Scaleway Privacy Policy changes — 20260729_rev01

1

## Overview

2

3

SCALEWAY attaches great importance to compliance with regulations relating to the protection of personal data and in particular the General Data Protection Regulation (EU Regulation 2016/679 of the European Parliament known as "GDPR") and the data processing and freedom law (law no. 78-17 of January 6, 1978 relating to data processing, files and freedoms).

4

5

In this context, this Privacy Policy will help you to understand what personal data concerning you is collected by Scaleway and what it is intended for.

6

7

## Scope

8

9

This privacy policy is intended to govern the processing carried out by Scaleway as data controller (Scaleway, 8 RUE DE LA VILLE L'EVÊQUE 75008 PARIS 8), in particular the data collected in the context of:

10

11

- the management of your customer account

12

- the management of marketing communications or prospection

13

- the use of one of our websites (not already covered by a specific privacy policy)

14

- the recruitment management

15

- the compliance with our legal obligations

16

- the guarantee of legitimate interests

17

18

The data collected for the operation of our services, where Scaleway acts as a processor, is governed by our [General Conditions of Services](https://www.scaleway.com/en/contracts/) as well as our [Data Processing Agreement (DPA).](https://www.scaleway.com/en/contracts/)

19

20

## What kind of personal data is processed ?

21

22

Scaleway is required to process the following categories of data:

23

24

- Data relating to identity: name, first name, customer number, signature, proof of identity.

25

- Billing data: bank details, terms of payment, invoices, etc.

26

- Consumption data: history of services and products used, event logs etc.

27

- Communication data: mails, emails, telephone number, history of exchanges with Scaleway, complaints, support tickets, etc.

28

- Connection data: IP address, user ID, location data, connection and event logs etc.

29

30

The categories of data used are indicated in each of the treatments in the following section. Any reference to "user account data" includes all account data.

31

32

## What data do we share?

33

34

Scaleway does not resell any personal data of its customers or contacts. We only share data as part of operations related to your contract, to meet a legal obligation, or in the company's legitimate interest in the following cases:

35

36

- Transfer of data to a sub-processor or partner for the performance of the service;

37

- In the event of a business transfer (included merger or acquisition of the company);

38

- To comply with our legal obligations (e.g., sharing data at the request of an authorized public body to identify fraud or as part of a criminal investigation);

39

- To ensure the security of our services and infrastructure (e.g. sharing data with security-related service providers).

40

41

## How we use your data?

42

43

Contracts management and customer relations

44

45

Scaleway processes your data in order to manage contracts for the services you use. This includes the management of accounts, support and payment methods.

46

47

48

| --- | --- | --- | --- | --- |

49

| Management of contracts and customer relations (management of accounts, support and means of payment) | Identity data

50

Billing data

51

Consumption data

52

Communication data

53

Connection data | Execution of the contract | Duration of the contractual relationship plus an archiving period to meet our legal obligations and guarantee the defense of our legitimate interest | Scaleway Services

54

Entitled Scaleway Partners for support and payment management

55

Authorized third parties\* |

56

| Management of contracts with our partners (service providers and suppliers) | Identity data

57

Commercial relationship monitoring data (activity reports and, communications) | Execution of the contract | Duration of the contractual relationship | Scaleway Services

58

Entitled Scaleway Partner for the management of suppliers

59

Authorized third parties |

60

61

\*Means any public authority or administration authorized by a text to receive personal information

62

63

Sales and Marketing

64

65

Scaleway processes certain data in order to send its service offers to its customers or prospects, guests for events or even collect their opinions on products (processing may involve profiling techniques). These processing operations may be based either on legitimate interest, if the person is already a customer of the company, particularly if the proposals concern products or services similar to those already subscribed, or on consent. Scaleway mainly collects this data directly but can also obtain it indirectly via specialized data processors in conformity with all applicable legal requirements.

