTC connections (DTLS/SRTP). Seer SAS servers never receive or record your screen content.
- No profiling: we do not build user profiles and we sell no data to third parties.
- Minimal account data: username, email and a hashed password. No device fingerprinting.
- Automatic expiry: session tokens expire after 24 hours, rate-limit data after 24 hours, and accounts inactive for 12 months are deleted.
- Purpose limitation: every data field we collect serves a specific need of the platform.

Data storage and security

Hosting in the EU

Personal data is hosted by OVH in data centers in France and Germany. Our processors are established in France. None of our customers' personal data is transferred outside the EU or EEA.

End-to-end encryption

All remote desktop streams are encrypted with DTLS/SRTP via WebRTC and travel peer to peer. Our servers do not receive stream content.

Private mesh network

Internal services communicate over an encrypted private mesh network. No internal service is exposed to the public internet.

Credential security

Passwords are hashed before storage and tokens are kept only as hashes. Machine authentication uses public-key cryptography with challenge-response verification.

Your rights

The GDPR gives you the following rights over your personal data. We answer every request within one month.

Right of access (Art. 15) - You can request a copy of all personal data we process about you.

Right to rectification (Art. 16) - You can ask for inaccurate data to be corrected, through your organization's administrator or by writing to us. Machine details can be edited in the platform.

Right to erasure (Art. 17) - You can ask for your data to be deleted by writing to us. An account inactive for 12 months is deleted automatically after two warnings. Machines can be deleted through the API and CLI.

Right to restriction (Art. 18) - You can ask us to restrict processing in certain circumstances, for example while you contest the accuracy of your data or object to processing.

Right to data portability (Art. 20) - On request, we send you your data in a structured, machine-readable format (JSON).

Right to object (Art. 21) - You can object to quality telemetry directly in the app's Settings, and to any other processing based on legitimate interest by writing to us.

If you believe your rights have not been respected, you can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), the French data protection authority, at www.cnil.fr.

Data retention

We keep personal data only as long as needed for the purposes it was collected for, or as long as the law requires.

Data type	Retention period	Justification
User accounts	Contract duration; deleted after 12 months of inactivity	Performance of contract
Session tokens	24 hours	Automatic expiry
Audit log	12 months	Legitimate interest (security)
Quality telemetry	6 to 13 months	Legitimate interest (service quality)
Crash reports	12 months (log excerpts: 90 days)	Legitimate interest (service quality)
Technical logs	30 days at most	Legitimate interest (security)
Rate-limit data	24 hours at most	Legitimate interest (abuse prevention)
Registered machines	Contract duration	Performance of contract
Invitations	Contract duration	Performance of contract
Sent emails	30 days after sending	Performance of contract
Billing data and invoices	10 years	Legal obligation
Contact form submissions	12 months	Pre-contractual steps

Sub-processors

The database, identity provider, authorization engine and monitoring are self-hosted on our servers. The following providers process personal data on our behalf:

OVH SAS

Server hosting and load balancing

France and Germany

Brevo

Transactional email delivery (invitations, invoices, notifications)

France

SUPER PDP

Electronic invoice transmission (approved e-invoicing platform)

France

Data breach notification

If a personal data breach occurs, we apply Articles 33 and 34 GDPR.

- Notification to the CNIL within 72 hours of becoming aware of a qualifying breach
- Notice to affected customers within 48 hours, as set out in our data processing agreement
- Notification to affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms
- Every breach, its effects and the corrective measures recorded in a breach register
- Post-incident review to prevent recurrence

Data processing agreement

A data processing agreement (DPA, Article 28 GDPR) is available to all customers and can be signed on request. It covers the scope of processing, security measures, sub-processors, breach notification and data subject rights. Write to contact@seerdesk.com to get one.

Exercise your rights

To exercise any of your rights, or for any question about how we process your data, contact us using the details below. We reply within one month of receiving your request.

Email: contact@seerdesk.com

Address: 3 Rue du Pré du Bois, 35000 Rennes, France

Response time: one month