Skip to content
CERIUM

Legal · Privacy

Privacy Policy

Effective 13 October 2026 · Last updated 13 October 2026

1. Introduction

This Privacy Policy explains how CERES FTS and its affiliates (“Cerium,” “we,” “us,” or “our”) collect, use, and protect personal information when you visit cerium360.com or cerium360.ai (the “Site”) or use the Cerium platform and related services (together, the “Services”). It also sets out your privacy rights and how to exercise them.

Where we process data that our customers upload to the Services, we do so as a processor on their behalf and under their instructions; for that data, the customer is the controller. The data controller for this Site is CERES FTS.

We recognise that information privacy is an ongoing responsibility, and we will update this policy from time to time as we adopt new data practices.

2. Data protection contact

Cerium is headquartered in the United States. Questions about this policy or about our data practices, and requests to exercise the rights described in Section 11, should be directed to our data protection contact:

CERES FTS
support@cerium360.com

3. Information we collect

  • Information you provide — generally limited to your name, job title, employer name, business email address, business phone number, and the contents of your communications with us, submitted through forms, demo requests, or support.
  • Information collected automatically — as is true of most websites, we collect certain information automatically and store it in log files. This may include your internet protocol (IP) address, the general region from which your device accesses the internet, browser type, operating system, the pages you view, and timestamps. We also use cookies, as described in Section 10.
  • Information from third parties — from time to time we receive business contact information about you from third parties, such as professional networks, events, or business data providers. This typically consists of further detail about your employer, role, or industry.
  • Customer platform data — data our customers and their users upload to or generate within the Services, which we process on their behalf and under their instructions.

We do not sell personal information to anyone, and we do not knowingly collect information from children.

4. How we use your information

  • Provide, operate, maintain, and secure the Site and Services.
  • Respond to enquiries, demo requests, and support needs.
  • Send service, security, and administrative communications.
  • Understand how visitors and customers use the Site so that we can design it to suit our users’ needs, diagnose problems with our servers, and plan support coverage.
  • Improve and develop our products.
  • Comply with legal obligations and detect, prevent, and respond to fraud and security incidents.

5. Legal bases for processing

Where the GDPR or a comparable law applies, we process personal information only where we have a lawful basis to do so. The basis depends on what we are doing:

  • Performance of a contract — to provide the Services to you or to the organisation you represent, to administer accounts, and to handle billing.
  • Legitimate interests — to understand how the Site and Services are used, to secure our systems and prevent abuse, to respond to business enquiries, and to communicate with existing customers about the Services they use. We balance these interests against your rights and freedoms, and do not rely on this basis where your interests override ours.
  • Legal obligation — to meet accounting, tax, and other regulatory requirements, and to respond to lawful requests from authorities.
  • Consent — where we ask for it, for example before sending marketing communications in jurisdictions that require consent. You may withdraw consent at any time without affecting processing already carried out.

Where we process Customer platform data as a processor, our customer determines the purpose and the lawful basis for that processing.

6. How we share your information

We do not sell personal information. We share it only with service providers and sub-processors who perform services on our behalf — such as cloud hosting, payment processing, and communications — under contractual confidentiality and data-protection obligations; within our group of companies where necessary to operate the Services; where required by law or to protect rights and safety; and in connection with a business transfer. Our infrastructure is hosted on Amazon Web Services (AWS).

Our service providers do not have access to personal information for any purpose other than performing the service we have engaged them for. We maintain a current list of the sub-processors we use to deliver the Services; to request it, contact us at the address in Section 2.

We do not otherwise disclose your personal data for a third party’s independent use unless you request or authorise it, it is required to comply with the law or enforce an agreement, or it is necessary to protect the rights, property, or safety of our people or others.

7. Transferring personal data to the United States

Cerium is headquartered in the United States, and our cloud infrastructure is hosted there. Information we collect about you will be processed in the United States. By using the Services, you acknowledge that your personal information will be processed in the United States.

