Privacy Policy

PRIVACY POLICY (SOFTWARE AND SERVICES) – General Provisions

This Privacy Policy (Software and Services) provides the policy and practice of SCALITY (“We” or “SCALITY”) for the protection of personal data and details on how we collect, use, process, and share personal data we may collect through the use of SCALITY’s software and services (“Software and Services”) by the users (the “Users” or “You”) and during our business and marketing activities.

This Privacy Policy is composed of General Provisions and Specific Provisions to make it easier for you to read and understand what provisions should apply to you depending on which country you reside or are located in.

1. SCALITY contact details

As a general overview, SCALITY is a group of affiliated companies, held by SCALITY Inc. based in San Francisco (United States of America) and providing the Software and Services described in Section 2 below.

For any general questions about SCALITY’s practice of personal data, these General Provisions, to exercise your rights, and/or other privacy requests or inquiries, please contact us:

By email: legal@scality.com
By mail: SCALITY Inc.
149 New Montgomery Street, Suite 607 San Francisco, CA, 94105

For any question or request for information related to a specific country, please refer to the appropriate contact information in the Specific Provisions of the relevant country.

2. SCALITY Software and Services

SCALITY provides secure storage software through the below 2 types of software:

• ARTESCA: a simple and secure S3 object storage software for modern applications and immutable backups, ARTESCA enables hassle-free, efficient growth from a single physical server or virtual machine all the way to petabyte capacity. For more details, please visit this link.
• RING: an unbreakable cloud storage solution for data centers that offers unlimited, independent scale out of capacity and throughput performance — plus, multi-protocol application support with AWS S3-compatible API and standard NFS, SMB file interfaces. For more details, please visit this link.

SCALITY provides also updates, upgrades, and maintenance services for the Users of ARTESCA and RING.

3. Information collected

This section describes the type of information we may collect and process to perform the Software and Services that you use. SCALITY may also collect and process some personal information that you have provided us through an exchange of business cards, during a promotional event through specific register forms and marketing and promotional materials such as satisfaction questionnaires.

Please note that the Specific Provisions provide you with more detailed information and definitions of the type of information collected according to the applicable local regulations.

3.1. What type of information we collect

SCALITY may collect the following personal information or data from you directly that you have agreed to provide us:

• Direct identifier information (first and last name, job title and position, address, email address, telephone number, or personal email address).
• Company’s name, address, email address, and telephone number
• Country and States (for the United States of America)
• Registration information (user ID and password)
• Transaction information (bank account number for direct debit, credit card number etc.
• Geolocation information (device location, IP address, etc.)

3.2. What information we do not collect

SCALITY does not collect information or data related to medical status, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information or data, biometric information or data, and criminal records, offenses, or accusations.

SCALITY does not knowingly collect any information or data directly or indirectly that may allow us to identify an individual under the age of 18.

4. Purpose of processing

We may use the information or data that we collect about you for the following purposes:

• Software and Services administration and improvement
  Your personal information or data may be used to perform our contractual obligations to you with the purchased Software or requested Services, to provide you with the updates and upgrades of Software and maintenance services, offer you the optimal customer experience, to improve existing Software and Services, and to develop new products and services.
• Marketing communications
  We may use your personal information or data for marketing communications by sending newsletters, promotional messages for the purchase of the Software, the provision of the Services, participation in events, and/or provide you with other information that may be of interest to you.
  You can opt-out of marketing communications at any time by submitting a request by email at: team.web@scality.com
• Security
  We may use your personal information or data to verify your identity, to monitor compliance with our policies and procedures, for fraud prevention, to ensure Software and processes work properly and securely, and to investigate and prosecute Users who violate our rules or who engage in behavior that is illegal or harmful to SCALITY or a third party.
• Compliance with legal and regulatory matters
  We may also use your personal information or data in connection with legal and regulatory matters such as our maintenance of business or processing records, compliance with external reporting requirements and internal policies and procedures, and responses to requests by government, law enforcement, regulators, courts, rights holders or other third parties.

5. Disclose of Personal Data

Affiliates – as part of conducting business within SCALITY’s group, SCALITY’s companies may disclose the personal information or data collected through the provision of Products and Services to other affiliates or subsidiaries for the purposes described in this Privacy Policy and subject to the provisions of this Privacy Policy. For the list of SCALITY’s companies, please access this page.

Services Providers – SCALITY may disclose personal information or data with third-party vendors, service providers contractors, and agents (the “Service Providers”) for business and commercial purposes and who perform functions on our behalf and according to a contractual relationship. The Service Providers are authorized to use the personal information or data provided by SCALITY only where such disclosure is necessary to provide these services to us. These Service Providers have agreed to minimize and proportionality restrict the use of any personal information or data we share with them either solely for the purpose of providing the contracted service to us.

Legal obligations – SCALITY may disclose personal information or data in case it is necessary to prevent, investigate, or take action against illegal activities, suspected fraud, situations involving potential threats to the safety of any person or public orders, to comply with a legal obligation, decision of a judicial court or governing regulatory authorities, or as evidence in a litigation involving SCALITY.

6. International transfer

SCALITY may transfer your personal information or data to foreign countries where SCALITY’s companies or Service Providers are located. For the details of the regulations applicable to the international transfer of a specific country, please refer to the relevant Specific Provisions.

Intercompany transfer – your personal information or data may be transferred and/or processed by and among SCALITY’s companies located in several foreign countries. For the list of SCALITY’s companies, please access this page.

International transfer to Service Providers – your personal information or data may also be transferred to our Service Providers located in foreign countries. Any international transfer of personal information or data to Service Providers located in foreign countries is conducted in compliance with the relevant data protection regulations of the transferor and transferee’s country including, where appropriate, by concluding an appropriate data transfer agreement between SCALITY and the Service Provider.

7. Storage and Security

SCALITY stores your personal information and data as long as it is reasonably necessary for the purpose described in this Privacy Policy and for which it was collected, except if otherwise required by applicable laws and regulations. Where your personal information or data is no longer needed, we will ensure that your personal information and data are deleted securely.

