01Scope of this policy
Scalt (“Scalt”, “we”, “us”), headquartered at Station F, 5 Parvis Alan Turing, 75013 Paris, France, is committed to protecting your personal data and to providing a transparent experience when you visit our websites or when we engage with you in the course of our business. For the processing described in this policy, Scalt acts as data controller.
This policy applies to personal data collected on scalt.ai and its subdomains, and in the course of our business operations: demo requests, contact forms, newsletters, events and webinars, downloadable content, job applications, and relationships with our partners and vendors.
It does not apply to the data our customers process within the Scalt platform. In that context, Scalt acts as a processor under the GDPR, on behalf of the customer acting as controller, under the terms of the data processing agreement (DPA) entered into with them. Platform data is never used to train a model.
By using our websites or providing us with personal data, you acknowledge that you have read this policy.
02Personal data we collect
We collect personal data in four ways.
02.1Information you provide directly
When you fill in a form, request a demo, register for an event or a newsletter, download a resource, apply for a job or talk to our teams, we may collect:
- your identity: first and last name, job title, company;
- your business contact details: email address, phone number, country;
- the content of your messages and your preferences: subject of the request, organisation size, use case;
- for job applications: résumé, cover letter, professional background.
02.2Information collected automatically
When you browse our websites, our servers and, subject to your consent, our analytics tools collect:
- IP address, browser and device type, operating system, language;
- pages viewed, traffic source, visit dates and durations;
- cookie identifiers and similar technologies (see section 7).
02.3Information from third parties
We may receive data about you from partners, business-data enrichment providers, professional social networks or public sources, in order to complete or verify the information we hold. We make sure these third parties are authorised to share it with us.
02.4Information you provide about others
If you give us the details of a colleague or a contact (a referral, registering an attendee), you confirm that you have their permission to do so. We use that data only for the purpose for which it was shared.
03How we use personal data and legal bases
We use your personal data for the following purposes, on the legal bases provided by the GDPR:
| Purpose | Data involved | Legal basis |
|---|---|---|
| Answer your requests (contact, demo, support) | Identity, contact details, message content | Pre-contractual steps · Legitimate interest |
| Manage the commercial and contractual relationship | Identity, contact details, billing data | Performance of a contract |
| Send marketing communications (newsletter, invitations, content) | Identity, contact details, preferences | Consent · Legitimate interest (B2B prospects and customers) |
| Run events and webinars | Identity, contact details, registration | Performance of a contract · Consent |
| Measure audience and improve our websites | Browsing data, cookies | Consent |
| Secure our websites and prevent fraud | IP address, technical logs | Legitimate interest · Legal obligation |
| Manage job applications | Identity, résumé, background | Pre-contractual steps |
| Comply with legal obligations and respond to authorities | As required by the request | Legal obligation |
Where we rely on our legitimate interest, we first check that it is not overridden by your rights and freedoms. You can object at any time (see section 10).
We do not make any decision producing legal effects on you based solely on automated processing.
05Data retention
We keep your personal data only as long as necessary for the purposes for which it was collected, and then as long as required by our legal, accounting or litigation obligations. Our reference periods are:
| Category | Retention period |
|---|---|
| Prospects (contact, demo, newsletter) | 3 years from your last contact with us |
| Customers and contractual contacts | Duration of the contract, then 5 years (limitation period) |
| Accounting and billing records | 10 years from the end of the financial year |
| Unsuccessful applications | 2 years from the last contact, unless you object |
| Technical and security logs | 12 months |
| Cookies and trackers | 13 months at most (see section 7) |
At the end of these periods, data is deleted or irreversibly anonymised.
06Security of personal data
We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access, disclosure or alteration: encryption in transit and at rest, least-privilege access control, logging, environment segregation, team awareness and regular review of our providers.
Your data is hosted in the European Union. No system is infallible, so please report any suspicious incident to us without delay at the address given in section 11. Our security approach is detailed on our Security and governance page.
08Third-party sites and services
Our websites may contain links to third-party sites (partners, social networks, event platforms) or embed content hosted by third parties. These sites have their own privacy policies, which we encourage you to read. This policy does not cover the processing they carry out.
Likewise, information you post in public spaces (comments, forums, social networks) can be read and reused by others.
09International data transfers
Scalt is established in France and hosts your data in the European Union. Some of our service providers may however be located outside the European Economic Area (EEA).
In that case, we make sure the transfer benefits from an adequate level of protection: an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework for certified companies), standard contractual clauses adopted by the Commission, supplemented where necessary by additional measures. You can obtain a copy of the applicable safeguards by contacting us.
10Your privacy rights
You have rights over your personal data. Their scope depends on the regulation that applies to you.
10.1European Economic Area, United Kingdom and Switzerland
Under the GDPR and the French Data Protection Act, you can:
- access your data and obtain a copy of it;
- have inaccurate or incomplete data corrected;
- request the erasure of your data, within the limits set by law;
- request the restriction of processing;
- object to processing based on our legitimate interest, and at any time to direct marketing;
- receive your data in a structured, machine-readable format (portability);
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- set directives on what happens to your data after your death;
- lodge a complaint with the competent supervisory authority, in France the CNIL (www.cnil.fr).
10.2Other jurisdictions
If you live in a country with its own data protection legislation (for example some U.S. states, Brazil or Canada), you may have similar rights: to know what data is collected, to have it corrected or deleted, to object to certain sharing, and not to be discriminated against for exercising your rights. We honour these rights under the conditions set by the applicable law.
We do not sell your personal data and do not share it for cross-context behavioural advertising.
11Contact us and how to submit requests
To exercise your rights, ask a question about this policy or report an incident, contact our data protection lead:
We may ask you to verify your identity where necessary to handle your request. We respond within one month of receipt, extendable by two months for complex requests, in which case we will let you know.
12Updates to this policy
We may update this policy to reflect changes in our business, our tools or the regulation. The last-updated date appears at the top of this page. In the event of a material change, we will let you know through a notice on our websites or, where appropriate, by email. We encourage you to review this page regularly.