66

67

68

| --- | --- | --- | --- | --- |

69

| Commercial prospecting and communication campaigns relating to our products and services | Identity data

70

Billing data

71

Consumption data

72

Communication data

73

Connection data | Legitimate interest

74

Consent | Duration of the contractual relationship

75

Account deletion request

76

Prospects : deletion after 3 years of inactivity from the last contact | Scaleway Sales and Marketing Teams

77

Entitled Scaleway Partners for the management of marketing campaigns and customer relation

78

Authorized third parties |

79

| Organization of events to promote our services | Identity data

80

Communication data

81

Connection data

82

Data relating to the professional background of the speakers | Legitimate interest

83

Consent | Duration of the contractual relationship

84

Account deletion request

85

Prospects : deletion after 3 years of inactivity from the last contact | Scaleway Sales and Marketing Teams

86

Entitled Scaleway Partners for the management of events

87

Scaleway service concerned by the event

88

Authorized third parties |

89

| Management of third-party cookies from our websites ([learn more about our cookie policy](https://www.scaleway.com/en/cookie/)) | Connection data | Consent | Cookies are stored between 3 months and 1 year depending on the type of cookie used | Scaleway Sales and Marketing Teams

90

Entitled Scaleway Partners for the cookies management

91

Authorized third parties |

92

| Carrying out satisfaction surveys or quality surveys on our services and the training of our teams | Identity data

93

Billing data

94

Consumption data

95

Communication data

96

Connection data

97

Audio or video recording | Legitimate interest

98

Consent | 1 year and anonymization | Scaleway Sales and Marketing Teams

99

Entitled Scaleway Partners for marketing analysis

100

Authorized third parties |

101

| Produce usage statistics | Connection data | Legitimate interest | Cookies: between 3 months and 1 year

102

Service usage data kept during the contractual period or anonymized | Scaleway Sales and Marketing Teams

103

Entitled Scaleway Partners for quality analysis

104

Authorized third parties |

105

106

Recruitment

107

108

Scaleway also processes the personal data of candidates as part of its recruitment procedure.

109

110

111

| --- | --- | --- | --- | --- |

112

| Recruitment | Identity data

113

Communication Data

114

Professional Data (Curriculum vitae, salary position, and specifics of the contract)

115

| Execution of contract or pre-contractual measures

116

| If the application is not accepted, the data is kept for a maximum period of 2 years

117

If the application is accepted, the data is kept for the entire duration of the contract, accompanied by an archiving period intended to comply with our legal obligations or guarantee the legitimate interests of the company. | Human resources services

118

Manager and team concerned

119

Scaleway partners for human resources

120

Authorized third parties |

121

122

Legal obligations

123

124

Scaleway processes some of your data in order to meet its legal obligations. This is particularly the case in order to secure our services as a provider of electronic communications services, to meet our accounting and tax obligations or to process your requests for rights relating to data protection.

125

126

127

| --- | --- | --- | --- | --- |

128

| Guarantee the security of our customers as a provider of electronic communications services (Directive 2002/58/EC and art 32 of the GDPR) in particular to prevent fraud and identity theft. The processed data may be transferred to a third country under the conditions of protection mechanisms compliant with the GDPR (including: Standard contractual clauses and appropriate security measures).

129

| Customer account data

130

Photographs and visual or audio recordings

131

Biometric data collected from an image, video or audio recording via facial recognition technology or similar technology for the provision of certain Services | Legal obligation | Duration of the contractual relationship plus an archiving period for the data necessary to guarantee compliance with our legal obligations

132

The data used for KYC checks is retained only for the time strictly necessary to verify identity, after which it is archived to comply with applicable legal requirements or those of the relevant service provider, and subsequently deleted. | Entitled Scaleway Services

133

Entitled Scaleway Partners for security management or KYC checks

134

Authorized third parties (auditors etc.) |

135

| Abuse of Scaleway services includes cyber-crime, copyright violation, illegal or offensive content, spamming and malware distribution. Abuse should be reported in the console. These data processings are likely to be subject to automated decision-making (e.g. anti-spam control) | Identity data

136

User account information | Legal obligation | 10 years from the closure of the ticket concerned

137

| Entitled Scaleway Services

138

Entitled Scaleway Partners for the ticketing and support management

139

Authorized third parties |

140

| Responses to the data protection requests and any complaints related to the protection of personal data | Identity data (including proof of identity)

141

User account information

142

ll the data related to the complaint | Legal obligation | 5 years from ticket closing

143

Verification of identity card: 1 month | Entitled Scaleway Services

144

Entitled Scaleway Partner for the management of subject requests

145

Authorized third parties

146

Entitled Iliad service |

147

| Data breaches management | Identity data

148

User account information related to the data breach

149

All data related to the data breach | Legal obligation | 5 years from the closure of the data breach | Entitled Scaleway Services

