- Last updated: [VALIDATION AND PUBLICATION DATE]
- Website: [FINAL SCALE & OWN URL]
1. Data controller
- Identity or legal business name: [TO BE COMPLETED]
- Address: [TO BE COMPLETED]
- Email address for exercising privacy rights: [TO BE COMPLETED]
- Data protection officer: [CONTACT DETAILS IF A DPO IS APPOINTED, OTHERWISE REMOVE THIS LINE]
2. Data that may be collected at launch
2.1 Training waiting list and newsletter
If the form is enabled, Scale & Own collects the email address and, only if the field actually exists, the first name. Technical data needed to demonstrate consent may also be retained.
2.2 Requests sent to Scale & Own
When a reader writes to the contact address or uses a form, the data contained in the message, their contact details and the information needed to follow up the request may be processed.
2.3 Technical data and audience measurement
The server may record technical data needed for website security and operation, such as the IP address, connection date, requested resource and browser information.
[TO BE CONFIRMED AFTER AUDIT] If an audience-measurement tool is enabled, this policy must state its name, configuration, collected data and whether prior consent is required.
2.4 Services that are not yet open
At this stage, Scale & Own does not sell training and should not collect billing, payment, customer-account or learning-progress data. This section must be reviewed before a course area or payment facility is opened.
3. Purposes, lawful bases and retention periods
| Planned processing | Data | Purpose | Lawful basis | Retention period |
|---|---|---|---|---|
| Waiting list or newsletter | Email address, first name if requested, evidence of consent | Send the requested information and announce the opening of training | Consent | Until consent is withdrawn, followed by limited retention of the evidence for the validated period |
| Contact request | Contact details and message content | Respond to and follow up the request | Legitimate interests or steps before entering into a contract, depending on the request | [PERIOD TO BE SET] |
| Technical logs | IP address and connection data | Secure the website, diagnose errors and prevent abuse | Legitimate interests | [PERIOD TO BE SET WITH THE HOSTING PROVIDER] |
| Audience measurement | [TO BE INVENTORIED] | Understand use of the website and improve content | Consent, unless the actual configuration qualifies for a documented exemption | [PERIOD TO BE SET IN THE TOOL] |
| Videos or external content | [TO BE INVENTORIED] | Display the requested content | Consent when non-essential trackers are used | According to the provider and the validated configuration |
The periods shown must correspond to the actual settings and the record of processing activities. Data must not be retained for longer than is necessary for the stated purpose.
4. Recipients and processors
Data is accessible only to authorised people within the publishing entity and to service providers that need it to deliver their services.
Before publication, complete the following list with the providers that are actually retained:
- Hosting: [PROVIDER AND COUNTRY TO BE CONFIRMED]
- Email delivery and waiting-list management: [TOOL TO BE CONFIRMED]
- Forms: [TOOL TO BE CONFIRMED]
- Audience measurement: [TOOL AND CONFIGURATION TO BE CONFIRMED]
- Embedded video: [PROVIDER AND PRIVACY MODE TO BE CONFIRMED]
- Backup, security and maintenance: [PROVIDERS TO BE CONFIRMED]
- Training or payment platform: no service to declare while the offer remains closed
Scale & Own does not sell its readers’ personal data.
5. International data transfers
Some providers may process data outside the country or region in which the reader lives. The published version must identify the relevant transfers and the safeguards used under the law that applies to the publisher and the affected reader.
[TO BE COMPLETED AFTER PROVIDERS ARE SELECTED] Do not claim that a provider benefits from a transfer mechanism without checking it on the validation date.
6. Your rights
Depending on the applicable law, the processing activity and its legal basis, a person may have rights to access, correct or delete their data, restrict or object to processing, or receive portable data. Where processing relies on consent, that consent may be withdrawn at any time without affecting processing already carried out lawfully.
To exercise these rights, write to [CONTACT ADDRESS TO BE COMPLETED], describing the request and providing the information needed to identify the relevant data. Proof of identity will be requested only when there is reasonable doubt and only to a proportionate extent.
The published version must also identify the appropriate supervisory authority or privacy regulator: [AUTHORITY AND COMPLAINT ROUTE TO BE CONFIRMED].
7. Security
Scale & Own applies technical and organisational measures proportionate to the risks, including encrypted connections, restricted access, updates, backups and protections for administrator accounts.
The published description must remain faithful to the measures actually deployed. Absolute security cannot be guaranteed.
8. Children
Scale & Own’s content is intended for adults. The website does not knowingly seek to collect data from children. If the controller learns that a child’s data was submitted without a valid basis, it will take appropriate steps to delete it.
9. Changes to this policy
This policy may change when processing activities, providers or regulations change. The date at the top of the page identifies the current version.
If a material change affects processing based on consent, the people concerned will be informed or asked again where the applicable framework requires it.