SCALITY has implemented and maintains appropriate technical and organizational security measures, internal policies, and procedures, and provides training to its employees to protect appropriately your personal information and data from unauthorized access, exfiltration, theft, loss, misuse, disclosure, alteration, or destruction. However, risks such as hacking by unauthorized third parties and interference with our security system cannot be ruled out. Therefore, please take care when transmitting personal data via the Internet.

8. Your rights

As a general rule, you have the following rights:

• Right to withdraw your consent: you have the right to withdraw at any time your consent previously given regarding the collection and processing of your personal information and data and to request SCALITY to cease the use of such information or data.
• Right of access and to be informed: you have the right to access and request information about the purposes, legal framework, interests, recipients, or categories of recipients with whom your personal information or data is shared, and the transfer to a third country.
• Right to rectify, restrict the processing, or erase: you have the right to request SCALITY to verify the accuracy of your personal information or data and request to update, correct restrict the processing, or erase your personal information or data if necessary.

In addition, subject to the country where you live, specific or additional rights may be granted to you depending on the local data protection regulations. We invite you to verify the Specific Provisions for the rights provided by the local data protection regulations.

To exercise the rights described above, you need to submit your verifiable request to legal@scality.com

To respond to your request, we will need to verify your identity. Therefore, you can only exercise the above rights by making a verifiable request which must:

• provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or data or an authorized representative (or if you have appointed an agent, that you in fact authorized such agent);
• describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it

We will not respond to any request if we are unable to verify your identity and therefore confirm the personal information or data in our possession actually relates to you. If you are an adult, you can make a verifiable request on behalf of a minor under your parental authority. Unless otherwise permitted by law, you can submit a maximum number of 2 requests over a period of 12 months.

We will confirm receipt of your verifiable request within the period proscribed by applicable law, provided that where no such period is proscribed, we endeavour to respond within 10 days and provide information about how we will process your request.

We will respond to your request within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to the shorter of the longest period permitted by applicable law, or 90 days to fulfill your request.

Our disclosure(s) will cover not more than the preceding 12-month period.

Should we deny your request, we will explain to you the reasons behind our denial.

We do not charge a fee to process or respond to reasonable verifiable requests unless such request is manifestly unfounded or excessive. In such cases, we may charge a reasonable fee, or refuse to act on the request. In either case, we will communicate our choices and explain the reasons behind it

9. Privacy for minors under 18

The Software and Services are not intended to be used by minors under the age of 18 except in specific circumstances for educational purposes under the direct supervision of a teacher or parent.

SCALITY does not knowingly collect personal information or data from minors under 18. If a parent or guardian becomes aware that his or her child has provided us with personal information or data without their consent, he or she should contact us at legal@scality.com.

If we become aware that a minor under 18 has provided us with personally identifiable data, we will delete such information or data from our database.

10. Changes to the Privacy Policy (General Provisions)

These General Provisions are effective as of the date indicated in the Section “Update History”. Please note that the effective date of Specific Provisions may differ from the General Provisions.

Changes to these General Provisions or any Specific Provisions will be promptly posted to this page and accompanied by a new effective date in the Section “Update History”.

PRIVACY POLICY (SOFTWARE AND SERVICES) – Specific Provisions

1. UNITED STATES OF AMERICA

If you are residing in or located in the United States of America, these Specific Provisions shall govern the collection and processing of your personal information or data, in addition to the foregoing General Provisions.

These Specific Provisions provide you with information about the privacy laws and regulations in the United States of America, including as an example, the California Consumer Privacy Act and California Privacy Rights Act of 2020 (California. Civil Code 1798.100, et seq. “CCPA” /CPRA”) in relation to the personal data that you agree to provide to SCALITY.

You understand and agree that this Privacy Policy (Software and Services) shall be effective and binding between you and SCALITY Inc., the company incorporated in the United States of America and you agree for the collection, processing, transfer to a third party (including international transfer) of your personal information or data.

1.1. Contact details

SCALITY Inc., incorporated under the laws of California, is acting as the owner and data controller for the collection and processing of your personal information, during the provision of Software and Services and collects some information that you have agreed to provide us through an exchange of business cards, during a promotional event through specific register forms and marketing and promotional materials such as satisfaction questionnaires.

SCALITY Inc.’s information is as follows:
SCALITY, Inc.
149 New Montgomery Street, Suite 607 San Francisco, CA, 94105
Chief Executive Officer: Jérôme Jules André LECAT

For any questions about these Specific Provisions for the United States of America or request for information, please contact:
By email: legal@scality.com
By mail: Scality, Inc.
149 New Montgomery Street, Suite 607 San Francisco, CA, 94105

1.2. Personal Data collected

SCALITY, Inc. collects the personal information listed in Section 3.1. of the General.

SCALITY, Inc. does not collect sensitive personal information as defined under the CCPA/CPRA and other state laws, such as genetic data, biometric information, health information, information about sex life or sexual orientation, racial or origin, religious or philosophical beliefs, or union membership, contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication, account log-in, financial account, debit card or credit card number in combination with any required security or access code, password or credentials allowing access to an account, precise geolocation Social Security, driver’s license, and state identification card or passport number. The Scality, Inc. service is not directed to children (minors under the age of 16) and Scality, Inc. does not have actual knowledge that it has collected any such information in the 12 months preceding the date this policy was updated.

1.3. Purpose of use and legal basis

SCALITY, Inc. collects and processes your Personal Data for the purposes of use listed in Article 4 of the General Provisions.

1.4. International Transfer

Your personal information may be transferred and processed by and among SCALITY, Inc. and its affiliates in the SCALITY Group since we operate on a global basis. Our group maintains all securities requirements based on the EU data protection regulations as well as regional requirements where EU standards are not sufficient and to ensure adequate protection during personal data worldwide transfers among the companies of SCALITY Group.