150

Competent administrative authority |

151

152

Entitled Scaleway Partner for the management of payments and invoices

153

Competent administrative authority |

154

| Legal or administrative procedure management | Identity data

155

User account information related to the case | Legal obligation | The necessary data is kept until the expiration of the legal remedies | Scaleway Legal Department

156

Iliad Legal Department

157

Competent administrative authority

158

Entitled third parties (legal advisor etc.) |

159

160

Legitimate interest

161

162

Scaleway processes some of your data in order to meet a legitimate interest. This is particularly the case in order to secure our services, ensure the management of unpaid debts and the training of our teams (processing relating to security or fraud may involve profiling techniques).

163

164

165

| --- | --- | --- | --- | --- |

166

| Guarantee the security of services we offer | Identity data

167

User account information | Legitimate interest | 5 years from the end of the contract

168

| Scaleway IT security service

169

Competent administrative authority |

170

| Debt collection | Identity data

171

User account information | Legitimate interest | 5 years from the payment incident

172

| Scaleway Legal and Accounting Services

173

Entitled Scaleway Partner for debt collection |

174

| Fraud detection and prevention | Bank details

175

Identity data

176

User account information | Legitimate interest | 5 years maximum from the suspicion of an incident

177

ID card verification: 1 month | Entitled Scaleway service

178

Entitled Scaleway Partner for support and ticketing |

179

| Anti-spam policy | Email addresses

180

Spam content | Legitimate interest | The reporter's data is deleted immediately after reporting | Service provider concerned |

181

| Litigation management | Identity data

182

Data necessary for the purposes of establishing evidence | Legitimate interest | The data is kept until the expiration of the legal remedies and archived for 10 years | Scaleway legal department

183

Entitled Scaleway partner |

184

| Ensure the training of our teams | Identity data

185

User account information | Legitimate interest | The data is kept during the contractual period | Entitled Scaleway service |

186

187

## Sub-processing

188

189

As a data controller, Scaleway uses data processors for the following purposes:

190

191

- customer relationship management (support management, etc.)

192

- carrying out emailing campaigns and surveys on the services

193

- partnership management with other cloud providers

194

- meeting our legal obligations (accounting, data protection etc.)

195

- marketing data analysis

196

- website data analysis

197

- management of payment services

198

- consulting or audit firms

199

- the organization of events

200

- security and identity control

201

202

Scaleway selects its data processors through a strict security control procedure to ensure that they only process data for the purposes for which they have been chosen. Scaleway also ensures that its data processors have technical and organizational security measures in accordance with the regulations relating to the protection of personal data.

203

204

## Transfer of data outside the European Union

205

206

Scaleway strives to minimize data transfers outside the European Union and only carries out such transfers as data controller for the purposes listed above. Data transferred as part of our services is governed by our [Data Processing Agreement (DPA)](https://www.scaleway.com/en/contracts/)

207

208

All transfers outside the European Union are subject to a strict control to ensure that the contracts entered into with our service providers comply with the Standard Contractual Clauses (SCC) updated by the implementing decision ( EU) 2021/914 of the Commission of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council (Text presenting interest for the EEA) and where possible, to supplement these clauses

209

210

## Requests from authorities

211

212

Scaleway may receive direct (administrative or judicial authorities) or indirect (lawyers, bailiffs, notaries, etc.) requests from competent authorities to transmit certain data relating to its customers.

213

214

In this case, and to the extent that Scaleway is legally entitled to do so, Scaleway may inform its customers in advance in order to enable them to assert their rights subject to compliance with applicable regulations. Scaleway cannot oppose such a request if it complies with French or European regulations, an international agreement (art. 48 of the GDPR) or with one of the exemptions provided for in art. 49 of the GDPR.

215

216

## Children

217

218

Scaleway does not provide services to children. Any children wishing to use our services must be accompanied and under the responsibility of an adult.

219

220

## Link to our partners

221

222

Our sites may contain links to our partners. We inform you that these links refer directly to the sites of these partners who have their own confidentiality policy for which Scaleway cannot be held responsible.

223

224

## Data Security

225

226

Scaleway implements technical and organizational security measures to guarantee the constant confidentiality, integrity, availability and resilience of its information systems and services. These measures meet the state of the art and are adapted to the type of data concerned. All of our staff are aware of IT security and data protection issues.

