Privacy Policy

Privacy Policy

The purpose of this privacy policy (“Privacy Policy“) is to inform persons whose personal data is processed by Scalex Invest, a simplified joint-stock company, located at 61 Boulevard Haussmann, 75008 Paris, registered with the RCS under the number 834 474 678 (“Scalex Invest” or "We"), of the conditions under which this data processing is performed, the data involved, the reasons for this processing, the ways in which We use the data, and the rights of the subjects whose data is being processed.

The Privacy Policy is accessible from our website (the “Website“) and is also made available to you during all exchanges with Scalex Invest, upon the conclusion of a contract, and upon request. It may be modified to take into account, in particular, the evolution of the data processing operations implemented and the applicable legislation. Any significant change will be brought to your attention by email, for example, during exchanges with our services, or via pop-ups upon your visit to the Website.

1. Processing Your Personal Data

Scalex Invest is responsible for Data processing as a professional entity offering ratings, analyses, and studies related to companies such as startups, in particular to achieve or obtain investments or to conclude commercial partnerships with our clients. In this capacity, Scalex Invest is subject to the obligations imposed by the regulations in force in France and across the European Union regarding the protection of personal data, in particular Regulation (EU) 2016/679, enacted on 27 April 2016, concerning the protection of individuals with regards to the processing of personal data and the free movement of such data, in addition to any applicable national legislation (the “Regulation”).

The Privacy Policy applies to Scalex Invest’s:

• clients;
• suppliers and service providers;
• prospects, whether they are potential clients subscribing to the services offered by Scalex Invest, prospects requesting a quote, or startups;
• users browsing the Website (the “People” or “You“).

The Privacy Policy covers personal data, including any information that could identify People directly, such as first and last names and contact details, or indirectly, such as an IP address or social security number (the “Data”). Data processing refers to any operation that is performed or considered directly or indirectly with the Data, such as collection, registration, organisation, storage, modification, consultation, use, transmission, or destruction.

Data processing always has a purpose, i.e., a reason justifying the Data processing. For example, Scalex Invest asking You to enter your email on the Website is a form of Data processing whose goal is to respond to a request for a quote or for information.

Only Data necessary for the processing purposes for which it is collected is processed. Furthermore, Data processing must be founded on a legal basis, such as the performance of a contract between You and Scalex Invest, the legitimate interest of Scalex Invest, the performance of a legal obligation, or your consent.

Moreover, Data whose collection is mandatory is identified as such (i.e., by an asterisk in the forms).

2. Collected and Processed Data

2.1 Data that You provide us

Scalex Invest collects Data directly from You through the forms accessible on the Website, by telephone, within the context of commercial discussions or exchanges, or through surveys and questionnaires. You must notify us of any update of this Data without delay.

2.2 Data obtained from third parties

Data can also be provided indirectly, in particular from public databases (e.g., LinkedIn), professional data providers, banking organisations, or credit institutions, and via cookies. For more information about cookies, please consult the Cookie Policy accessible via the Cookie Settings link in the footer of the Website. We update your Data in our database on a regular basis.

2.3 Data regarding third parties that You provide us

In the event that You send us Data relating to another person (e.g., reference contacts such as an investor), You guarantee that You have the authority to consent to the processing of their Data, receive correspondence on their behalf, and, if necessary, consent to the transfer of their Data abroad.

3. Summary Table of Purposes

3.1 Prospects

Purpose of ProcessingType of DataLegal BasisPerson/Service with AccessAnalysis of the prospect’s needs, answering questions, and sending quotesFirst and last nameConsentCommercial serviceSending commercial offersEmail addressConsentMarketing serviceSending information regarding research and ratings in progressPhone numberConsentService providers (e.g., Google, Airtable, Salesforce)

3.2 Clients

‍

‍

4. Data Access and Security

The Data collected is accessible within Scalex Invest by the services charged with managing the different processes concerned. Access to the Data is strictly reserved to those persons who need it within the scope of their assignments and are bound by a confidentiality agreement.

Scalex Invest ensures that your Data is hosted within the European Union and implements measures to secure the Data against unauthorized access. For example, bank details are encrypted, and access to systems is protected by authentication mechanisms.

In cases where transfers outside the European Union are required, Scalex Invest ensures compliance with GDPR by using standard contractual clauses or working with providers certified under frameworks such as the EU-U.S. Privacy Shield.

5. The Recipient and Transfers of This Data

For certain purposes identified above, Scalex Invest makes use of service providers or subcontractors (e.g. those in charge of monitoring the premises or charged with providing administrative services like archiving) such as IT service providers (e.g. web hosting service providers), solutions in the form of software-as-a-service (SaaS) which need to access the Data to carry out the assignment entrusted to them by Scalex Invest (e.g., Airtable for startup documents), including certain providers outside France.