Your personal information may also be transferred and processed by our vendors, suppliers, and business partners in other countries. Any international transfer of personal data to third parties, and other countries with cross-border transfer restrictions, will be conducted in compliance with the international data-transfer restrictions and requirements that apply under data protection laws, including, where appropriate, using appropriate data transfer agreements for personal data transfers to data processors or data controllers.

1.5. Your Rights

In addition to the rights listed in Section 8 of the General Provisions, you have the following additional rights:

• Anti-Discrimination rights: you have the right to be free from discrimination if you choose to exercise your privacy rights. We will not discriminate against you for exercising your rights.
• Right to designate an authorized agent: you may designate an authorized agent to exercise some of your rights; however, in order to help protect the security of your personal information, the authorized agent must follow the same authentication procedures that are required if you exercise your rights without using an agent. SCALITY will verify requests made through authorized agents to help ensure the safety of your account and to comply with our policies and procedures.

1.6. California residents’ privacy rights

If you are residing in or located in California, or in any jurisdiction that has substantially similar rights under that State’s laws, you have specific rights according to the CCPA/CPRA or such laws. Scality will comply with such laws. This Section 1.6. provides you with the supplement information applicable to California residents, and residents of States with substantially similar laws or regulations.

• Categories of personal data collected: we collect the personal data described in Section. 3.1 of the General Provisions.
• Sources of collection: we may collect your personal data when using our Softwares and Services listed in Section 2 of the General Provisions we may also collect some information that you have provided us through an exchange of business cards, during a promotional event through specific register forms and marketing and promotional materials such as satisfaction questionnaires. We may also collect de-identified information through cookies or use of other technology such as clear gifs that links a session with the person invoking such session, but is not otherwise linked to personal information of such user. As an example, we may have technology that can detect when an individual who we have sent an email, opens that email.
• Purposes of use: the purpose of use is as described in Section 4 of the General Provisions.
• Disclosure of personal data: we disclose your personal data to the recipients described in Section 5 of the General Provisions.
• Sale of personal data: we do not “sell” personal information directly, for example, we do not collect personal information and then transfer it to data brokers or third parties for compensation. However, we may use data analytics providers that assign de-identified links to your interactions with us, which do not constitute “service providers” under CCPA/CPRA, and as such, the use of such de-identified information by us may be construed to be a “sale” of personal information. We do not knowingly collect or sell personal information of minors under 16 years of age
• Your rights as a California resident: in addition to the rights provided in General Provisions and in these Specific Provisions, you have the following additional rights:
• Right to opt-out of the sale of Personal Information: you have the right to opt out of the sale of your personal information to third parties. You may exercise this right in accordance with our Notice of Right to Opt-out of Sale/Sharing.

Except with respect to opt out of sale of personal information, which is processed online, we will not respond to any other request if we are unable to verify your identity and therefore confirm the personal information in our possession relates to you.

If you cannot personally submit a verifiable request, you can authorize a person registered with the California Secretary of State to act on your behalf. We will confirm receipt of your verifiable request within the time required by applicable law, or if no such period is specified, we typically confirm receipt in not more than 10 days and provide information about how we will process your request.

We will respond to your request within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to 90 days to fulfill your request. Our disclosure(s) will cover the preceding 12-month period. Should we deny your request, we will explain to you the reasons behind our denial.

We do not charge a fee to process or respond to your verifiable request unless such request is manifestly unfounded or excessive. In such cases, we may charge a reasonable fee, or refuse to act on the request. In either case, we will communicate our choices and explain the reasons behind it.

To exercise your right to opt out, please contact us at: team.web@scality.com

1.7. Change to the Privacy Policy (Specific Provisions)

We will use Personal Data only in the manner described in this Privacy Policy (Specific Provisions). However, and subject to any applicable consent requirements, we reserve the right to change the terms of this Privacy Policy (Specific Provisions) at any time. Any changes to this Privacy Policy (Specific Provisions) will be promptly posted to this page and accompanied by a new effective date in the Section “Update History”. We invite you to review this Privacy Policy (Specific Provisions) regularly for any changes. Any Personal Data collected will be handled in accordance with the currently posted Privacy Policy (Specific Provisions).

We will endeavor to amicably resolve any disputes that arise out of or in connection with this Privacy Policy. However, in the case of such a dispute can not be resolved amicably, it shall be settled by the district court having jurisdiction over the location of SCALITY, Inc.’s head office.

1.8. Opt Out Preference signal

We respect the general privacy control setting in modern browsers. The opt out made in this manner will apply to that specific browser, and will not be saved if you use a different browser. You can enable the GPC option in most browsers under settings, Privacy. For example, in Chrome, go to Settings | Privacy and Security | Third-party Cookies | and toggle “Send a “Do Not Track” request with your browsing traffic” to on.

1.9. Notice at Collection

• The categories of personal information about consumers that are collected: direct identifier information (such as first and last name, job title and position, address, email address, telephone number, or personal email addresses); Company’s name, address, email addresses, and telephone numbers and taxpayer identification numbers; registration information (user ID and password); transaction information (bank account number for direct debit, credit card number etc.); geolocation information (device location, IP address, etc.)
• The purpose(s) for which the categories of personal information are collected and used: personal information is collected to provide the service to customers, for analytics purposes to improve the service, and to track the effectiveness of communications with users for purposes of enhancing the user experience with us
• Explanation of how each category of personal information identified in (1) above is sold or shared: No information is overtly sold, however, de-identified data is shared with analytics providers, who do not charge for their service, and use such de-identified data for their own purposes and to sell their analytics and marketing services.
• The length of time the business intends to retain each category of personal information: personal information is only intended to be retained while the user is a customer, however, some Personal Information can be retained for longer periods such as stored in backup storage, email communication systems, and in the case of a dispute or request hereunder, until such dispute or matter is resolved.
• Link to the Notice of Right to Opt-out of Sale/Sharing

2. EUROPEAN UNION

If you are residing in or located in a country in the European Union, extended to the European Economic Area, these Specific Provisions shall govern the collection and processing of your personal information or data, in addition to the foregoing General Provisions.

