Privacy Policy

This Privacy Policy explains how SEQUESTO BV ("SEQUESTO", "we", "us") collects, uses and protects personal data when you visit sequesto.com, fill in a form, attend a webinar, request a demo or trial, or otherwise interact with us.

1. Who we are and what this policy covers

SEQUESTO BV is the data controller for the personal data described in this policy. For any privacy question or request, contact privacy@sequesto.com.

When our customers use the SEQUESTO platform, they decide what data they upload. For that data we act as a processor on their behalf under our customer agreement and data processing agreement, and this policy does not apply to it.

This policy applies to visitors and contacts worldwide. Section 10 sets out additional rights for people in the European Economic Area (EEA) and the United Kingdom. Section 11 sets out additional information for residents of US states with consumer privacy laws.

2. Personal data we collect

Data you give us. Name, business email, job title, company, country, phone number and any message you send through a form, demo or trial request, webinar registration, event or email. Forms on our website are powered by Fillout.

Data collected automatically. When you use our website, we may record certain information about your visit, such as the pages you view, the date and time of your visit, the referring page, campaign parameters (UTM tags), your device and browser type, the IP address assigned to your device and the approximate location derived from it, and interactions such as clicks and scrolls. We may also use cookies or similar tracking technologies that help us understand how our website is used and remember your preferences (section 6).

Data from third parties. Our visitor identification service (RB2B, see section 4) may match your visit to information it holds: for visitors in the United States, to business contact information such as name, job title, company, LinkedIn profile URL and business email; for visitors elsewhere, to the company you work for. We may also receive business contact details from professional data providers and from platforms where you chose to engage with us, such as LinkedIn.

We do not intentionally collect special categories of personal data (for example health data) and ask you not to send them to us.

3. Why we use your data and our legal basis

We use your personal data for the following purposes, on the legal bases set out below (the legal bases apply in the EEA and the UK).

• Responding to demo, trial, contact and webinar requests, using your form data: steps taken prior to entering a contract, or our legitimate interest in responding to your request.
• Sending marketing emails and newsletters, using your form data and email engagement: your consent, given when you opted in on a form.
• Running and securing the website, using IP address, device data and strictly necessary cookies: our legitimate interest in operating a secure website.
• Measuring and improving website performance, using analytics data (Google Analytics 4, Microsoft Clarity): your consent via the cookie banner.
• Advertising, retargeting and measuring campaigns, using advertising cookies and pixels (Google Ads, LinkedIn, Meta, Bing, OpenAI): your consent via the cookie banner.
• Understanding which companies visit our website, using visitor identification services (RB2B, Leadfeeder, Apollo): our legitimate interest in understanding which businesses are interested in our services. Outside the United States, this is limited to identifying the company a visit comes from.
• Managing our sales pipeline and customer relationships, using CRM data in Attio: our legitimate interest in managing business relationships, or performance of a contract.
• Complying with legal obligations, using invoicing, contract and correspondence records: our legal obligations.

Where we rely on consent, you can withdraw it at any time through the cookie settings link on our website or the unsubscribe link in any email. Withdrawal does not affect processing that took place before it.

Where we rely on legitimate interest, we have weighed our interest against your rights and you can object at any time (section 10). We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

4. Website visitor identification

We use a visitor identification service, RB2B, to understand which businesses visit our website. You can opt out at any time using the links below.

Outside the United States, we do not use browsing information to identify you personally: RB2B identifies only the company a visit comes from. For visitors in the United States, RB2B may match your visit to you as an individual business contact.

RB2B requires us to tell you the following. When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout. You can also opt out of this collection under the GDPR at https://www.rb2b.com/rb2b-gdpr-opt-out.

In practice, SEQUESTO only sends marketing emails to people who have opted in through a form (section 5). A visit identified by RB2B does not, on its own, add you to our email marketing.

Identification data is stored in SEQUESTO's own internal systems, separate from the environment our customers use, and is deleted after 12 months (section 9). You can object at any time, or have identification data about you deleted from our systems, by contacting privacy@sequesto.com.

5. Marketing communications

We send marketing emails only to people who have opted in to receive them, by filling in a form on our website or on another platform (for example a webinar or event registration or a LinkedIn lead form).

Every marketing email contains an unsubscribe link. You can also unsubscribe by emailing privacy@sequesto.com. After you unsubscribe, we keep your email address on a suppression list so we do not contact you again.

We use Customer.io to send emails and measure opens and clicks, and Attio to keep a record of our relationship with you.

6. Cookies and consent

We use Cookiebot to manage your cookie choices. Strictly necessary cookies load without consent, because the website cannot work without them. We also use cookies and similar technologies that help us understand how our website is used and which companies visit it (section 4). Analytics and advertising cookies are used once you accept them in the cookie banner.

You can change or withdraw your choice at any time through the cookie settings icon on our website, which also shows the cookies in use, how long each one lasts and the consent you have given. Most cookies expire within 12 months; a few third-party cookies, such as Google Analytics, last slightly longer. Our Cookie Policy explains the categories in more detail.