227

228

Our security measures specifically meet data protection regulations and in particular the following points:

229

230

- Information systems security policy (ISSP)

231

- Physical protection measures for all of our data centers

232

- Secure authentication of user accounts

233

- Logging

234

- Security Information and Event Management (SIEM)

235

- Incident management procedure

236

- Secure management procedure for data processors

237

- Procedure for handling data breaches

238

- Secure data backup

239

- Anonymization of data when personal data is no longer necessary for processing in order to produce statistics or improve our services or marketing communication

240

241

In accordance with our general conditions of service, we remind you that the customer is solely responsible for the management and security of its content as well as the environments and systems that it deploys on the infrastructures made available to it as part of the services offered by Scaleway. It is also up to the customer to make any backups of their content (or other means aimed at ensuring their longevity) that he considers necessary in order to protect against possible deletion, alteration or modification of said content.

242

243

For more information regarding all of our security measures, you can consult our [Security and Resilience page.](https://www.scaleway.com/en/security-and-resilience/)

244

245

If you have identified a vulnerability or would like to send us a security question, please send it to us at: [security@scaleway.com](mailto:security@scaleway.com)

246

247

## Data subjects rights & contact

248

249

Scaleway informs you that you have the following rights depending on the purpose of processing:

250

251

- Be informed why we process your personal information

252

- Access your data and obtain a copy of the personal data we process about you

253

- Rectify incorrect, incomplete or outdated data

254

- Limit the use of your data

255

- Oppose the processing of your data if it is processed on the basis of legitimate interest

256

- Withdraw your consent at any time if the processing is based on this legal basis

257

- Delete data that is no longer necessary for processing or to meet a legal obligation

258

- Exercise your right to portability

259

260

You can exercise your rights directly in the privacy section of your Scaleway account or via [privacy@scaleway.com](mailto:privacy@scaleway.com). If you believe that your rights have not been respected, you can also file a complaint [with the competent supervisory authority](https://www.edpb.europa.eu/about-edpb/about-edpb/members_fr).

261

262

## Policy update

263

264

This privacy policy may be updated to reflect changes in regulations or services offered by Scaleway, as well as to improve the transparency of our practices. Any changes will take effect from the date of publication.