These Specific Provisions provide you with information about the data protection regulations in countries in the European Union in relation to the personal information or data that you agree to provide to SCALITY. These Specific Provisions supplement and complete the General Provisions by reflecting the requirements set out in the General Data Protection Regulation (Regulation (EU) 2016/679) and any transposition local law (“GDPR”).

You understand and agree that this Privacy Policy (Software and Services) shall be effective and binding between you and SCALITY SA, the local SCALITY company in France and you agree for the collection, processing, transfer to a third party (including international transfer) of Personal Data (as defined below) by SCALITY SA and SCALITY.

2.1. Definitions

In these Specific Provisions, the following terms shall have the following meanings. The terms used with a capital letter and not defined below shall have the meaning ascribed to them in the General Provisions.

Biometric Data means Personal Data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.

Controller: a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Data Concerning Health: means Personal Data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.

Genetic Data: means Personal Data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question.

Personal Data: any information relating to an identified or identifiable natural person (‘Data Subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing: means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.

Consent: means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her.

2.2. Contact details

SCALITY S.A., incorporated under the laws of France, is acting as the Processor and the Controller for the collection and the processing of your Personal Data during the provision of Software and Services and collects some information that you have agreed to provide us through an exchange of business cards, during a promotional event through specific register forms and marketing and promotional materials such as satisfaction questionnaires.

SCALITY S.A.’s information is as follows:
SCALITY S.A.
11 Rue Tronchet 75008 PARIS
Président Directeur Général : Jérôme Jules André LECAT
Data Protection Officer: Pierre DEROME

For any questions about these Specific Provisions for European Union or request for information, please contact:
By email: legal@scality.com
By mail: SCALITY S.A.
11 Rue Tronchet 75008 PARIS

2.3. Personal Data collected

SCALITY S.A. collects the information listed in Section 3.1. of the General Provisions which we consider as Personal Data under the GDPR.

SCALITY S.A. does not collect Biometric Data, Genetic Data or any Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of Biometric Data, Genetic Data, or any Personal Data for the purpose of uniquely identifying a natural person, Data Concerning Health or data concerning a natural person’s sex life or sexual orientation or any Personal Data directly or indirectly that may allow us to identify an individual under the age of 16.

2.4. Purpose of use and legal basis

SCALITY S.A. collects and process your Personal Data for the purposes of use listed in Article 4 of the General Provisions.

SCALITY S.A. may collect and process your Personal Data only if, at least, one of the following legal basis applies:
(a) You have given your consent to the collection and the processing of you Personal Data for one or more specific purposes;
(b) The collection and the processing of your Personal Data are necessary for the performance of an agreement that you have entered into with us;
(c) The collection and the processing are necessary to us to be compliant with a legal and regulatory obligations;
(d) The collection and the processing are related to a task that is carried out in the public interest or in the exercise of official authority vested in SCALITY S.A.;
(e) The collection and the processing are necessary for the purposes of the legitimate interests pursued by SCALITY S.A. or by a third party.

2.5. Data Processors

SCALITY S.A. may outsource to the following service providers for processing your Personal Data in the performance of the Software and Services and therefore, may transfer your Personal Data to these service providers:

A) Salesforce, Inc. (« Salesforce »): Salesforce is SCALITY’s service providers for the performance of customer relationship management (CRM) and provide SCALITY with the CRM management platform software to facilitate the management of client’s information and building up the marketing strategy. For the Salesforce’s privacy policy, please access here.

B) Google Analytics 4 (« GA4 ») : GA4 assists SCALITY in performing statistical and data analysis. For the Google’s privacy policy, please access here.

C) Veeam Software Group GmbH (« Veeam »): from time to time, Veeam is the partner of SCALITY during the marketing and/or promotional event and may collect and process the Personal Data for or on behalf of SCALITY. For Veeam’s privacy policy, please access here.

D) Hewlett Packard Enterprise (« HPE »): from time to time, HPE is the partner of SCALITY during the marketing and/or promotional event and may collect and process the Personal Data for or on behalf of SCALITY. For HPE’s privacy policy, please access here.

These service providers may transfer your Personal Data to a location outside of the European Economic Area depending on their respective privacy policies. Therefore, we recommend you read each of the privacy policies to learn about the privacy terms applicable to you.

2.6. International Transfer

SCALITY S.A. is an affiliate of SCALITY Group and we operate on a global basis. SCALITY Japan K.K. could transfer your Personal Data to another company of SCALITY Group located outside the European Economic Area and the European Union. For the list of SCALITY’s companies, please access this page.

SCALITY S.A. may outsource to service providers for the processing of your Personal Data which could be located outside the European Economic Area and the European Union. For the list of service providers, please see section 2.5. of the Specific Provisions.

SCALITY S.A. takes appropriate steps to ensure that transfers of personal information are in accordance with applicable law and carefully managed to protect your privacy rights and interests and transfers are limited to countries that are recognized as providing an adequate level of legal protection under Article 45 of the GDPR or where we can confirm that alternative arrangements are in place to protect your Personal Data. Otherwise, we rely on measures provided by the GDPR such as concluding the Standard Contractual Clause or verifying that the recipient has adopted Binding Corporate Rules, which contractually oblige each member to ensure that Personal Data receives an adequate and consistent level of protection.

2.7. Your rights

In addition to the rights listed in Section 8 of the General Provisions, according to the GDPR you have the following additional rights:

• Right to object to processing: you have the right to object to the processing of your Personal Data, including the right to object to marketing and promotional campaigns.
• Right to data portability: you have the right to receive your Personal Data, which you have provided to us, in a structured, commonly used and machine-readable format and you also have the right to transmit those data to another Controller without hindrance from us.
• Right to lodge a complaint: you have the right to contact the local supervisory authority for the Data Protection to lodge a complaint if your request or concern is not satisfactorily resolved by us.
• Right to an effective judicial remedy against a controller or processor or against a supervisory authority: you have the right to an effective judicial remedy if you consider that your rights under the GDPR have been infringed as a result of the processing of your Personal Data in non compliance with the GDPR and also the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning you.

