# Personal data protection policy

> How Scalon collects, processes and retains personal data, the rights you have and how to exercise them.

Source : https://scalon.fr/en/legal/privacy

---

[← Back to the site](/en)

Legal

How Scalon processes personal data, who is concerned, and how to exercise your rights.

Version 1.0Effective 11 August 2026

[Compliance](/en/legal/compliance) [Terms of sale](/en/legal/terms) [Referral terms](/en/legal/referral-terms) [Privacy](/en/legal/privacy) [Legal notice](/en/legal/legal-notice)

**English version, for information only.** Scalon is operated by a French company and this document is governed by French law. The French version is the only binding text: in the event of any discrepancy between the two, the French version prevails. It is available at [/legal/confidentialite](/legal/confidentialite).

**This document has three audiences.** The **people appearing in our market maps**, who did not give us their data and to whom Article 14 GDPR owes information: that is section 3. Our **clients and prospects**: section 4. **Visitors to this site**: section 5.

## 1. Who processes your data

The controller is **The Leading Company**, a simplified joint-stock company with share capital of 1,000 euros, trading under the name **Scalon**, currently being registered with the French Trade and Companies Register, registered office at 71b rue Championnet, 75018 Paris, France.

Contact for any question about personal data: [valentin@scalon.fr](mailto:valentin@scalon.fr), or by mail to the registered office marked for the attention of the person responsible for data protection. No data protection officer has been appointed to date, none of the mandatory appointment criteria of Article 37 GDPR being met.

## 2. What Scalon does, in one sentence

Scalon builds, on behalf of its business clients, maps of business locations intended for business-to-business prospecting. Those maps contain information about **businesses**; they may incidentally contain information about the **individuals who run or represent them**, solely in the course of their professional activity.

## 3. People appearing in the market maps

This section constitutes **the information required by Article 14 GDPR**. It is addressed to people whose data was collected from sources other than themselves.

### 3.1 What data is processed

| Category | Examples |
| --- | --- |
| **Professional identification** | First and last name of the owner or legal representative, job title |
| **Professional contact details** | Business address, work phone number, work email address, website |
| **Business data** | Legal name, legal form, company registration numbers, activity code, incorporation date, headcount, trading status, published financial data |
| **Assessments produced by Scalon** | An assessment of the match with the scope requested by a client, the written justification attached to it, attributes built from the analysis of public content |
| **Public content** | Extracts of information published by the business or by third parties about it, insofar as they concern the professional activity |

**No data falling within the special categories of Article 9 GDPR** (opinions, health, trade union membership, sexual orientation, origin, religious beliefs, biometric or genetic data) **is collected, inferred or retained.** No data relating to offenses or convictions within the meaning of Article 10 is processed.

**No data about an individual acting for purposes outside their professional activity is processed.** The identity of online reviewers, and the faces and license plates visible in photographs, are neither extracted, nor analyzed, nor retained.

### 3.2 Where this data comes from

In accordance with Article 14(2)(f) GDPR, the data comes from the following categories of source, all **publicly accessible**:

- **public and official registries** maintained by government or under its control, in particular business registers and statutory publication registries;
- **information published by the business itself**, in particular on its website and on the business pages it maintains;
- **content made public by third parties about the business**, insofar as it concerns its professional activity;
- where applicable, **trade directories and publications** accessible without restriction.

This list describes the sources of the **market maps**, and those only. Scalon **acquires no prospecting file from data brokers**, carries out no file exchange, and receives from its clients no personal data that would feed a market map.

**Two layers of data, not to be confused.**

- The **business layer**, described in this section 3: what Scalon collects from public sources to build its deliverables. This is the layer Article 14 GDPR applies to.
- The **form layer**, described in section 5: what you send us yourself by filling in a form on this site, or what a third party sends us about you when recommending you under the referral program.

These two layers are **kept separate**. Data received through a form never enters a market map delivered to a client, and market map data is never enriched with what was typed into a form.

### 3.3 Why, and on what basis

**Purpose:** enabling companies to identify and qualify business locations likely to be interested in their offering, in the context of business-to-business prospecting.

**Legal basis: the legitimate interest** of Scalon and its clients in carrying out and receiving commercial information activity, within the meaning of Article 6(1)(f) GDPR. That basis has been the subject of a balancing test, summarized here:

| Element | Assessment |
| --- | --- |
| Interest pursued | Business-to-business prospecting, an interest recognized as legitimate by recital 47 GDPR |
| Necessity | The data processed is strictly what is needed to identify and qualify a business; no private life data is processed |
| Reasonable expectations | The data comes from sources the business has itself made public or whose publication is required by law, in a professional context where commercial approaches are customary |
| Impact on the individual | Low: the approach concerns the professional activity, at professional contact details, and not the private sphere |
| Safeguards | Exclusion of special category data and of non-professional individuals, an unconditional right to object with no reason required, an opt-out register propagated to clients, bounded retention periods, permanently accessible information |

**Conclusion:** the legitimate interest does not appear to override, disproportionately, the rights and freedoms of the people concerned, provided the safeguards above are effectively maintained, and in particular the right to object.

