Scaleway Privacy Policy changes — 20240421_rev01

1

Scaleway S.A.S is committed to protecting and respecting your privacy and the confidentiality of your personal data.

2

In this context, this Privacy Policy therefore explains the types of personal data Scaleway collects and how we use it.

1

## Overview

3

2

4

1. Personal data we collect

5

When you sign up for our services and during the provision of those services, Scaleway collects the following categories of data:

3

SCALEWAY attaches great importance to compliance with regulations relating to the protection of personal data and in particular the General Data Protection Regulation (EU Regulation 2016/679 of the European Parliament known as "GDPR") and the data processing and freedom law (law no. 78-17 of January 6, 1978 relating to data processing, files and freedoms).

6

4

7

Identification data: surname, forename, postal and email address, telephone number, customer number etc.

8

Billing and/or payment data: bank account details, methods of payment, bills, etc.

9

User data: services purchased, products used, charges, communications, etc.

10

Customer relationship data: requests for support, correspondence with customers, etc.

5

In this context, this Privacy Policy will help you to understand what personal data concerning you is collected by Scaleway and what it is intended for.

11

6

12

2. How we use your data

13

Scaleway uses your data to perform and manage your contract. This includes managing your Customer account and our contractual relationship, installing, maintaining, providing and managing the service purchased or the product ordered, providing support services, processing your requests, billing the service or product, handling complaints and disputes and debt recovery procedures, which may involve third parties. Scaleway may also use automated analysis of the data you have provided to it in order to prevent possible payment difficulties and, if necessary, ask you for additional supporting documents or an advance on consumption. For more information, Scaleway recommends you to contact its Customer Service.

14

These data are retained for up to 5 years from the end of the contractual relationship and/or for the time imposed by law. Without these data, Scaleway would not be able to provide the services you have purchased.

7

## Scope

15

8

16

Scaleway may also use your data in its legitimate interests. Your data will allow Scaleway to assess and improve its services and develop new services, and to implement loyalty, direct marketing, customer satisfaction and promotional campaigns.

17

Unless you opt out, you may receive offers from Scaleway or its commercial partners, by post and/or telephone, and emails promoting services similar to those offered by Scaleway. With your express consent, Scaleway may email you commercial information on other different types of services.

18

Your data may also be used to protect the security of the network and prevent fraud or as part of a merger, asset sale or transfer of all or part of its business, by transferring your Customer personal data to the one or more third parties involved in the transaction.

19

These data will be retained for the time needed to achieve those purposes and for no more than three years after the end of the contractual relationship, as regards direct marketing purposes.

9

This privacy policy is intended to govern the processing carried out by Scaleway as data controller (Scaleway, 8 RUE DE LA VILLE L'EVÊQUE 75008 PARIS 8), in particular the data collected in the context of

20

10

21

Scaleway may also use your data to respect its legal obligations (including under anti-fraud and money-laundering laws and the legislation on late payments and payment defaults) and/or to reply to requests submitted by public and governmental bodies. These data will be retained for the legal period only.

11

- the management of your customer account

12

- the management of marketing communications or prospection

13

- the use of one of our websites (not already covered by a specific privacy policy)

14

- the recruitment management

15

- the compliance with our legal obligations

16

- the guarantee of legitimate interests

22

17

23

3. Your preferences regarding the collection and use of your data

24

You may access your data, rectify it, request its erasure, object to processing on legitimate grounds relating to your particular situation and exercise your right to data portability, at any time, via your Account Management Console or by emailing your request at: privacy\[at\]scaleway.com

25

By sending an email to this address, you can also define instructions for the processing of your personal data after your death. According to the nature of your request, a proof of identity may be required.

26

Scaleway is not under any obligation to erase the data needed for the purpose for which it was collected, required to ensure compliance with a statutory obligation and/or to confirm, exercise or defend rights before a court of law.

27

You can contact the Personal Data Protection Officer for questions relating to the protection of your personal data at: dpo\[at\]iliad.fr

28

If you are not happy with our handling of a complaint, you may contact the French Data Protection Agency (Commission Nationale de l'Informatique et des Libertés or "CNIL"), in charge of regulating compliance with personal data obligations.

18

## What kind of personal data is processed ?

29

19

30

4. Security of your data

31

Scaleway takes all steps required to protect the personal data processed and carefully selects all its partners and service providers who may have to access your data. Your data is processed electronically and/or manually and, in both cases, Scaleway ensures an appropriate level of security, protection and confidentiality based on the sensitivity of your data, using administrative, technical and physical measures preventing any loss or theft or any unauthorised use, disclosure or alteration of your data.