To exercise the rights described above, you need to submit your verifiable request to legal@scality.com

2.8. Change to the Privacy Policy (Specific Provisions)

We will use Personal Data only in the manner described in this Privacy Policy (Specific Provisions). However, and subject to any applicable consent requirements, we reserve the right to change the terms of this Privacy Policy (Specific Provisions) at any time. Any changes to this Privacy Policy (Specific Provisions) will be promptly posted to this page and accompanied by a new effective date in the Section “Update History”. We invite you to review this Privacy Policy (Specific Provisions) regularly for any changes. Any Personal Data collected will be handled in accordance with the currently posted Privacy Policy (Specific Provisions).

We will endeavor to amicably resolve any disputes that arise out of or in connection with this Privacy Policy. However, in the case if such a dispute can not be resolved amicably, it shall be settled by the district court having jurisdiction over the location of SCALITY S.A.’s head office.

3. UNITED KINGDOM

If you are residing or located in the United Kingdom, these Specific Provisions shall govern the collection and processing of your personal information or data, in addition to the foregoing General Provisions.

These Specific Provisions provide you with information about the data protection regulations in the United Kingdom in relation to the personal information or data that you agree to provide to SCALITY. These Specific Provisions supplement and complete the General Provisions by reflecting the requirements set out in the General Data Protection Regulation (the retained EU law version of Regulation (EU) 2016/679), the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 and the Data Protection Act 2018.

3.1. Definitions

In these Specific Provisions, the following terms shall have the following meanings. The terms used with a capital letter and not defined below shall have the meaning ascribed to them in the General Provisions.

Controller means the person who alone or jointly with others, determines the purposes and means of the processing of personal data.

Personal Data means any information relating to an identified or identifiable living individual.

Processing means an operation or set of operations which is performed on information, or on sets of information, such as collection, recording, organization, structuring or storage, adaptation or alteration, retrieval, consultation or use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, or restriction, erasure or destruction.

Processor means the person who processes personal data on behalf of the controller.

Public Authority means public authority as defined by the Freedom of Information Act 2000, a Scottish public authority as defined by the Freedom of Information (Scotland) Act 2002, the Advanced Research and Invention Agency, and an authority or body specified or described by the Secretary of State in regulations.

3.2. Contact Details

SCALITY Limited, incorporated under the laws of the United Kingdom, is acting as the Controller and the Processor for the Processing of your Personal Data, during the provision of Software and Services and collects some information that you have agreed to provide us through an exchange of business cards, during a promotional event through specific register forms and marketing and promotional materials such as satisfaction questionnaires.

SCALITY Limited’s information is as follows:
SCALITY Limited
Quadrant House, Floor 6, 4 Thomas More Square, London, United Kingdom, E1W 1YW
Director: Jérôme Jules André LECAT
Data Protection Officer: Pierre DEROME

For any questions about these Specific Provisions for the United Kingdom or request for information, please contact:
By email: legal@scality.com
By mail: SCALITY Limited
Quadrant House, Floor 6, 4 Thomas More Square, London, United Kingdom, E1W 1YW

3.3. Personal Data collected

In addition to the Personal Data collected by SCALITY Limited listed in Section 3.1. of the General Provisions, which we consider Personal Data, the following additional Personal Data may be collected by SCALITY Limited:

• Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses;
• Usage Data includes information about how you use our website, products and services; and
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

3.4. How is your Personal Data collected?

We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your Identity, contact and financial data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
  – apply for our products or services
  – create an account on our website
  – subscribe to our service or publications
  – request marketing to be sent to you
  – enter a competition, promotion or survey
  – give us feedback or contact us
• Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our Cookie Policy for further details.
• Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources as set out below:
  Technical Data from the following parties:
  (i) analytics providers such as Google based outside the UK
  (ii) advertising networks based inside or outside the UK
  (iii) search information providers based inside or outside the UK
  Contact, financial and transaction data from providers of technical, payment and delivery services
  Identity and contact data from data brokers or aggregators based inside and outside the UK
• Marketing and communications data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• Profile data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses
• Technical data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website
• Usage Data includes information about how you use our website, products and services

3.5. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.

Generally, we do not rely on consent as a legal basis for processing your personal data, although we will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

SCALITY Limited does not collect special categories of Personal Data (including data relating to race, religion, sexual life, data pertaining to health, genetics and biometrics) and Personal Data relating to criminal convictions and offences.

3.6. Purpose of use and legal basis

SCALITY Limited collects and processes your Personal Data for the purposes of use listed in Article 4 of the General Provisions.

SCALITY Limited may collect and process your Personal Data only if, at least, one of the following legal basis applies:
(a) You have given your consent to the collection and processing of your Personal Data for one or more specific purposes;
(b) The collection and processing of your Personal Data are necessary for the performance of an agreement that you have entered into with us or for any pre-contractual obligations;
(c) The collection and processing are necessary for us to be compliant with legal and regulatory obligations;
(d) The collection and the processing are related to a task that is carried out in the public interest or in the exercise of official authority vested in SCALITY Limited.

3.7. International Transfer

Your personal information may be transferred and processed by and among SCALITY Limited and its affiliates in the SCALITY Group since we operate on a global basis. Our group maintains all securities requirements based on the EU data protection regulations as well as regional requirements where EU standards are not sufficient and to ensure adequate protection during Personal Data worldwide transfers among the companies of SCALITY Group.

Your Personal Data may also be transferred and processed by our vendors, suppliers, and business partners in other countries. Any international transfer of Personal Data to third parties, and other countries with cross-border transfer restrictions, will be conducted in compliance with the international data-transfer restrictions and requirements that apply under data protection laws, including, where appropriate, using appropriate data transfer agreements for Personal Data transfers to Controllers or Processors.