### 3.4 Who receives this data

- **Scalon's clients**, the companies receiving the market map, who become independent controllers from delivery onward and who are contractually required to inform you no later than their first contact with you.
- **Scalon's technical vendors**, acting as processors within the meaning of Article 28 GDPR, strictly within the limits of their assignment. See section 8.

No data is sold, exchanged or made available outside that framework.

### 3.5 For how long

Scalon distinguishes two layers of data, which do not follow the same regime.

**The business layer** describes a place of business: legal name, address, activity category, the legal entity's registration number, opening hours, observed characteristics of the location, signals built from the analysis of public content. Where it does not allow an individual to be identified, it does not constitute personal data.

**The person layer** designates an individual: first and last name of the owner or representative, job title, named professional contact details. It follows the periods below.

| Data | Active database | Intermediate database | End |
| --- | --- | --- | --- |
| Person layer, licensed market map | Term of the license | **36 months** | Deletion or anonymization |
| Person layer, business ruled out | Not applicable | **36 months** | Deletion or anonymization |
| Business layer, excluding individuals | No time limit | Not applicable | Not applicable |
| People who have exercised their right to object | No time limit, strictly to the extent necessary to honor the objection | On request |  |
| Billing data and accounting records | Term of the contract | 10 years, as required by French commercial law | Deletion |
| Technical logs | 12 months | Not applicable | Deletion |

The **active database** means the data routinely used to produce and update the market maps. The **intermediate database** means restricted-access storage, separate from the active database, whose data is no longer used for current production. At the end of that period, person-layer data is deleted or irreversibly anonymized.

### 3.6 Your rights

| Right | Scope |
| --- | --- |
| **Objection** (Art. 21) | **With no reason required**, this being processing for prospecting purposes. That right is absolute and exercising it results in the immediate and permanent removal of your data. |
| **Access** (Art. 15) | Obtain confirmation that your data is processed and receive a copy of it |
| **Rectification** (Art. 16) | Have inaccurate or incomplete data corrected |
| **Erasure** (Art. 17) | Have your data deleted |
| **Restriction** (Art. 18) | Have the use of your data frozen while it is checked |
| **Complaint** | Lodge a complaint with the French supervisory authority, CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or via [cnil.fr](https://www.cnil.fr) |

**How to exercise these rights:** by email to [valentin@scalon.fr](mailto:valentin@scalon.fr), or by mail to the registered office. You receive a reply within one (1) month of your request being received, extendable by two (2) months where the request is complex, in which case you are told within the initial period.

**What an objection actually produces:**

1. your data is removed from the market maps in progress;
2. you are entered in the **opt-out register**, which prevents your data from being reintroduced in later updates;
3. the clients your data was sent to are notified and contractually required to delete it from their systems within thirty (30) days and to stop all approaches.

The right to object cannot be refused, nor made conditional on providing any evidence beyond what is strictly necessary to identify you.

### 3.7 Automated decision-making

Scalon produces an assessment of the match between a business and the scope defined by its client. **That assessment goes through a human review before delivery** and produces, in relation to you, **no legal effect and no effect significantly affecting you** within the meaning of Article 22 GDPR: it only determines whether a company is likely to send you a commercial offer. You retain the right to request its rectification and to object to the processing.

### 3.8 You were not aware of this processing

That is normal, and it is exactly what this section is for. Your data was not collected from you but from public sources. If you discover this processing through a commercial approach, the company that contacted you is required to tell you that Scalon is the source. You can exercise your right to object with Scalon, which applies across all its clients, or with that company, which only applies to that company. **Objecting with Scalon is the broader route.**

### 3.9 Why you were not informed individually

Article 14 GDPR provides in principle for individual notice to people whose data was not collected from them. Scalon does not give that individual notice, and explains itself here.

Market maps cover a very large number of business locations, whose data comes from public sources. Notifying every person appearing in them one by one would require **disproportionate effort within the meaning of Article 14(5)(b) GDPR**, given the number of people concerned, the uneven reliability of the public contact details available, and the fact that reaching out purely to inform would itself be the approach the person is trying to avoid.

That same provision then requires appropriate measures to protect the rights, freedoms and legitimate interests of the people concerned, **including making the information publicly available**. The measures in place are:

1. this information is **publicly accessible at all times**, with no access condition and no account to create, at the address of this page;
2. a **right to object, with no reason required**, is open at any time by a simple message, and exercising it with Scalon covers every market map produced;
3. the **opt-out register** described in section 6 prevents the reintroduction of the data of anyone who has objected, and it is enforceable against Scalon;
4. **no data falling within Articles 9 and 10** GDPR is processed, and no data about a person acting outside their professional activity.

This assessment is reviewed whenever the processing described in this policy changes substantially.