265

266

Last update : November 2025

+## Overview
+SCALEWAY attaches great importance to compliance with regulations relating to the protection of personal data and in particular the General Data Protection Regulation (EU Regulation 2016/679 of the European Parliament known as "GDPR") and the data processing and freedom law (law no. 78-17 of January 6, 1978 relating to data processing, files and freedoms).
+In this context, this Privacy Policy will help you to understand what personal data concerning you is collected by Scaleway and what it is intended for.
+## Scope
+This privacy policy is intended to govern the processing carried out by Scaleway as data controller (Scaleway, 8 RUE DE LA VILLE L'EVÊQUE 75008 PARIS 8), in particular the data collected in the context of:
+- the management of your customer account
+- the management of marketing communications or prospection
+- the use of one of our websites (not already covered by a specific privacy policy)
+- the recruitment management
+- the compliance with our legal obligations
+- the guarantee of legitimate interests
+The data collected for the operation of our services, where Scaleway acts as a processor, is governed by our [General Conditions of Services](https://www.scaleway.com/en/contracts/) as well as our [Data Processing Agreement (DPA).](https://www.scaleway.com/en/contracts/)
+## What kind of personal data is processed ?
+Scaleway is required to process the following categories of data:
+- Data relating to identity: name, first name, customer number, signature, proof of identity.
+- Billing data: bank details, terms of payment, invoices, etc.
+- Consumption data: history of services and products used, event logs etc.
+- Communication data: mails, emails, telephone number, history of exchanges with Scaleway, complaints, support tickets, etc.
+- Connection data: IP address, user ID, location data, connection and event logs etc.
+The categories of data used are indicated in each of the treatments in the following section. Any reference to "user account data" includes all account data.
+## What data do we share?
+Scaleway does not resell any personal data of its customers or contacts. We only share data as part of operations related to your contract, to meet a legal obligation, or in the company's legitimate interest in the following cases:
+- Transfer of data to a sub-processor or partner for the performance of the service;
+- In the event of a business transfer (included merger or acquisition of the company);
+- To comply with our legal obligations (e.g., sharing data at the request of an authorized public body to identify fraud or as part of a criminal investigation);
+- To ensure the security of our services and infrastructure (e.g. sharing data with security-related service providers).
+## How we use your data?
+Contracts management and customer relations
+Scaleway processes your data in order to manage contracts for the services you use. This includes the management of accounts, support and payment methods.
+| Purposes | Categories of data | Legal basis | Retention | Categories of recipients |
+| --- | --- | --- | --- | --- |
+| Management of contracts and customer relations (management of accounts, support and means of payment) | Identity data
+Billing data
+Consumption data
+Communication data
+Connection data | Execution of the contract | Duration of the contractual relationship plus an archiving period to meet our legal obligations and guarantee the defense of our legitimate interest | Scaleway Services
+Entitled Scaleway Partners for support and payment management
+Authorized third parties\* |
+| Management of contracts with our partners (service providers and suppliers) | Identity data
+Commercial relationship monitoring data (activity reports and, communications) | Execution of the contract | Duration of the contractual relationship | Scaleway Services
+Entitled Scaleway Partner for the management of suppliers
+Authorized third parties |
+\*Means any public authority or administration authorized by a text to receive personal information
+Sales and Marketing
+Scaleway processes certain data in order to send its service offers to its customers or prospects, guests for events or even collect their opinions on products (processing may involve profiling techniques). These processing operations may be based either on legitimate interest, if the person is already a customer of the company, particularly if the proposals concern products or services similar to those already subscribed, or on consent. Scaleway mainly collects this data directly but can also obtain it indirectly via specialized data processors in conformity with all applicable legal requirements.
+| Purposes | Categories of data | Legal basis | Retention | Categories of recipients |
+| --- | --- | --- | --- | --- |
+| Commercial prospecting and communication campaigns relating to our products and services | Identity data
+Billing data
+Consumption data
+Communication data
+Connection data | Legitimate interest
+Consent | Duration of the contractual relationship
+Account deletion request
+Prospects : deletion after 3 years of inactivity from the last contact | Scaleway Sales and Marketing Teams
+Entitled Scaleway Partners for the management of marketing campaigns and customer relation
+Authorized third parties |
+| Organization of events to promote our services | Identity data
+Communication data
+Connection data
+Data relating to the professional background of the speakers | Legitimate interest
+Consent | Duration of the contractual relationship
+Account deletion request
+Prospects : deletion after 3 years of inactivity from the last contact | Scaleway Sales and Marketing Teams
+Entitled Scaleway Partners for the management of events
+Scaleway service concerned by the event
+Authorized third parties |
+| Management of third-party cookies from our websites ([learn more about our cookie policy](https://www.scaleway.com/en/cookie/)) | Connection data | Consent | Cookies are stored between 3 months and 1 year depending on the type of cookie used | Scaleway Sales and Marketing Teams
+Entitled Scaleway Partners for the cookies management
+Authorized third parties |
+| Carrying out satisfaction surveys or quality surveys on our services and the training of our teams | Identity data