3.8. Your Rights

In addition to the rights listed in Section 8 of the General Provisions, you have the following additional rights:

• Right to object to processing: you have the right to object to the processing of your Personal Data, including the right to object to marketing and promotional campaigns.
• Right to data portability: you have the right to receive your Personal Data, which you have provided to us, in a structured, commonly used, and machine-readable format and you also have the right to transmit those data to another Controller without hindrance from us.
• Right to not be subject to automated decision making, including profiling: you have the right to refuse to be subject to automated decision making (including profiling) and also to obtain human intervention, to contest the decision, and to express your point of view.
• Right to lodge a complaint: you have the right to contact the Public Authority to lodge a complaint if your request or concern is not satisfactorily resolved by us.

3.9. Withdrawal of your consent

If at any time where we are relying on consent to process your personal data, you may withdraw your consent. However, this will not affect the lawfulness of any processing carried out before you do so. If you do withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

To exercise the rights described above, you need to submit your verifiable request to legal@scality.com

3.10. Change to the Privacy Policy (Specific Provisions)

We will use Personal Data only in the manner described in this Privacy Policy (Specific Provisions). However, and subject to any applicable consent requirements, we reserve the right to change the terms of this Privacy Policy (Specific Provisions) at any time. Any changes to this Privacy Policy (Specific Provisions) will be promptly posted to this page and accompanied by a new effective date in the Section “Update History”. We invite you to review this Privacy Policy (Specific Provisions) regularly for any changes. Any Personal Data collected will be handled in accordance with the currently posted Privacy Policy (Specific Provisions).

We will endeavor to amicably resolve any disputes that arise out of or in connection with this Privacy Policy. However, in the case such a dispute can not be resolved amicably, it shall be settled by the court having jurisdiction over the location of SCALITY, Limited’s head office.

3.11. Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookie Policy

4. JAPAN

For the General Provisions and the Specific Provisions for Japan in Japanese, please access this page.

If you are residing in or located in Japan, these Specific Provisions shall govern the collection and processing of your personal information or data, in addition to the foregoing General Provisions.

These Specific Provisions provide you with information about the data protection regulations in Japan in relation to the personal information or data that you agree to provide to SCALITY. These Specific Provisions supplement and complete the General Provisions by reflecting the requirements set out in the Act on the Protection of Personal Information (Act n°57 of 30 May 2003 as may be amended and superseded from time to time – “APPI”) and other related laws, regulations, and guidelines.

You understand and agree that this Privacy Policy (Software and Services) shall be effective and binding between you and SCALITY Japan K.K., the local SCALITY company in Japan and you agree for the collection, processing, transfer to a third party (including international transfer) of your Personal Information (as defined below) and/or your Personal Data (as defined below) by SCALITY Japan K.K. and SCALITY.

4.1. Definitions

In these Specific Provisions, the following terms shall have the following meanings. The terms used with a capital letter and not defined below shall have the meaning ascribed to them in the General Provisions.

Personal Information: information concerning a living individual which can identify a specific individual by name, date of birth, or other description contained in the information (including information which can be easily referenced by a method taken in the ordinary course of business) with other information and thereby identify a specific individual. Personal Information includes information that contains a Personal Identification Code.

Personal Data: Personal Information constituting the Personal Information Database.

Personal Information Business Operator: Business Operator (individual or company) using Personal Information Database for its business.

Sensitive Personal Information: Personal Information comprising an individual’s race, creed, social status, medical history, criminal record, fact of having suffered damage by a crime, or other descriptions etc. prescribed by cabinet order as those of which the handling requires special care so as not to cause unfair discrimination, prejudice or other disadvantages to the individual.

4.2. Contact details

SCALITY Japan K.K. is acting as a Personal Information Business Operator for the collection of your Personal Data during the provision of Software and Services and collects some information that you have agreed to provide us through an exchange of business cards, during a promotional event through specific register forms and marketing and promotional materials such as satisfaction questionnaires in Japan.

SCALITY Japan K.K.’s information is as follows:
SCALITY Japan K.K.
〒100-0004
C/O FINOLAB, 4th Floor, Otemachi Building, 1-6-1 Otemachi, Chiyoda-ku, Tokyo
Representative Director : Jérôme Jules André LECAT

For any questions about these Specific Provisions for Japan or request for information, please contact:
By email: legal@scality.com
By mail: SCALITY Japan K.K.
〒100-0004
C/O FINOLAB, 4th Floor, Otemachi Building, 1-6-1 Otemachi, Chiyoda-ku, Tokyo

4.3. Personal Information Collected

SCALITY Japan K.K. collects the information listed in Section 3.1. of the General Provisions which we consider as Personal Information and Personal Data when the Personal Information is saved in our database under the form of digital data according to the APPI.

SCALITY Japan K.K. does not collect Sensitive Personal Information nor any information or data directly or indirectly that may allow us to identify an individual under the age of 18.

4.4. Joint Use of the Personal Data

SCALITY Japan K.K. and SCALITY’s companies could jointly use your Personal Data for the provision of the Software and Services in accordance with this Privacy Policy (Software and Service). For the list of SCALITY’s companies, please access this page.

SCALITY Japan K.K. jointly uses the Personal Data as listed in Section 3.1. of the General Provisions and for the purpose as provided in Section 4 of the General Provisions.

4.5. Outsourcing of the processing of Personal Data

SCALITY Japan K.K. has business relationships with various Service Providers in Japan and in foreign countries who may need access to Personal Data in the course of supporting our business operations and providing services to SCALITY Japan K.K. We require these businesses to handle Personal Data obtained through the SCALITY Japan K.K. services in accordance with appropriate contractual privacy and security provisions.

4.6. International Transfer

SCALITY Japan K.K. is an affiliate of SCALITY Group and we operate on a global basis. SCALITY Japan K.K. could transfer your Personal Data to another company of SCALITY Group located in foreign country. For the list of SCALITY’s companies, please access this page.

According to the APPI, you will find below the information about the personal data protection regulations of the relevant country:

SCALITY Inc.