20

Scaleway is required to process the following categories of data:

32

21

33

5. Access to your personal data

34

Your personal data is processed by Scaleway, its subcontractors and partners, to manage the contract and provide the services you have requested or authorised.

35

Your data may also be transferred to third parties, providing services or support and advice to Scaleway.

36

On request, it may also be transferred to the persons and authorities granted access to personal data under applicable laws or regulations or provisions adopted by legally competent authorities.

22

- Data relating to identity: name, first name, postal and email address, telephone number, customer number, signature, proof of identity.

23

- Billing data: bank details, means of payment, invoices, etc.

24

- Consumption data: history of services and products used, event logs etc.

25

- Communication data: history of exchanges with Scaleway, complaints, support tickets, etc.

26

- Connection data: IP address, user ID, location data, connection and event logs etc.

37

27

38

Scaleway's subcontractors and partners may be located outside the European Union. If they are located in a country that has not been recognised as providing an adequate level of protection, Scaleway requires them to comply with its requirements for the security and confidentiality of your personal data and only authorised them to process your data for the purposes determined by Scaleway. These subcontractors and partners must first sign the standard contractual clauses published by the European Commission.

28

The categories of data used are indicated in each of the treatments in the following section. Any reference to "user account data" includes all account data.

39

29

40

6. Amendments to this Privacy Policy

41

This Privacy Policy may be amended, mainly to reflect changes in applicable laws and regulations and changes in our practices and technologies.

30

## How we use your data.

42

31

43

- Last updated : September 2020

32

Contracts management and customer relations

44

33

45

SCALEWAY S.A.S, BP 438, F-75366 Paris Cedex 08

46

A French société par actions simplifiée with a share capital of €214,410.50

47

Paris Trade and Companies Register number: B 433 115 904

34

Scaleway processes your data in order to manage contracts for the services you use. This includes the management of accounts, support and payment methods.

35

36

| | | | | |

37

| --- | --- | --- | --- | --- |

38

39

| Management of contracts and customer relations (management of accounts, support and means of payment) | Identity data Billing data Consumption data Communication data Connection data | Execution of the contract | Duration of the contractual relationship plus an archiving period to meet our legal obligations and guarantee the defense of our legitimate interest | Scaleway Services Entitled Scaleway Partners for support and payment management Authorized third parties\* |

40

| Management of contracts with our partners (service providers and suppliers) | Identity data Commercial relationship monitoring data (activity reports and, communications) | Execution of the contract | Duration of the contractual relationship | Scaleway Services Entitled Scaleway Partner for the management of suppliers Authorized third parties |

41

42

Sales and Marketing

43

44

Scaleway processes certain data in order to send its service offers to its customers or prospects, guests for events or even collect their opinions on products (processing may involve profiling techniques). These processing operations may be based either on legitimate interest, if the person is already a customer of the company, particularly if the proposals concern products or services similar to those already subscribed, or on consent. Scaleway mainly collects this data directly but can also obtain it indirectly via specialized data processors in conformity with all applicable legal requirements.

45

46

| | | | | |

47

| --- | --- | --- | --- | --- |

48

49

| Commercial prospecting and communication campaigns relating to our products and services | Identity data Billing data Consumption data Communication data Connection data | Legitimate interest Consent | Duration of the contractual relationship Account deletion request withdrawal of consent objection of the person | Scaleway Sales and Marketing Teams Entitled Scaleway Partners for the management of marketing campaigns and customer relation Authorized third parties |

50

| Organization of events to promote our services | Identity data Communication data Connection data | Legitimate interest Consent | Duration of the contractual relationship Account deletion request | Scaleway Sales and Marketing Teams Entitled Scaleway Partners for the management of events Authorized third parties |

51

| Management of cookies and other trackers (learn more about our cookie policy) | Connection data | Consent | Cookies are stored between 3 months and 1 year depending on the type of cookie used | Scaleway Sales and Marketing Teams Entitled Scaleway Partners for the cookies management Authorized third parties |

52

| Carrying out satisfaction surveys or quality surveys on our services and the training of our teams | Identity data Billing data Consumption data Communication data Connection data Audio or video recording | Legitimate interest Consent | 1 year and anonymization | Scaleway Sales and Marketing Teams Entitled Scaleway Partners for marketing analysis Authorized third parties |

53

| Produce usage statistics | Connection data | Legitimate interest | Cookies: between 3 months and 1 year Service usage data kept during the contractual period or anonymized | Scaleway Sales and Marketing Teams Entitled Scaleway Partners for quality analysis Authorized third parties |

54

55

Recruitment

56

57

Scaleway also processes the personal data of candidates as part of its recruitment procedure.