7. Who we share data with

We share personal data only with service providers that process it on our behalf under written agreements, and where the law requires us to.

• Amazon Web Services: website hosting.
• Cookiebot (Usercentrics): cookie consent management.
• Google (Tag Manager, Analytics 4, Ads): tag management, website analytics, advertising and conversion measurement.
• LinkedIn (Insight Tag): advertising, retargeting and conversion measurement.
• Meta (Pixel): advertising, retargeting and conversion measurement.
• Microsoft (Bing UET, Clarity): advertising measurement, website usage and session analytics.
• RudderStack: routing website event data to our internal systems, CRM and email tools.
• Customer.io: sending marketing and service emails.
• Attio: customer relationship management.
• RB2B (Retention.com): visitor identification (individual business contacts for US visitors, company level elsewhere).
• Leadfeeder (Dealfront): company-level visitor identification.
• Apollo: company-level visitor identification and business contact data.
• OpenAI: measuring advertising campaigns on ChatGPT.
• Fillout: website forms.

Some of these providers, including LinkedIn, Meta and Google for advertising, may also use the data for their own purposes as independent or joint controllers under their own privacy policies.

We may also disclose data to professional advisers, to authorities when legally required, or to a buyer or successor in a merger or acquisition.

8. International transfers

Several of our providers are based in, or process data in, the United States and other countries outside the EEA and UK. When we transfer personal data outside the EEA or UK, we rely on an adequacy decision (including the EU-US Data Privacy Framework and its UK extension, where the provider is certified) or on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, with supplementary measures where needed.

RB2B is based in the United States. For visitors in the EEA and the UK, the data it receives is used only to identify the company a visit comes from. You can opt out using the links in section 4 or by contacting privacy@sequesto.com.

You can request a copy of the relevant safeguards by emailing privacy@sequesto.com.

9. How long we keep your data

• Prospect, lead and marketing data: 12 months from your last interaction with us, unless you become a customer or ask us to delete it sooner.
• Cookies and tracking data: generally up to 12 months; a few third-party cookies last slightly longer (see our Cookie Policy).
• Marketing opt-outs: we keep your email address on a suppression list for as long as needed to respect your opt-out.
• Customer and contract data: for the duration of the contract and afterwards for as long as required by law, including Belgian accounting and tax retention obligations.

When a retention period ends, we delete or anonymise the data.

10. Your rights in the EEA and UK

Under the GDPR and UK GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict our processing in certain circumstances;
• receive your data in a portable format;
• object at any time to processing based on legitimate interest, and to direct marketing, including related profiling;
• withdraw consent at any time, without affecting earlier processing.

To exercise these rights, email privacy@sequesto.com. We will respond within one month. We may ask you to verify your identity before acting on a request.

If you complain to us about how we handle your personal data, we will acknowledge your complaint within 30 days and tell you how we will deal with it.

You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorite de protection des donnees). You can also complain to the authority where you live or work; in the UK, that is the Information Commissioner's Office (ICO). We would appreciate the chance to address your concern first.

11. Additional information for US residents

This section applies to residents of US states with consumer privacy laws, including California.

Categories we collect. In the last 12 months we have collected: identifiers (name, business email, IP address, cookie IDs); professional information (job title, company); internet and website activity; approximate location derived from IP; and information you send us. Sources and purposes are described in sections 2 to 5.

Selling and sharing. We do not sell personal data for money. Our use of advertising pixels (Google, LinkedIn, Meta, Microsoft, OpenAI) and visitor identification services (RB2B, Leadfeeder, Apollo) may be considered "selling" or "sharing" personal data for cross-context behavioural or targeted advertising under some state laws. We do not knowingly sell or share the personal data of anyone under 16.

Your rights. Depending on your state, you may have the right to know what personal data we collect, use and disclose and to access it; to correct inaccurate data; to delete your data; to opt out of the sale or sharing of your data and of targeted advertising; and not to be discriminated against for exercising your rights.

How to opt out. To opt out of advertising cookies, use the cookie settings link on our website and decline marketing cookies. To opt out of visitor identification, use the RB2B opt-out links in section 4. You can also email privacy@sequesto.com.

How to make a request. Email privacy@sequesto.com. We will verify your request using the information you provide and respond within the time the law requires. You may use an authorised agent, who must provide proof of authorisation. If we decline your request, you can appeal by replying to our decision; we will respond to appeals within the time the law requires.

Do Not Track. Our website does not currently respond to browser Do Not Track or Global Privacy Control signals, because there is no single common standard for them. You can opt out using the methods described above.

12. Security, children, changes and contact

Security. We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit and contractual obligations on our providers.

Children. Our website and services are intended for business users. We do not knowingly collect personal data from anyone under 16.

Changes. We will update this policy when our practices change and show the date of the latest version at the top. Where changes are significant, we will highlight them on our website.

Contact. SEQUESTO BV, privacy@sequesto.com.