In this case, Scalex Invest imposes strong obligations on these contracting parties regarding the processing, the confidentiality, and the security of the Data to which these providers have access.

Scalex Invest may also be required to disclose the Data to third parties in certain specific cases:

• If Scalex Invest plans to sell any business or assets (including by selling the business which carries out that activity or owns those assets), the Data may be disclosed to potential acquirers as part of an audit, including their advisors;
• If all or part of Scalex Invest’s assets are acquired by a third party, the Data will be one of the transferred assets and will therefore be processed by the acquirer who will act as the new Data controller and its data policy will govern the Data processing;
• If Scalex Invest must communicate or give access to the Data to comply with a legal or regulatory obligation, a court decision, or a request from an administrative authority;
• If the law or You yourself authorises this transfer by Scalex Invest.

In any eventuality, Scalex Invest does not sell the Data to third parties other than our clients. The Data of the companies which are the object of a service, notably rating, will be shared with the client(s) who ordered the service or who would be interested in receiving the report, as well as the clients linked to Scalex Invest by the contracted subscription to the ratings. The transmission of your Data is based on the fulfilment of the contract between You and Scalex Invest in the scope of this assignment.

6. Length of Data Storage

The Data (in particular, the startup rating report) is kept for a period of five years from the completion of the service, whether as a contract with a client or as the completion of a service (notably startup rating) for the completion of a service by a supplier. However:

• The Data of prospects, Sourced Startups or Indexed Startups is deleted within three years of its collection or the last contact with You;
• In pre-litigation matters, the Data is stored until the conclusion of a settlement agreement or, if not, until the prescription of the corresponding legal action;
• In matters of judicial litigation, the Data is stored until the decision has the force definitive of res judicata.

In addition, anonymous data and data relating to Startups may be kept indefinitely as long as it does not contain any Data.

7. Actions Carried Out on the Data

The following actions are carried out on the Data:

• Collection and saving
• Organisation and structuring
• Hosting or storing in third-party software
• Consultation
• Sorting (via a solution published by a third party)
• Archiving externally
• Communication by transmission, disclosure, or in other form made available to the services concerned
• Modification/consultation by the account management service or marketing service
• Deletion or destruction

8. The Location of the Data and Security Measures in Place

Your Data is hosted within the European Union but is accessible, in particular, to certain subcontractors in the United States. Scalex Invest takes all necessary precautions to ensure the confidentiality of the Data and to prevent its alteration, corruption, or access by unauthorized persons with respect to the Data concerned. For example, access to your Data is limited and restricted to only those persons/services that need to access it. This Data is stored on secure servers, and bank data is also encrypted. Access to the Data requires the use of a username and password.

Nevertheless, the Data transmission via the internet is not without risk. Therefore, Scalex Invest does not guarantee the security of Data transmitted via the internet once Scalex Invest has fulfilled its commitments to security.

In the event that transfers of Data take place outside the European Union, they comply with the General Data Protection Regulation (GDPR) and, in particular, are subject to the signature of standard contractual clauses, as laid out by the European Commission, or are carried out only in countries that have been the object of an adequacy finding by a competent authority, such as subcontractors located in the United States certified under the Privacy Shield Framework, or that provide an equivalent level of protection to that provided by the GDPR.

9. Rights of Those Concerned and the Exercise of Rights

As part of the Data processing carried out by Scalex Invest, You have the right:

• To obtain access to the Data processed and a copy of said Data;
• To obtain rectification of the Data;
• To obtain deletion of all or part of the Data when the Data (i) is no longer necessary for the purposes for which it was collected, (ii) is based exclusively on consent, (iii) is the subject of an opposition request;
• To oppose the processing of your Data for legitimate reasons and to obtain the limitation/restriction of the processing, temporarily, when the accuracy of the Data is contested or when the Data is no longer necessary for Scalex Invest but is still necessary for the exercise or defence of legal rights;
• To unsubscribe or oppose the receipt of business prospecting messages at any time by clicking on the “unsubscribe” link in any email or communication sent by Scalex Invest;
• To withdraw, at any moment, your consent to any Data processing based on consent;
• To obtain portability of the Data when the processing is based on consent and the processing is carried out using automated procedures;
• To provide guidance on the fate of Data post-mortem; and
• To file a complaint with the CNIL.

You can read more about your rights in detail here. To exercise your rights or for any issue relating to the Privacy Policy, please address your question to the following address: contact@scalex-invest.com.

If You intend to exercise any of your rights, We reserve the right to verify your identity before accessing your request and in particular to obtain a copy of your identification documents.

‍