58

59

| | | | | |

60

| --- | --- | --- | --- | --- |

61

62

| Recruitment | Identity data | Execution of contract or pre-contractual measures | If the application is not accepted, the data is kept for a maximum period of 2 years If the application is accepted, the data is kept for the entire duration of the contract, accompanied by an archiving period intended to comply with our legal obligations or guarantee the legitimate interests of the company. | Human resources services Manager and team concerned Scaleway partners for human resources Authorized third parties |

63

64

Legal obligations

65

66

Scaleway processes some of your data in order to meet its legal obligations. This is particularly the case in order to secure our services as a provider of electronic communications services, to meet our accounting and tax obligations or to process your requests for rights relating to data protection.

67

68

| | | | | |

69

| --- | --- | --- | --- | --- |

70

71

| Guarantee the security of our customers as a provider of electronic communications services (Directive 2002/58/EC and art 32 of the GDPR) | Identity data Billing data Consumption data Communication data Connection data | Legal obligation | Duration of the contractual relationship plus an archiving period for the data necessary to guarantee compliance with our legal obligations | Entitled Scaleway Services Entitled Scaleway Partners for security management Authorized third parties (auditors etc.) |

72

| Abuse of Scaleway services includes cyber-crime, copyright violation, illegal or offensive content, spamming and malware distribution. Abuse should be reported in the console. These data processings are likely to be subject to automated decision-making (e.g. anti-spam control) | Identity data User account information | Legal obligation | Duration necessary to meet our legal obligations | Entitled Scaleway Services Entitled Scaleway Partners for the ticketing and support management Authorized third parties |

73

| Responses to the data protection requests and any complaints related to the protection of personal data | Identity data (including proof of identity) User account information ll the data related to the complaint | Legal obligation | 5 years from ticket closing Verification of identity card: 1 month | Entitled Scaleway Services Entitled Scaleway Partner for the management of subject requests Authorized third parties Entitled Iliad service |

74

| Data breaches management | Identity data User account information related to the data breach All data related to the data breach | Legal obligation | 5 years from the closure of the data breach | Entitled Scaleway Services Competent administrative authority |

75

| Accounting obligations | Billing data | Legal obligation | 10 years from the end of the contract | Entitled Scaleway Services Entitled Scaleway Partner for the management of payments and invoices Competent administrative authority |

76

| Legal or administrative procedure management | Identity data User account information related to the case | Legal obligation | The necessary data is kept until the expiration of the legal remedies | Scaleway Legal Department Iliad Legal Department Competent administrative authority Entitled third parties (legal advisor etc.) |

77

78

Legitimate interest

79

80

Scaleway processes some of your data in order to meet a legitimate interest. This is particularly the case in order to secure our services, ensure the management of unpaid debts and the training of our teams (processing relating to security or fraud may involve profiling techniques).

81

82

| | | | | |

83

| --- | --- | --- | --- | --- |

84

85

| Guarantee the security of services we offer | Identity data User account information | Legitimate interest | Duration of the contractual relationship or duration limited to the limitation period from the closure of the event concerned | Scaleway IT security service Competent administrative authority |

86

87

| Fraud detection and prevention | Bank details Identity data User account information | Legitimate interest | 5 years maximum from the suspicion of an incident ID card verification: 1 month | Entitled Scaleway service Entitled Scaleway Partner for support and ticketing |

88

| Litigation management | Identity data Data necessary for the purposes of establishing evidence | Legitimate interest | The data is kept until the expiration of the legal remedies and archived for 10 years | Scaleway legal department Entitled Scaleway partner |

89

90

91

## Data processors

92

93

As a data controller, Scaleway uses data processors for the following purposes:

94

95

- customer relationship management (support management, etc.)

96

- carrying out emailing campaigns and surveys on the services

97

- partnership management with other cloud providers

98

- meeting our legal obligations (accounting, data protection etc.)