+Billing data
+Consumption data
+Communication data
+Connection data
+Audio or video recording | Legitimate interest
+Consent | 1 year and anonymization | Scaleway Sales and Marketing Teams
+Entitled Scaleway Partners for marketing analysis
+Authorized third parties |
+| Produce usage statistics | Connection data | Legitimate interest | Cookies: between 3 months and 1 year
+Service usage data kept during the contractual period or anonymized | Scaleway Sales and Marketing Teams
+Entitled Scaleway Partners for quality analysis
+Authorized third parties |
+Recruitment
+Scaleway also processes the personal data of candidates as part of its recruitment procedure.
+| Purposes | Categories of data | Legal basis | Retention | Categories of recipients |
+| --- | --- | --- | --- | --- |
+| Recruitment | Identity data
+Communication Data
+Professional Data (Curriculum vitae, salary position, and specifics of the contract)
+ | Execution of contract or pre-contractual measures
+ | If the application is not accepted, the data is kept for a maximum period of 2 years
+If the application is accepted, the data is kept for the entire duration of the contract, accompanied by an archiving period intended to comply with our legal obligations or guarantee the legitimate interests of the company. | Human resources services
+Manager and team concerned
+Scaleway partners for human resources
+Authorized third parties |
+Legal obligations
+Scaleway processes some of your data in order to meet its legal obligations. This is particularly the case in order to secure our services as a provider of electronic communications services, to meet our accounting and tax obligations or to process your requests for rights relating to data protection.
+| Purposes | Categories of data | Legal basis | Retention | Categories of recipients |
+| --- | --- | --- | --- | --- |
+| Guarantee the security of our customers as a provider of electronic communications services (Directive 2002/58/EC and art 32 of the GDPR) in particular to prevent fraud and identity theft. The processed data may be transferred to a third country under the conditions of protection mechanisms compliant with the GDPR (including: Standard contractual clauses and appropriate security measures).
+ | Customer account data
+Photographs and visual or audio recordings
+Biometric data collected from an image, video or audio recording via facial recognition technology or similar technology for the provision of certain Services | Legal obligation | Duration of the contractual relationship plus an archiving period for the data necessary to guarantee compliance with our legal obligations
+The data used for KYC checks is retained only for the time strictly necessary to verify identity, after which it is archived to comply with applicable legal requirements or those of the relevant service provider, and subsequently deleted. | Entitled Scaleway Services
+Entitled Scaleway Partners for security management or KYC checks
+Authorized third parties (auditors etc.) |
+| Abuse of Scaleway services includes cyber-crime, copyright violation, illegal or offensive content, spamming and malware distribution. Abuse should be reported in the console. These data processings are likely to be subject to automated decision-making (e.g. anti-spam control) | Identity data
+User account information | Legal obligation | 10 years from the closure of the ticket concerned
+ | Entitled Scaleway Services
+Entitled Scaleway Partners for the ticketing and support management
+Authorized third parties |
+| Responses to the data protection requests and any complaints related to the protection of personal data | Identity data (including proof of identity)
+User account information
+ll the data related to the complaint | Legal obligation | 5 years from ticket closing
+Verification of identity card: 1 month | Entitled Scaleway Services
+Entitled Scaleway Partner for the management of subject requests
+Authorized third parties
+Entitled Iliad service |
+| Data breaches management | Identity data
+User account information related to the data breach
+All data related to the data breach | Legal obligation | 5 years from the closure of the data breach | Entitled Scaleway Services
+Competent administrative authority |
+| Accounting obligations | Billing data | Legal obligation | 10 years from the end of the contract | Entitled Scaleway Services
+Entitled Scaleway Partner for the management of payments and invoices
+Competent administrative authority |
+| Legal or administrative procedure management | Identity data
+User account information related to the case | Legal obligation | The necessary data is kept until the expiration of the legal remedies | Scaleway Legal Department
+Iliad Legal Department
+Competent administrative authority
+Entitled third parties (legal advisor etc.) |
+Legitimate interest
+Scaleway processes some of your data in order to meet a legitimate interest. This is particularly the case in order to secure our services, ensure the management of unpaid debts and the training of our teams (processing relating to security or fraud may involve profiling techniques).
+| Purposes | Categories of data | Legal basis | Retention | Categories of recipients |
+| --- | --- | --- | --- | --- |
+| Guarantee the security of services we offer | Identity data
+User account information | Legitimate interest | 5 years from the end of the contract
+ | Scaleway IT security service
+Competent administrative authority |
+| Debt collection | Identity data
+User account information | Legitimate interest | 5 years from the payment incident
+ | Scaleway Legal and Accounting Services
+Entitled Scaleway Partner for debt collection |
+| Fraud detection and prevention | Bank details
+Identity data
+User account information | Legitimate interest | 5 years maximum from the suspicion of an incident
+ID card verification: 1 month | Entitled Scaleway service
+Entitled Scaleway Partner for support and ticketing |
+| Anti-spam policy | Email addresses
+Spam content | Legitimate interest | The reporter's data is deleted immediately after reporting | Service provider concerned |
+| Litigation management | Identity data