Country: United States of America (California States and Washington D.C.)
Information about the applicable Personal Data protection regulations:
https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_america/#federal
https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_america/#fcalifornia

Information on measures taken by Scality Inc. for the protection of Personal Data: please refers to the General Provisions and Specific Provisions for the United States of America.

In addition, Scality Inc. complies with the following 8 principles of OECD Privacy Principles:

• Collection Limitation Principle – We have taken appropriate measures to comply with the principle.
• Data Quality Principle – We have taken appropriate measures to comply with the principle.
• Purpose Specification Principle – We have taken appropriate measures to comply with the principle.
• Use Limitation Principle – We have taken appropriate measures to comply with the principle.
• Security Safeguard Principle – We have taken appropriate measures to comply with the principle.
• Openness Principle – We have taken appropriate measures to comply with the principle.
• Individual Participation Principle – We have taken appropriate measures to comply with the principle.
• Accountability Principle – We have taken appropriate measures to comply with the principle.

SCALITY Limited

Country: United Kingdom
Information about the applicable Personal Data protection regulations:
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/

Information on measures taken by Scality Inc. for the protection of Personal Data: please refers to the General Provisions and Specific Provisions for the United Kingdom.

In addition, Scality Inc. complies with the following 8 principles of OECD Privacy Principles:

• Collection Limitation Principle – We have taken appropriate measures to comply with the principle.
• Data Quality Principle – We have taken appropriate measures to comply with the principle.
• Purpose Specification Principle – We have taken appropriate measures to comply with the principle.
• Use Limitation Principle – We have taken appropriate measures to comply with the principle.
• Security Safeguard Principle – We have taken appropriate measures to comply with the principle.
• Openness Principle – We have taken appropriate measures to comply with the principle.
• Individual Participation Principle – We have taken appropriate measures to comply with the principle.
• Accountability Principle – We have taken appropriate measures to comply with the principle.

SCALITY SA

Country: France
Information about the applicable Personal Data protection regulations:
https://www.ppc.go.jp/enforcement/infoprovision/EU/

Information on measures taken by Scality Inc. for the protection of Personal Data: please refers to the General Provisions and Specific Provisions for European Union.

In addition, Scality SA complies with the following 8 principles of OECD Privacy Principles:

• Collection Limitation Principle – We have taken appropriate measures to comply with the principle.
• Data Quality Principle – We have taken appropriate measures to comply with the principle.
• Purpose Specification Principle – We have taken appropriate measures to comply with the principle.
• Use Limitation Principle – We have taken appropriate measures to comply with the principle.
• Security Safeguard Principle – We have taken appropriate measures to comply with the principle.
• Openness Principle – We have taken appropriate measures to comply with the principle.
• Individual Participation Principle – We have taken appropriate measures to comply with the principle.
• Accountability Principle – We have taken appropriate measures to comply with the principle.

4.7. Your rights

In addition to the rights listed in Section 8 of the General Provisions, according to the APPI you have the following additional rights:

• The right to request the explanation of the refusal to proceed to the disclose of the contents of the collected Personal Data and the purpose of use, to proceed to the requested rectification, to proceed to the requested cease of use.
• The right to request the records of all transfers to third parties (including the international transfer) and the method of transfer of your Personal Data.

To exercise the rights described above, you need to submit your verifiable request to team.web@scality.com in the same conditions as those provided in Section 8 of the General Provisions.

4.8. Change to the Privacy Policy (Specific Provisions)

We will use Personal Data only in the manner described in this Privacy Policy (Specific Provisions). However, and subject to any applicable consent requirements, we reserve the right to change the terms of this Privacy Policy (Specific Provisions) at any time. Any changes to this Privacy Policy (Specific Provisions) will be promptly posted to this page and accompanied by a new effective date in the Section “Update History”. We invite you to review this Privacy Policy (Specific Provisions) regularly for any changes. Any Personal Data collected will be handled in accordance with the currently posted Privacy Policy (Specific Provisions).

We will endeavor to amicably resolve any disputes that arise out of or in connection with this Privacy Policy. However, in the case if such a dispute can not be resolved amicably, it shall be settled by the district court having jurisdiction over the location of SCALITY Japan K.K.’s head office.

UPDATE HISTORY

November 5, 2026

SCALITY WEBSITE PRIVACY & COOKIE POLICY

Last Updated & Effective Date: November 5, 2026

This Website Privacy & Cookie Policy describes how Scality S.A. and its subsidiaries, including Scality, Inc., SCALITY Limited and SCALITY Japan K.K. (“Scality,” “we,” “us,” or “our”), collect, use, process, and protect personal information collected from visitors who browse or interact with our corporate websites (including scality.com and artesca.scality.com), submit web inquiries, or engage with our online marketing communications.

Scality Software & Services Notice: This Policy governs our public website properties only. For the collection, processing, and telemetry of personal data via the deployment and use of Scality storage software (such as RING, ARTESCA and ADI), corporate support portals, or contractual professional services, please consult our dedicated Software and Services Privacy Policy.

This Policy is organized into General Provisions and Region-Specific Provisions (United States, European Union, United Kingdom, and Japan).

PART I – GENERAL PROVISIONS

1. Corporate Identity and Contact Details

Scality operates globally through affiliated operating entities. The primary holding company of the Scality Group and the overarching Data Controller for processing across our website properties is:

SCALITY S.A.
11 Rue Tronchet, 75008 Paris, France
Group CEO: Jérôme Jules André LECAT
DPO: Pierre DEROME
Email: dpo@scality.com or legal@scality.com

For users located in North America, our primary operating affiliate is:

SCALITY, Inc.
465 California Street, 7th Floor, San Francisco, CA 94104, USA
Email: dpo@scality.com or legal@scality.com

2. Information We Collect Through Our Websites

We collect personal information directly when you provide it to us, and automatically through trackers when you navigate our sites:

• Information You Provide Directly:
  • Contact & Identification Data: First and last name, business email address, telephone number, job title, and organization/company name provided via demo requests, whitepaper downloads, contact forms, or newsletter subscriptions.
  • Communications Content: Inquiries, feedback, survey submissions, and event registrations.
• Information Collected Automatically:
  • Technical & Device Identifiers: Internet Protocol (IP) address, browser type and version, operating system, device type, language settings, and referral URLs.
  • Usage & Interaction Data: Pages visited, duration of visit, clickstream pathways, resources viewed, and interaction with online marketing emails (such as open rates and link clicks).
  • Geolocation Data: General geographic location derived from IP address (country, state, or metropolitan area).
• Special Categories and Minors
  Scality does not solicit or knowingly collect sensitive personal data (e.g., health, racial/ethnic origin, political affiliations, biometrics, or criminal history) through its websites. Our websites are intended for business professionals. We do not knowingly collect personal data from individuals under the age of 18.

