| 18 | 18 | The data collected for the operation of our services, where Scaleway acts as a processor, is governed by our [General Conditions of Services](https://www.scaleway.com/en/contracts/) as well as our [Data Processing Agreement (DPA).](https://www.scaleway.com/en/contracts/) |
| 19 | 19 | |
| 20 | 20 | ## What kind of personal data is processed ? |
| 21 | 21 | |
| 22 | 22 | Scaleway is required to process the following categories of data: |
| 23 | 23 | |
| 24 | | - Data relating to identity: name, first name, postal and email address, telephone number, customer number, signature, proof of identity. |
| 25 | | - Billing data: bank details, means of payment, invoices, etc. |
| 24 | - Data relating to identity: name, first name, customer number, signature, proof of identity. |
| 25 | - Billing data: bank details, terms of payment, invoices, etc. |
| 26 | 26 | - Consumption data: history of services and products used, event logs etc. |
| 27 | | - Communication data: history of exchanges with Scaleway, complaints, support tickets, etc. |
| 27 | - Communication data: mails, emails, telephone number, history of exchanges with Scaleway, complaints, support tickets, etc. |
| 28 | 28 | - Connection data: IP address, user ID, location data, connection and event logs etc. |
| 29 | 29 | |
| 30 | 30 | The categories of data used are indicated in each of the treatments in the following section. Any reference to "user account data" includes all account data. |
| 31 | 31 | |
| 32 | ## What data do we share? |
| 33 | |
| 34 | Scaleway does not resell any personal data of its customers or contacts. We only share data as part of operations related to your contract, to meet a legal obligation, or in the company's legitimate interest in the following cases: |
| 35 | |
| 36 | - Transfer of data to a sub-processor or partner for the performance of the service; |
| 37 | - In the event of a business transfer (included merger or acquisition of the company); |
| 38 | - To comply with our legal obligations (e.g., sharing data at the request of an authorized public body to identify fraud or as part of a criminal investigation); |
| 39 | - To ensure the security of our services and infrastructure (e.g. sharing data with security-related service providers). |
| 40 | |
| 32 | 41 | ## How we use your data? |
| 33 | 42 | |
| 34 | 43 | Contracts management and customer relations |
| 35 | 44 | |
| 36 | 45 | Scaleway processes your data in order to manage contracts for the services you use. This includes the management of accounts, support and payment methods. |
| 37 | 46 | |
| 60 | 69 | | Commercial prospecting and communication campaigns relating to our products and services | Identity data |
| 61 | 70 | Billing data |
| 62 | 71 | Consumption data |
| 63 | 72 | Communication data |
| 64 | 73 | Connection data | Legitimate interest |
| 65 | 74 | Consent | Duration of the contractual relationship |
| 66 | | Account deletion request withdrawal of consent objection of the person | Scaleway Sales and Marketing Teams |
| 75 | Account deletion request |
| 76 | Prospects : deletion after 3 years of inactivity from the last contact | Scaleway Sales and Marketing Teams |
| 67 | 77 | Entitled Scaleway Partners for the management of marketing campaigns and customer relation |
| 68 | 78 | Authorized third parties | |
| 69 | 79 | | Organization of events to promote our services | Identity data |
| 70 | 80 | Communication data |
| 71 | | Connection data | Legitimate interest |
| 81 | Connection data |
| 82 | Data relating to the professional background of the speakers | Legitimate interest |
| 72 | 83 | Consent | Duration of the contractual relationship |
| 73 | | Account deletion request | Scaleway Sales and Marketing Teams |
| 84 | Account deletion request |
| 85 | Prospects : deletion after 3 years of inactivity from the last contact | Scaleway Sales and Marketing Teams |
| 74 | 86 | Entitled Scaleway Partners for the management of events |
| 87 | Scaleway service concerned by the event |
| 75 | 88 | Authorized third parties | |
| 76 | | | Management of cookies and other trackers (learn more about our cookie policy) | Connection data | Consent | Cookies are stored between 3 months and 1 year depending on the type of cookie used | Scaleway Sales and Marketing Teams |
| 89 | | Management of third-party cookies from our websites ([learn more about our cookie policy](https://www.scaleway.com/en/cookie/)) | Connection data | Consent | Cookies are stored between 3 months and 1 year depending on the type of cookie used | Scaleway Sales and Marketing Teams |
| 77 | 90 | Entitled Scaleway Partners for the cookies management |
| 78 | 91 | Authorized third parties | |
| 79 | 92 | | Carrying out satisfaction surveys or quality surveys on our services and the training of our teams | Identity data |
| 80 | 93 | Billing data |
| 81 | 94 | Consumption data |