99

- marketing data analysis

100

- website data analysis

101

- management of payment services

102

- consulting or audit firms

103

- the organization of events

104

- security and identity control

105

106

Scaleway selects its data processors through a strict security control procedure to ensure that they only process data for the purposes for which they have been chosen. Scaleway also ensures that its data processors have technical and organizational security measures in accordance with the regulations relating to the protection of personal data.

107

108

## Transfer of data outside the European Union

109

110

Scaleway strives to minimize data transfers outside the European Union and only carries out such transfers as data controller for the purposes listed above. Data transferred as part of our services is governed by our [Data Processing Agreement (DPA)](https://www.scaleway.com/en/contracts/)

111

112

All transfers outside the European Union are subject to a strict control to ensure that the contracts entered into with our service providers comply with the Standard Contractual Clauses (SCC) updated by the implementing decision ( EU) 2021/914 of the Commission of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council (Text presenting interest for the EEA) and where possible, to supplement these clauses

113

114

Scaleway undertakes to inform its customers in advance in the event of a request for information from an administrative or judicial authority in order to enable them to assert their rights subject to compliance with applicable regulations. Scaleway cannot oppose such a request if it complies with French or European regulations, an international agreement (art. 48 of the GDPR) or with one of the exemptions provided for in art. 49 of the GDPR.

115

116

Children

117

118

Scaleway does not provide services to children. Any children wishing to use our services must be accompanied and under the responsibility of an adult.

119

with appropriate security measures.

120

121

## Requests from authorities

122

123

Scaleway undertakes to inform its customers in advance in the event of a request for information from an administrative or judicial authority in order to enable them to assert their rights subject to compliance with applicable regulations. Scaleway cannot oppose such a request if it complies with French or European regulations, an international agreement (art. 48 of the GDPR) or with one of the exemptions provided for in art. 49 of the GDPR.

124

125

## Children

126

127

Scaleway does not provide services to children. Any children wishing to use our services must be accompanied and under the responsibility of an adult.

128

129

## Link to our partners

130

131

Our sites may contain links to our partners. We inform you that these links refer directly to the sites of these partners who have their own confidentiality policy for which Scaleway cannot be held responsible.

132

133

## Data Security

134

135

Scaleway implements technical and organizational security measures to guarantee the constant confidentiality, integrity, availability and resilience of its information systems and services. These measures meet the state of the art and are adapted to the type of data concerned. All of our staff are aware of IT security and data protection issues.

136

137

Our security measures specifically meet data protection regulations and in particular the following points:

138

139

- Information systems security policy (ISSP)

140

- Physical protection measures for all of our data centers

141

- Secure authentication of user accounts

142

- Logging

143

- Security Information and Event Management (SIEM)

144

- Incident management procedure

145

- Secure management procedure for data processors

146

- Procedure for handling data breaches

147

- Secure data backup

148

- Anonymization of data when personal data is no longer necessary for processing in order to produce statistics or improve our services or marketing communication

149

150

In accordance with our general conditions of service, we remind you that the customer is solely responsible for the management and security of its content as well as the environments and systems that it deploys on the infrastructures made available to it as part of the services offered by Scaleway. It is also up to the customer to make any backups of their content (or other means aimed at ensuring their longevity) that he considers necessary in order to protect against possible deletion, alteration or modification of said content.

151

152

For more information regarding all of our security measures, you can consult our [Security and Resilience page.](https://www.scaleway.com/en/security-and-resilience/)

153

154

If you have identified a vulnerability or would like to send us a security question, please send it to us at: [security@scaleway.com](mailto:security@scaleway.com)

155

156

Scaleway informs you that you have the following rights depending on the purpose of processing:

157

158

- Be informed why we process your personal information

159

- Access your data and obtain a copy of the personal data we process about you

160

- Rectify incorrect, incomplete or outdated data

161

- Limit the use of your data

162

- Oppose the processing of your data if it is processed on the basis of legitimate interest

163

- Withdraw your consent at any time if the processing is based on this legal basis

164

- Delete data that is no longer necessary for processing or to meet a legal obligation

165

- Exercise your right to portability

166

167

You can exercise your rights directly in the privacy section of your Scaleway account or via privacy@scaleway.com. If you believe that your rights have not been respected, you can also file a complaint [with the competent supervisory authority](https://www.edpb.europa.eu/about-edpb/about-edpb/members_fr).

168

169

## Policy update

170

171

This privacy policy may be updated according to regulatory developments. Any modification will enter into force from its date of publication.