## 4. Scalon's clients and prospects

**Data processed:** first name, last name, job title, work email address, work phone number, company, the exchanges that took place, and, for clients, billing data.

| Purpose | Legal basis | Period |
| --- | --- | --- |
| Responding to a call or contact request | Pre-contractual measures, Art. 6(1)(b) | 3 years after the last contact |
| Managing the contractual relationship | Performance of the contract, Art. 6(1)(b) | Term of the contract, then 5 years |
| Billing and accounting | Legal obligation, Art. 6(1)(c) | 10 years, as required by French commercial law |
| Scalon's own prospecting | Legitimate interest, Art. 6(1)(f) | 3 years after the last contact |
| Evidence of acceptance of the terms | Legitimate interest, Art. 6(1)(f) | Term of the contract, then 5 years |

The rights listed in section 3.6 apply, together with the **right to portability** (Art. 20) for data provided on the basis of the contract.

## 5. Site visitors

### 5.1 Site forms

**Three forms** collect personal data. In all three cases the fields requested are necessary to handle the request: without them it cannot go through. None of the data below enters a market map delivered to a client.

| Form | Data collected | Purpose | Legal basis | Retention |
| --- | --- | --- | --- | --- |
| **Call request and market suggestion**home page and Observatory | Name, work email address, company, description of the commercial target or of the market being suggested | Answering the request, and gathering markets to count | Steps taken at the request of the person prior to entering a contract (Art. 6(1)(b)), and legitimate interest in answering an approach (Art. 6(1)(f)) | 3 years from the last contact |
| **Observatory report request**census page | First name, email address, company, and the language of the request | Sending the document requested, and measuring interest in the census | Performance of the request made by the person (Art. 6(1)(b)) | 3 years from the last contact |
| **Referral submission**partners page | *About the referrer:* name, email address, phone, postal address, status, company registration number where applicable.*About the recommended business and its contact:* legal name, website or online listing, sector, identified need, and where applicable the name, role and work contact details of the person to approach | Reviewing the submission, establishing its priority in time, and paying any commission due | Performance of the referral agreement (Art. 6(1)(b)) for the referrer; legitimate interest in receiving a commercial recommendation (Art. 6(1)(f)) for the recommended person | Successful submissions: duration of the relationship, then 5 years under accounting and tax obligations.Rejected or lapsed submissions: 24 months |

**The particular case of the recommended person.** The third form is the only one on this site where someone sends us data about **somebody else**. If you were recommended this way, your data came neither from you nor from a public source, but from the referrer who put your name forward. You have every right listed in section 3.6, and the right to object applies on the same terms.

**Recipients.** This data reaches us by email through the sending provider listed in section 8. Referral submissions are additionally recorded, with their timestamp, in a register held on the workspace tool listed in the same section: that timestamp is what establishes which submission came first.

### 5.2 Cookies and trackers

The site is a static site served by Vercel. It sets **no analytics, advertising or conversion tracking cookie**. The only trackers used are those strictly necessary for the security and correct operation of the site, together with those set by the Cal.com booking module when you open the calendar.

Trackers strictly necessary to the operation of the site do not require consent. Any non-exempt analytics tracker, and any advertising or conversion tracker, requires prior consent, as easy to refuse as to accept. Tracker retention: 13 months maximum. Retention of the choice expressed: 6 months.

## 6. Opt-out register

Scalon maintains an **opt-out register** separate from its market maps.

**What it contains:** only the identifying elements strictly necessary to prevent the reintroduction of the data of a person who has objected, to the exclusion of any other data.

**How it works:**

1. every objection received is entered without delay;
2. the register is applied as a filter to **every market map produced and every update**, including the quarterly updates of licenses in force;
3. clients that received the data of the person concerned are notified and contractually required to delete it within thirty (30) days;
4. the entry is permanent and is only lifted at the express request of the person concerned.

**That register is enforceable against Scalon.** A registered person who finds their data reappearing in a later market map may rely on it directly.

## 7. Security

Scalon implements the appropriate technical and organizational measures within the meaning of Article 32 GDPR: encryption of data in transit and at rest, named access control, logging, environment segregation, regular backups, and a confidentiality undertaking from authorized personnel.

In the event of a data breach likely to result in a risk to the rights and freedoms of individuals, Scalon notifies the French supervisory authority within 72 hours and, where the risk is high, informs the people concerned.

## 8. Sub-processors and locations

| Category | Location | Transfer safeguards |
| --- | --- | --- |
| Hosting of the site and the deliverables | Vercel Inc., United States | Standard contractual clauses |
| Processing by artificial intelligence models | Anthropic PBC, United States | Standard contractual clauses |
| Sales management tools | Notion Labs Inc., United States | Standard contractual clauses |
| Delivery of messages from the site forms | Resend (Plus Five Five, Inc.), United States | Standard contractual clauses |
| Email and office software | Google Ireland Ltd., European Union, with transfers to Google LLC, United States | Standard contractual clauses and supplementary measures |

Where a transfer takes place outside the European Union, it is covered by an adequacy decision, by the European Commission's standard contractual clauses, or by another appropriate safeguard within the meaning of Chapter V GDPR, a copy of which can be obtained on request.

## 9. Changes to this policy

Scalon may amend this policy. The applicable version is the one published on this page on the date of consultation. Any substantial change is notified to clients at least thirty (30) days before it takes effect. The version history is retained and provided on request.

Personal data protection policy, version 1.0, effective 11 August 2026.