+Data necessary for the purposes of establishing evidence | Legitimate interest | The data is kept until the expiration of the legal remedies and archived for 10 years | Scaleway legal department
+Entitled Scaleway partner |
+| Ensure the training of our teams | Identity data
+User account information | Legitimate interest | The data is kept during the contractual period | Entitled Scaleway service |
+## Sub-processing
+As a data controller, Scaleway uses data processors for the following purposes:
+- customer relationship management (support management, etc.)
+- carrying out emailing campaigns and surveys on the services
+- partnership management with other cloud providers
+- meeting our legal obligations (accounting, data protection etc.)
+- marketing data analysis
+- website data analysis
+- management of payment services
+- consulting or audit firms
+- the organization of events
+- security and identity control
+Scaleway selects its data processors through a strict security control procedure to ensure that they only process data for the purposes for which they have been chosen. Scaleway also ensures that its data processors have technical and organizational security measures in accordance with the regulations relating to the protection of personal data.
+## Transfer of data outside the European Union
+Scaleway strives to minimize data transfers outside the European Union and only carries out such transfers as data controller for the purposes listed above. Data transferred as part of our services is governed by our [Data Processing Agreement (DPA)](https://www.scaleway.com/en/contracts/)
+All transfers outside the European Union are subject to a strict control to ensure that the contracts entered into with our service providers comply with the Standard Contractual Clauses (SCC) updated by the implementing decision ( EU) 2021/914 of the Commission of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council (Text presenting interest for the EEA) and where possible, to supplement these clauses
+## Requests from authorities
+Scaleway may receive direct (administrative or judicial authorities) or indirect (lawyers, bailiffs, notaries, etc.) requests from competent authorities to transmit certain data relating to its customers.
+In this case, and to the extent that Scaleway is legally entitled to do so, Scaleway may inform its customers in advance in order to enable them to assert their rights subject to compliance with applicable regulations. Scaleway cannot oppose such a request if it complies with French or European regulations, an international agreement (art. 48 of the GDPR) or with one of the exemptions provided for in art. 49 of the GDPR.
+## Children
+Scaleway does not provide services to children. Any children wishing to use our services must be accompanied and under the responsibility of an adult.
+## Link to our partners
+Our sites may contain links to our partners. We inform you that these links refer directly to the sites of these partners who have their own confidentiality policy for which Scaleway cannot be held responsible.
+## Data Security
+Scaleway implements technical and organizational security measures to guarantee the constant confidentiality, integrity, availability and resilience of its information systems and services. These measures meet the state of the art and are adapted to the type of data concerned. All of our staff are aware of IT security and data protection issues.
+Our security measures specifically meet data protection regulations and in particular the following points:
+- Information systems security policy (ISSP)
+- Physical protection measures for all of our data centers
+- Secure authentication of user accounts
+- Logging
+- Security Information and Event Management (SIEM)
+- Incident management procedure
+- Secure management procedure for data processors
+- Procedure for handling data breaches
+- Secure data backup
+- Anonymization of data when personal data is no longer necessary for processing in order to produce statistics or improve our services or marketing communication
+In accordance with our general conditions of service, we remind you that the customer is solely responsible for the management and security of its content as well as the environments and systems that it deploys on the infrastructures made available to it as part of the services offered by Scaleway. It is also up to the customer to make any backups of their content (or other means aimed at ensuring their longevity) that he considers necessary in order to protect against possible deletion, alteration or modification of said content.
+For more information regarding all of our security measures, you can consult our [Security and Resilience page.](https://www.scaleway.com/en/security-and-resilience/)
+If you have identified a vulnerability or would like to send us a security question, please send it to us at: [security@scaleway.com](mailto:security@scaleway.com)
+## Data subjects rights & contact
+Scaleway informs you that you have the following rights depending on the purpose of processing:
+- Be informed why we process your personal information
+- Access your data and obtain a copy of the personal data we process about you
+- Rectify incorrect, incomplete or outdated data
+- Limit the use of your data
+- Oppose the processing of your data if it is processed on the basis of legitimate interest
+- Withdraw your consent at any time if the processing is based on this legal basis
+- Delete data that is no longer necessary for processing or to meet a legal obligation
+- Exercise your right to portability
+You can exercise your rights directly in the privacy section of your Scaleway account or via [privacy@scaleway.com](mailto:privacy@scaleway.com). If you believe that your rights have not been respected, you can also file a complaint [with the competent supervisory authority](https://www.edpb.europa.eu/about-edpb/about-edpb/members_fr).
+## Policy update
+This privacy policy may be updated to reflect changes in regulations or services offered by Scaleway, as well as to improve the transparency of our practices. Any changes will take effect from the date of publication.
+Last update : November 2025

Privacy Policy

Full text changes — 20260101_rev01 to 20260729_rev01