172

173

_Last update : january 2024_

+Scaleway S.A.S is committed to protecting and respecting your privacy and the confidentiality of your personal data.
+In this context, this Privacy Policy therefore explains the types of personal data Scaleway collects and how we use it.
+## Overview
+. Personal data we collect
+    When you sign up for our services and during the provision of those services, Scaleway collects the following categories of data:
+SCALEWAY attaches great importance to compliance with regulations relating to the protection of personal data and in particular the General Data Protection Regulation (EU Regulation 2016/679 of the European Parliament known as "GDPR") and the data processing and freedom law (law no. 78-17 of January 6, 1978 relating to data processing, files and freedoms).
+Identification data: surname, forename, postal and email address, telephone number, customer number etc.
+Billing and/or payment data: bank account details, methods of payment, bills, etc.
+User data: services purchased, products used, charges, communications, etc.
+Customer relationship data: requests for support, correspondence with customers, etc.
+In this context, this Privacy Policy will help you to understand what personal data concerning you is collected by Scaleway and what it is intended for.
+. How we use your data
+    Scaleway uses your data to perform and manage your contract. This includes managing your Customer account and our contractual relationship, installing, maintaining, providing and managing the service purchased or the product ordered, providing support services, processing your requests, billing the service or product, handling complaints and disputes and debt recovery procedures, which may involve third parties. Scaleway may also use automated analysis of the data you have provided to it in order to prevent possible payment difficulties and, if necessary, ask you for additional supporting documents or an advance on consumption. For more information, Scaleway recommends you to contact its Customer Service.
+    These data are retained for up to 5 years from the end of the contractual relationship and/or for the time imposed by law. Without these data, Scaleway would not be able to provide the services you have purchased.
+## Scope
+Scaleway may also use your data in its legitimate interests. Your data will allow Scaleway to assess and improve its services and develop new services, and to implement loyalty, direct marketing, customer satisfaction and promotional campaigns.
+Unless you opt out, you may receive offers from Scaleway or its commercial partners, by post and/or telephone, and emails promoting services similar to those offered by Scaleway. With your express consent, Scaleway may email you commercial information on other different types of services.
+Your data may also be used to protect the security of the network and prevent fraud or as part of a merger, asset sale or transfer of all or part of its business, by transferring your Customer personal data to the one or more third parties involved in the transaction.
+These data will be retained for the time needed to achieve those purposes and for no more than three years after the end of the contractual relationship, as regards direct marketing purposes.
+This privacy policy is intended to govern the processing carried out by Scaleway as data controller (Scaleway, 8 RUE DE LA VILLE L'EVÊQUE 75008 PARIS 8), in particular the data collected in the context of
+Scaleway may also use your data to respect its legal obligations (including under anti-fraud and money-laundering laws and the legislation on late payments and payment defaults) and/or to reply to requests submitted by public and governmental bodies. These data will be retained for the legal period only.
+- the management of your customer account
+- the management of marketing communications or prospection
+- the use of one of our websites (not already covered by a specific privacy policy)
+- the recruitment management
+- the compliance with our legal obligations
+- the guarantee of legitimate interests
+. Your preferences regarding the collection and use of your data
+    You may access your data, rectify it, request its erasure, object to processing on legitimate grounds relating to your particular situation and exercise your right to data portability, at any time, via your Account Management Console or by emailing your request at: privacy\[at\]scaleway.com
+    By sending an email to this address, you can also define instructions for the processing of your personal data after your death. According to the nature of your request, a proof of identity may be required.
+    Scaleway is not under any obligation to erase the data needed for the purpose for which it was collected, required to ensure compliance with a statutory obligation and/or to confirm, exercise or defend rights before a court of law.
+    You can contact the Personal Data Protection Officer for questions relating to the protection of your personal data at: dpo\[at\]iliad.fr
+    If you are not happy with our handling of a complaint, you may contact the French Data Protection Agency (Commission Nationale de l'Informatique et des Libertés or "CNIL"), in charge of regulating compliance with personal data obligations.
+## What kind of personal data is processed ?
+. Security of your data
+    Scaleway takes all steps required to protect the personal data processed and carefully selects all its partners and service providers who may have to access your data. Your data is processed electronically and/or manually and, in both cases, Scaleway ensures an appropriate level of security, protection and confidentiality based on the sensitivity of your data, using administrative, technical and physical measures preventing any loss or theft or any unauthorised use, disclosure or alteration of your data.