| 82 | 95 | Communication data |
| 83 | 96 | Connection data |
| 84 | 97 | Audio or video recording | Legitimate interest |
| 85 | | Consent | 1 year and anonymization | Scaleway Sales and Marketing Teams Entitled Scaleway Partners for marketing analysis |
| 98 | Consent | 1 year and anonymization | Scaleway Sales and Marketing Teams |
| 99 | Entitled Scaleway Partners for marketing analysis |
| 86 | 100 | Authorized third parties | |
| 87 | 101 | | Produce usage statistics | Connection data | Legitimate interest | Cookies: between 3 months and 1 year |
| 88 | 102 | Service usage data kept during the contractual period or anonymized | Scaleway Sales and Marketing Teams |
| 89 | 103 | Entitled Scaleway Partners for quality analysis |
| 90 | 104 | Authorized third parties | |
| 91 | 105 | |
| 92 | 106 | Recruitment |
| 93 | 107 | |
| 94 | 108 | Scaleway also processes the personal data of candidates as part of its recruitment procedure. |
| 95 | 109 | |
| 96 | 110 | | Purposes | Categories of data | Legal basis | Retention | Categories of recipients | |
| 97 | 111 | | --- | --- | --- | --- | --- | |
| 98 | | | Recruitment | Identity data | Execution of contract or pre-contractual measures | If the application is not accepted, the data is kept for a maximum period of 2 years |
| 112 | | Recruitment | Identity data |
| 113 | Communication Data |
| 114 | Professional Data (Curriculum vitae, salary position, and specifics of the contract) |
| 115 | | Execution of contract or pre-contractual measures |
| 116 | | If the application is not accepted, the data is kept for a maximum period of 2 years |
| 99 | 117 | If the application is accepted, the data is kept for the entire duration of the contract, accompanied by an archiving period intended to comply with our legal obligations or guarantee the legitimate interests of the company. | Human resources services |
| 100 | 118 | Manager and team concerned |
| 101 | 119 | Scaleway partners for human resources |
| 102 | 120 | Authorized third parties | |
| 103 | 121 | |
| 104 | 122 | Legal obligations |
| 105 | 123 | |
| 106 | 124 | Scaleway processes some of your data in order to meet its legal obligations. This is particularly the case in order to secure our services as a provider of electronic communications services, to meet our accounting and tax obligations or to process your requests for rights relating to data protection. |
| 107 | 125 | |
| 108 | 126 | | Purposes | Categories of data | Legal basis | Retention | Categories of recipients | |
| 109 | 127 | | --- | --- | --- | --- | --- | |
| 110 | | | Guarantee the security of our customers as a provider of electronic communications services (Directive 2002/58/EC and art 32 of the GDPR) | Identity data |
| 111 | | Billing data |
| 112 | | Consumption data |
| 113 | | Communication data |
| 114 | | Connection data | Legal obligation | Duration of the contractual relationship plus an archiving period for the data necessary to guarantee compliance with our legal obligations | Entitled Scaleway Services |
| 115 | | Entitled Scaleway Partners for security management |
| 128 | | Guarantee the security of our customers as a provider of electronic communications services (Directive 2002/58/EC and art 32 of the GDPR) in particular to prevent fraud and identity theft. The processed data may be transferred to a third country under the conditions of protection mechanisms compliant with the GDPR (including: Standard contractual clauses and appropriate security measures). |
| 129 | | Customer account data |
| 130 | Photographs and visual or audio recordings |
| 131 | Biometric data collected from an image, video or audio recording via facial recognition technology or similar technology for the provision of certain Services | Legal obligation | Duration of the contractual relationship plus an archiving period for the data necessary to guarantee compliance with our legal obligations |
| 132 | The data used for KYC checks is retained only for the time strictly necessary to verify identity, after which it is archived to comply with applicable legal requirements or those of the relevant service provider, and subsequently deleted. | Entitled Scaleway Services |
| 133 | Entitled Scaleway Partners for security management or KYC checks |
| 116 | 134 | Authorized third parties (auditors etc.) | |
| 117 | 135 | | Abuse of Scaleway services includes cyber-crime, copyright violation, illegal or offensive content, spamming and malware distribution. Abuse should be reported in the console. These data processings are likely to be subject to automated decision-making (e.g. anti-spam control) | Identity data |
| 118 | | User account information | Legal obligation | Duration necessary to meet our legal obligations | Entitled Scaleway Services |
| 136 | User account information | Legal obligation | 10 years from the closure of the ticket concerned |
| 137 | | Entitled Scaleway Services |