We are not currently self-certified under the EU–U.S. Data Privacy Framework, so we do not rely on the European Commission’s adequacy decision for transfers from the EEA. Instead, under Article 46 of the GDPR, we provide appropriate safeguards by entering into binding standard contractual clauses that are enforceable by data subjects in the EEA, the UK, and Switzerland, and we enter into data processing agreements with our vendors. Depending on the circumstances, we may also transfer personal data with your consent, to perform a contract with you, or in reliance on a legitimate interest that does not override your rights and freedoms.

We apply suitable safeguards to protect the privacy and security of your personal data and use it only in a manner consistent with your relationship with us and the practices described in this policy.

8. Data retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy and to comply with legal obligations. For example, customer account data is made available for export for 30 days following termination of the customer agreement, after which it is securely deleted in accordance with our Terms of Service. Information about prospects is retained until it no longer has business value, at which point it is purged from our systems. Personal information is deleted or de-identified once it no longer has a business use.

For more detail on where and for how long your personal data is stored, contact us at the address in Section 2.

9. Data security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption of data in transit and at rest, access controls, monitoring, and logging. No method of transmission or storage is completely secure, but we work to protect your information and continually improve our controls.

10. Cookies

We use only strictly necessary cookies — to sign you in, keep you signed in, and protect your session from attack. We set no analytics, advertising, or third-party cookies, and for that reason the Site does not present a cookie consent banner.

You can control cookies through your browser settings, but because these cookies are how you remain signed in, blocking them will prevent you from using the platform. For the full list, including each cookie’s purpose and duration, see our Cookie Policy.

11. Your rights

The GDPR and other privacy laws give data subjects certain rights. Depending on where you are located, these include:

  • The right to be informed about how your personal data is used.
  • The right of access to the personal data we hold about you.
  • The right to rectification of inaccurate or incomplete data.
  • The right to erasure, subject to certain exceptions.
  • The right to restrict processing.
  • The right of data portability.
  • The right to object to processing, including processing for direct marketing.
  • Rights related to automated decision making, including profiling (see Section 12).

You may also request information about the purpose of the processing, the categories of personal data concerned, who outside Cerium may have received it, the source of the data where you did not provide it to us directly, and how long it will be stored.

To exercise any of these rights, contact us at the address in Section 2. Reasonable access to your personal data is provided at no cost. If we cannot respond within a reasonable time frame, we will tell you when to expect a response; if we must decline a request, we will explain why. You also have the right to lodge a complaint with your local Data Protection Authority in the EU/EEA member state where you reside or work, or with the Information Commissioner’s Office (ICO) in the UK.

U.S. state privacy rights. If you are a resident of California or of another U.S. state with a comprehensive privacy law, you may have the right to know what personal information we collect and the purposes for which we use it, to request a copy of it, to request its correction or deletion, and to be free from discrimination for exercising those rights. We do not sell personal information, and we do not share it for cross-context behavioural advertising; because we set no advertising or analytics cookies, there is no such sharing to opt out of. We do not use or disclose sensitive personal information beyond the purposes permitted under applicable law. To exercise these rights, or to submit a request through an authorised agent, contact us at the address in Section 2; we will verify your request before acting on it.

12. Automated decision making

We do not make decisions about you by solely automated means that produce legal effects concerning you or otherwise significantly affect you. The Services may apply automated analysis to data our customers submit, but that processing is carried out on our customers’ instructions and for their own purposes; where it involves personal data, the customer is the controller and determines how the output is used.

13. Children’s data

The Services are intended for business use by adults. We do not knowingly solicit or collect personal information from children. If you believe a child has provided us with personal information, contact us at the address in Section 2 and we will delete it.

14. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above. Your continued use of the Site or Services after changes take effect constitutes acceptance of the updated policy.

15. Questions, concerns, or complaints

If you have questions, concerns, or complaints about this policy, or wish to exercise your rights, please email us at support@cerium360.com.