+Scaleway is required to process the following categories of data:
+. Access to your personal data
+    Your personal data is processed by Scaleway, its subcontractors and partners, to manage the contract and provide the services you have requested or authorised.
+    Your data may also be transferred to third parties, providing services or support and advice to Scaleway.
+    On request, it may also be transferred to the persons and authorities granted access to personal data under applicable laws or regulations or provisions adopted by legally competent authorities.
+- Data relating to identity: name, first name, postal and email address, telephone number, customer number, signature, proof of identity.
+- Billing data: bank details, means of payment, invoices, etc.
+- Consumption data: history of services and products used, event logs etc.
+- Communication data: history of exchanges with Scaleway, complaints, support tickets, etc.
+- Connection data: IP address, user ID, location data, connection and event logs etc.
+Scaleway's subcontractors and partners may be located outside the European Union. If they are located in a country that has not been recognised as providing an adequate level of protection, Scaleway requires them to comply with its requirements for the security and confidentiality of your personal data and only authorised them to process your data for the purposes determined by Scaleway. These subcontractors and partners must first sign the standard contractual clauses published by the European Commission.
+The categories of data used are indicated in each of the treatments in the following section. Any reference to "user account data" includes all account data.
+. Amendments to this Privacy Policy
+    This Privacy Policy may be amended, mainly to reflect changes in applicable laws and regulations and changes in our practices and technologies.
+## How we use your data.
+- Last updated : September 2020
+Contracts management and customer relations
+SCALEWAY S.A.S, BP 438, F-75366 Paris Cedex 08
+A French société par actions simplifiée with a share capital of €214,410.50
+Paris Trade and Companies Register number: B 433 115 904
+Scaleway processes your data in order to manage contracts for the services you use. This includes the management of accounts, support and payment methods.
+| | | | | |
+| --- | --- | --- | --- | --- |
+| Purposes | Categories of data | Legal basis | Retention | Categories of recipients |
+| Management of contracts and customer relations (management of accounts, support and means of payment) | Identity data Billing data Consumption data Communication data Connection data | Execution of the contract | Duration of the contractual relationship plus an archiving period to meet our legal obligations and guarantee the defense of our legitimate interest | Scaleway Services Entitled Scaleway Partners for support and payment management Authorized third parties\* |
+| Management of contracts with our partners (service providers and suppliers) | Identity data Commercial relationship monitoring data (activity reports and, communications) | Execution of the contract | Duration of the contractual relationship | Scaleway Services Entitled Scaleway Partner for the management of suppliers Authorized third parties |
+Sales and Marketing
+Scaleway processes certain data in order to send its service offers to its customers or prospects, guests for events or even collect their opinions on products (processing may involve profiling techniques). These processing operations may be based either on legitimate interest, if the person is already a customer of the company, particularly if the proposals concern products or services similar to those already subscribed, or on consent. Scaleway mainly collects this data directly but can also obtain it indirectly via specialized data processors in conformity with all applicable legal requirements.
+| | | | | |
+| --- | --- | --- | --- | --- |
+| Purposes | Categories of data | Legal basis | Retention | Categories of recipients |
+| Commercial prospecting and communication campaigns relating to our products and services | Identity data Billing data Consumption data Communication data Connection data | Legitimate interest Consent | Duration of the contractual relationship Account deletion request withdrawal of consent objection of the person | Scaleway Sales and Marketing Teams Entitled Scaleway Partners for the management of marketing campaigns and customer relation Authorized third parties |
+| Organization of events to promote our services | Identity data Communication data Connection data | Legitimate interest Consent | Duration of the contractual relationship Account deletion request | Scaleway Sales and Marketing Teams Entitled Scaleway Partners for the management of events Authorized third parties |
+| Management of cookies and other trackers (learn more about our cookie policy) | Connection data | Consent | Cookies are stored between 3 months and 1 year depending on the type of cookie used | Scaleway Sales and Marketing Teams Entitled Scaleway Partners for the cookies management Authorized third parties |
+| Carrying out satisfaction surveys or quality surveys on our services and the training of our teams | Identity data Billing data Consumption data Communication data Connection data Audio or video recording | Legitimate interest Consent | 1 year and anonymization | Scaleway Sales and Marketing Teams Entitled Scaleway Partners for marketing analysis Authorized third parties |
