Where the data comes from, and what you can do with it.
Our sources, our commitments, and the obligations that remain yours. All written in plain terms, so your legal team can sign off before you sign.
English version, for information only. Scalon is operated by a French company and this document is governed by French law. The French version is the only binding text: in the event of any discrepancy between the two, the French version prevails. It is available at /legal/conformite.
Our four commitments
Public sources only
Official registries, information published by the businesses themselves, public content about them. No file bought from a data broker, no database swap, no data obtained through unauthorized access.
Businesses, not private individuals
We only process professional data, about professionals, in the course of their business. No special category data within the meaning of Article 9 GDPR is collected or inferred. The identity of online reviewers, and the faces and license plates visible in photographs, are neither extracted, nor analyzed, nor retained.
An opt-out register that is kept and enforceable
Anyone who objects is removed, permanently, including from subsequent updates. Our clients are notified and contractually required to remove them from their own systems within thirty days.
Everything is traceable, on request
Ask us where a piece of information came from and when it was observed, and we answer. That is what lets you answer "where did you get my number", which is the first question an annoyed prospect will ask.
What we refuse to do
- We buy no prospecting files.
- We do not resell your brief, or the signals built for you. They are yours for the duration of your license.
- We collect no data on individuals acting outside their professional capacity.
- We process no special category data, and we infer none.
- We never ask you for your database. The matching happens on your side, with the keys we deliver.
- We promise no quantified commercial outcome. What we commit to is a scope, a method and an update frequency.
How we handle personal data
Scalon is an independent controller. You become one in turn as soon as the market map is delivered to you. There is neither processing on your behalf nor joint controllership between us, and therefore no data processing agreement to negotiate.
Our legal basis: legitimate interest
Article 6(1)(f) GDPR. The balancing test is published, with its reasoning, in our data protection policy.
Informing the people concerned
Our data protection policy constitutes the information required by Article 14 GDPR. On your side, you must tell the people you contact that Scalon is the source of their contact details. That is written into our terms, and we provide standard wording, ready to paste at the foot of your campaigns.
Your obligations, stated plainly
A delivered market map exempts you from nothing. Informing the people concerned, obtaining consent for electronic prospecting where it is required, retention periods: all of that is on you. We would rather tell you before you sign.
Telephone prospecting. Since 11 August 2026, telephone prospecting directed at consumers in France requires their prior consent, and the national opt-out service has been discontinued. Business-to-business prospecting, which is the only use of our market maps, remains outside that regime and continues to rest on legitimate interest with a right to object. It is your responsibility to make sure your calls fall within that framework, under the rules of the country you are calling into.
Where the data lives
| Hosting | Vercel Inc., executing on the platform's European infrastructure. |
|---|---|
| Transfers outside the EU | Some sub-processors are established in the United States. Every transfer is covered by the European Commission's standard contractual clauses, a copy of which is provided on request. |
| Sub-processors | Categories and locations detailed in the data protection policy, kept up to date. |
Security
Encryption in transit and at rest. Named, logged access. Segregated environments. Regular backups. A confidentiality undertaking from every authorized person.
In the event of a data breach presenting a risk, we notify the French supervisory authority within 72 hours and inform you without delay.
Exercising your rights
You appear in one of our market maps
You can object, without having to give a reason, at valentin@scalon.fr. Your request is handled within one month. Your objection applies across all our clients, present and future.
You also have rights of access, rectification, erasure and restriction, and the right to lodge a complaint with the French supervisory authority.
You are a client
Any compliance question, including a questionnaire from your legal department, goes to the same address. Answer within five business days.