| 119 | 138 | Entitled Scaleway Partners for the ticketing and support management |
| 120 | 139 | Authorized third parties | |
| 121 | 140 | | Responses to the data protection requests and any complaints related to the protection of personal data | Identity data (including proof of identity) |
| 122 | 141 | User account information |
| 123 | | All the data related to the complaint | Legal obligation | 5 years from ticket closing |
| 142 | ll the data related to the complaint | Legal obligation | 5 years from ticket closing |
| 124 | 143 | Verification of identity card: 1 month | Entitled Scaleway Services |
| 125 | 144 | Entitled Scaleway Partner for the management of subject requests |
| 126 | | Authorized third partiesEntitled Iliad service | |
| 145 | Authorized third parties |
| 146 | Entitled Iliad service | |
| 127 | 147 | | Data breaches management | Identity data |
| 128 | 148 | User account information related to the data breach |
| 129 | 149 | All data related to the data breach | Legal obligation | 5 years from the closure of the data breach | Entitled Scaleway Services |
| 130 | 150 | Competent administrative authority | |
| 131 | | | Accounting obligations | Billing data | Legal obligation | 10 years from the end of the contract | Entitled Scaleway ServicesEntitled Scaleway Partner for the management of payments and invoices |
| 151 | | Accounting obligations | Billing data | Legal obligation | 10 years from the end of the contract | Entitled Scaleway Services |
| 152 | Entitled Scaleway Partner for the management of payments and invoices |
| 132 | 153 | Competent administrative authority | |
| 133 | 154 | | Legal or administrative procedure management | Identity data |
| 134 | 155 | User account information related to the case | Legal obligation | The necessary data is kept until the expiration of the legal remedies | Scaleway Legal Department |
| 135 | 156 | Iliad Legal Department |
| 136 | 157 | Competent administrative authority |
| 137 | 158 | Entitled third parties (legal advisor etc.) | |
| 140 | 161 | |
| 141 | 162 | Scaleway processes some of your data in order to meet a legitimate interest. This is particularly the case in order to secure our services, ensure the management of unpaid debts and the training of our teams (processing relating to security or fraud may involve profiling techniques). |
| 142 | 163 | |
| 143 | 164 | | Purposes | Categories of data | Legal basis | Retention | Categories of recipients | |
| 144 | 165 | | --- | --- | --- | --- | --- | |
| 145 | 166 | | Guarantee the security of services we offer | Identity data |
| 146 | | User account information | Legitimate interest | Duration of the contractual relationship or duration limited to the limitation period from the closure of the event concerned | Scaleway IT security service |
| 167 | User account information | Legitimate interest | 5 years from the end of the contract |
| 168 | | Scaleway IT security service |
| 147 | 169 | Competent administrative authority | |
| 148 | 170 | | Debt collection | Identity data |
| 149 | | User account information | Legitimate interest | 5 years from the payment incident | Scaleway Legal and Accounting Services |
| 171 | User account information | Legitimate interest | 5 years from the payment incident |
| 172 | | Scaleway Legal and Accounting Services |
| 150 | 173 | Entitled Scaleway Partner for debt collection | |
| 151 | 174 | | Fraud detection and prevention | Bank details |
| 152 | 175 | Identity data |
| 153 | 176 | User account information | Legitimate interest | 5 years maximum from the suspicion of an incident |
| 154 | 177 | ID card verification: 1 month | Entitled Scaleway service |
| 155 | 178 | Entitled Scaleway Partner for support and ticketing | |
| 179 | | Anti-spam policy | Email addresses |
| 180 | Spam content | Legitimate interest | The reporter's data is deleted immediately after reporting | Service provider concerned | |
| 156 | 181 | | Litigation management | Identity data |
| 157 | 182 | Data necessary for the purposes of establishing evidence | Legitimate interest | The data is kept until the expiration of the legal remedies and archived for 10 years | Scaleway legal department |
| 158 | 183 | Entitled Scaleway partner | |
| 159 | 184 | | Ensure the training of our teams | Identity data |
| 160 | 185 | User account information | Legitimate interest | The data is kept during the contractual period | Entitled Scaleway service | |
| 161 | 186 | |
| 162 | | ## Data processors |
| 187 | ## Sub-processing |
| 163 | 188 | |
| 164 | 189 | As a data controller, Scaleway uses data processors for the following purposes: |
| 165 | 190 | |
| 166 | 191 | - customer relationship management (support management, etc.) |
| 167 | 192 | - carrying out emailing campaigns and surveys on the services |
| 168 | 193 | - partnership management with other cloud providers |