+| Produce usage statistics | Connection data | Legitimate interest | Cookies: between 3 months and 1 year Service usage data kept during the contractual period or anonymized | Scaleway Sales and Marketing Teams Entitled Scaleway Partners for quality analysis Authorized third parties |
+Recruitment
+Scaleway also processes the personal data of candidates as part of its recruitment procedure.
+| | | | | |
+| --- | --- | --- | --- | --- |
+| Purposes | Categories of data | Legal basis | Retention | Categories of recipients |
+| Recruitment | Identity data | Execution of contract or pre-contractual measures | If the application is not accepted, the data is kept for a maximum period of 2 years If the application is accepted, the data is kept for the entire duration of the contract, accompanied by an archiving period intended to comply with our legal obligations or guarantee the legitimate interests of the company. | Human resources services Manager and team concerned Scaleway partners for human resources Authorized third parties |
+Legal obligations
+Scaleway processes some of your data in order to meet its legal obligations. This is particularly the case in order to secure our services as a provider of electronic communications services, to meet our accounting and tax obligations or to process your requests for rights relating to data protection.
+| | | | | |
+| --- | --- | --- | --- | --- |
+| Purposes | Categories of data | Legal basis | Retention | Categories of recipients |
+| Guarantee the security of our customers as a provider of electronic communications services (Directive 2002/58/EC and art 32 of the GDPR) | Identity data Billing data Consumption data Communication data Connection data | Legal obligation | Duration of the contractual relationship plus an archiving period for the data necessary to guarantee compliance with our legal obligations | Entitled Scaleway Services Entitled Scaleway Partners for security management Authorized third parties (auditors etc.) |
+| Abuse of Scaleway services includes cyber-crime, copyright violation, illegal or offensive content, spamming and malware distribution. Abuse should be reported in the console. These data processings are likely to be subject to automated decision-making (e.g. anti-spam control) | Identity data User account information | Legal obligation | Duration necessary to meet our legal obligations | Entitled Scaleway Services Entitled Scaleway Partners for the ticketing and support management Authorized third parties |
+| Responses to the data protection requests and any complaints related to the protection of personal data | Identity data (including proof of identity) User account information ll the data related to the complaint | Legal obligation | 5 years from ticket closing Verification of identity card: 1 month | Entitled Scaleway Services Entitled Scaleway Partner for the management of subject requests Authorized third parties Entitled Iliad service |
+| Data breaches management | Identity data User account information related to the data breach All data related to the data breach | Legal obligation | 5 years from the closure of the data breach | Entitled Scaleway Services Competent administrative authority |
+| Accounting obligations | Billing data | Legal obligation | 10 years from the end of the contract | Entitled Scaleway Services Entitled Scaleway Partner for the management of payments and invoices Competent administrative authority |
+| Legal or administrative procedure management | Identity data User account information related to the case | Legal obligation | The necessary data is kept until the expiration of the legal remedies | Scaleway Legal Department Iliad Legal Department Competent administrative authority Entitled third parties (legal advisor etc.) |
+Legitimate interest
+Scaleway processes some of your data in order to meet a legitimate interest. This is particularly the case in order to secure our services, ensure the management of unpaid debts and the training of our teams (processing relating to security or fraud may involve profiling techniques).
+| | | | | |
+| --- | --- | --- | --- | --- |
+| Purposes | Categories of data | Legal basis | Retention | Categories of recipients |
+| Guarantee the security of services we offer | Identity data User account information | Legitimate interest | Duration of the contractual relationship or duration limited to the limitation period from the closure of the event concerned | Scaleway IT security service Competent administrative authority |
+| Debt collection | Identity data User account information | Legitimate interest | 5 years from the payment incident | Scaleway Legal and Accounting Services Entitled Scaleway Partner for debt collection |
+| Fraud detection and prevention | Bank details Identity data User account information | Legitimate interest | 5 years maximum from the suspicion of an incident ID card verification: 1 month | Entitled Scaleway service Entitled Scaleway Partner for support and ticketing |
+| Litigation management | Identity data Data necessary for the purposes of establishing evidence | Legitimate interest | The data is kept until the expiration of the legal remedies and archived for 10 years | Scaleway legal department Entitled Scaleway partner |
+| Ensure the training of our teams | Identity data User account information | Legitimate interest | The data is kept during the contractual period | Entitled Scaleway service |
+## Data processors
+As a data controller, Scaleway uses data processors for the following purposes:
+- customer relationship management (support management, etc.)
+- carrying out emailing campaigns and surveys on the services
+- partnership management with other cloud providers
+- meeting our legal obligations (accounting, data protection etc.)
+- marketing data analysis
+- website data analysis
+- management of payment services
+- consulting or audit firms
+- the organization of events
+- security and identity control
+Scaleway selects its data processors through a strict security control procedure to ensure that they only process data for the purposes for which they have been chosen. Scaleway also ensures that its data processors have technical and organizational security measures in accordance with the regulations relating to the protection of personal data.
+## Transfer of data outside the European Union
+Scaleway strives to minimize data transfers outside the European Union and only carries out such transfers as data controller for the purposes listed above. Data transferred as part of our services is governed by our [Data Processing Agreement (DPA)](https://www.scaleway.com/en/contracts/)
+All transfers outside the European Union are subject to a strict control to ensure that the contracts entered into with our service providers comply with the Standard Contractual Clauses (SCC) updated by the implementing decision ( EU) 2021/914 of the Commission of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council (Text presenting interest for the EEA) and where possible, to supplement these clauses
+Scaleway undertakes to inform its customers in advance in the event of a request for information from an administrative or judicial authority in order to enable them to assert their rights subject to compliance with applicable regulations. Scaleway cannot oppose such a request if it complies with French or European regulations, an international agreement (art. 48 of the GDPR) or with one of the exemptions provided for in art. 49 of the GDPR.
+Children
+Scaleway does not provide services to children. Any children wishing to use our services must be accompanied and under the responsibility of an adult.
+with appropriate security measures.
+## Requests from authorities
+Scaleway undertakes to inform its customers in advance in the event of a request for information from an administrative or judicial authority in order to enable them to assert their rights subject to compliance with applicable regulations. Scaleway cannot oppose such a request if it complies with French or European regulations, an international agreement (art. 48 of the GDPR) or with one of the exemptions provided for in art. 49 of the GDPR.
+## Children
+Scaleway does not provide services to children. Any children wishing to use our services must be accompanied and under the responsibility of an adult.
+## Link to our partners
+Our sites may contain links to our partners. We inform you that these links refer directly to the sites of these partners who have their own confidentiality policy for which Scaleway cannot be held responsible.
+## Data Security
+Scaleway implements technical and organizational security measures to guarantee the constant confidentiality, integrity, availability and resilience of its information systems and services. These measures meet the state of the art and are adapted to the type of data concerned. All of our staff are aware of IT security and data protection issues.
+Our security measures specifically meet data protection regulations and in particular the following points:
+- Information systems security policy (ISSP)
+- Physical protection measures for all of our data centers
+- Secure authentication of user accounts
+- Logging
+- Security Information and Event Management (SIEM)
+- Incident management procedure
+- Secure management procedure for data processors
+- Procedure for handling data breaches
+- Secure data backup
+- Anonymization of data when personal data is no longer necessary for processing in order to produce statistics or improve our services or marketing communication
+In accordance with our general conditions of service, we remind you that the customer is solely responsible for the management and security of its content as well as the environments and systems that it deploys on the infrastructures made available to it as part of the services offered by Scaleway. It is also up to the customer to make any backups of their content (or other means aimed at ensuring their longevity) that he considers necessary in order to protect against possible deletion, alteration or modification of said content.
+For more information regarding all of our security measures, you can consult our [Security and Resilience page.](https://www.scaleway.com/en/security-and-resilience/)
+If you have identified a vulnerability or would like to send us a security question, please send it to us at: [security@scaleway.com](mailto:security@scaleway.com)
+Scaleway informs you that you have the following rights depending on the purpose of processing:
+- Be informed why we process your personal information
+- Access your data and obtain a copy of the personal data we process about you
+- Rectify incorrect, incomplete or outdated data
+- Limit the use of your data
+- Oppose the processing of your data if it is processed on the basis of legitimate interest
+- Withdraw your consent at any time if the processing is based on this legal basis
+- Delete data that is no longer necessary for processing or to meet a legal obligation
+- Exercise your right to portability
+You can exercise your rights directly in the privacy section of your Scaleway account or via privacy@scaleway.com. If you believe that your rights have not been respected, you can also file a complaint [with the competent supervisory authority](https://www.edpb.europa.eu/about-edpb/about-edpb/members_fr).
+## Policy update
+This privacy policy may be updated according to regulatory developments. Any modification will enter into force from its date of publication.
+_Last update : january 2024_

Privacy Policy

Full text changes — 20220812_rev01 to 20240421_rev01