3. Purposes and Legal Bases for Processing

We process personal data gathered from our websites for the following business purposes (the legal bases applicable in the EU/EEA and the UK are set out in Part III):

1. Website Operation & Security: To ensure proper site functionality, monitor system uptime, safeguard IT systems, and detect or prevent fraudulent, malicious, or abusive activities.
2. Responding to Inquiries & Lead Generation: To respond to demo requests, distribute requested product materials, and assess prospective business needs.
3. Marketing & Communications: To send newsletters, event invites, and promotional materials concerning Scality solutions (users may opt out at any time by clicking “Unsubscribe” in any email or emailing team.web@scality.com).
4. Analytics & Performance Optimization: To analyze site traffic trends, measure the efficacy of digital marketing campaigns, enhance user experience and, subject to your consent where required, deliver and measure targeted advertising (including retargeting) on third-party platforms such as Google and LinkedIn.
5. Legal Compliance & Defense: To comply with regulatory reporting obligations, maintain business records, and establish or defend legal claims.

4. Disclosure and International Transfer of Data

• Affiliates: We share website visitor data across Scality Group subsidiaries solely for administrative, sales, and marketing purposes under standard intra-group contractual safeguards.
• Service Providers / Processors: We engage vetted third-party service providers, contractors, and processors to support website infrastructure, cybersecurity, customer relationship management (CRM), digital communications, and web analytics/advertising (specifically Cloudflare for DNS, CDN, and bot protection; Salesforce and HubSpot for CRM, email delivery, and form management; Google Analytics & Google Ads for statistical traffic evaluation and conversion tracking; and LinkedIn for B2B campaign measurement and retargeting). Our processors are bound by written data processing agreements restricting their processing to performing designated functions on our behalf. Google (Google Ads/DoubleClick) and LinkedIn also process data collected through their advertising cookies and pixels for their own purposes and act as independent controllers (or as joint controllers with Scality for the collection and transmission of that data); their own privacy policies apply to that processing.
• International Transfers: Your data may be transferred to and processed in countries outside your country of residence (including the United States and France). Transfers outside the European Economic Area (EEA) or UK rely on European Commission Adequacy Decisions, UK Data Bridge frameworks, or Standard Contractual Clauses (SCCs) supplemented by appropriate technical and organizational safeguards.

5. Data Retention Schedule

In accordance with statutory minimization principles, we do not retain website data longer than necessary. We enforce the following defined retention criteria:

6. General Data Subject Rights

Subject to your local jurisdiction, you have the right to:

• Request access to and confirmation of the personal data we hold about you.
• Request correction of inaccurate or incomplete personal information.
• Request erasure (deletion) of your personal data.
• Object to or restrict the processing of your data, particularly for direct marketing.
• Request a portable, machine-readable copy of your data.
• Withdraw prior consent at any time without affecting the lawfulness of pre-withdrawal processing.

To exercise these rights, submit a verifiable request to legal@scality.com. We endeavor to acknowledge requests within 10 days and respond within one month for EU/EEA and UK requests (extendable by two further months where necessary), within 45 days for US requests, and without delay for requests under Japanese law.

PART II – COOKIE & TRACKING TECHNOLOGIES POLICY

1. How We Use Cookies and Consent Management

Our websites utilize cookies, pixels, and web beacons. The mechanism for managing your cookie preferences depends on your geographic location:

• European Union, United Kingdom, and International Visitors (Outside the US): In accordance with GDPR and applicable international regulations, non-essential cookies (including Analytics, Functional, and Marketing/Targeting trackers) remain deactivated by default. They will only be deployed after you provide affirmative opt-in consent by category via our Cookie Banner.
• United States Visitors: In the United States, non-essential cookies may be enabled upon page load by default. You may opt out or disable these cookies at any time by category using the “Cookie Settings” button (or “Your Privacy Choices” link) in the website footer, or by enabling a recognized Global Privacy Control (GPC) signal in your browser.

You can update or withdraw your consent at any time via the footer preference controls.

2. Cookie Transparency Table

The following primary trackers operate across our website properties:

3. Managing and Updating Cookie Preferences

Visitors can update cookie consent at any time by clicking the permanent “Cookie Settings” or “Your Privacy Choices” link situated in the website footer. You can also configure your web browser to block or alert you to cookies; disabling certain cookies may impact site functionality.

PART III – REGION-SPECIFIC PROVISIONS

1. UNITED STATES OF AMERICA (California & Other States) (CCPA/CPRA)

These provisions apply to US residents, including consumers under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA).

• Operating Entity: Scality, Inc., 465 California Street, 7th Floor, San Francisco, CA 94104.
• Categories Collected & Disclosed: Identifiers (name, IP address, email), commercial information (demo history), internet activity (browsing metrics), and geolocation (city/state level).
• Sale / Sharing of Personal Information: Scality does not sell personal information for monetary compensation. However, through our deployment of third-party cookies, tracking pixels, and analytics tools (including Google, LinkedIn, and Meta), we share internet browsing activity and device identifiers with these providers to deliver cross-context behavioral advertising and measure marketing campaigns. Under California law (CCPA/CPRA), this activity constitutes “sharing” personal information and may be treated as a “sale”. These advertising and analytics technologies have been active on our websites within the preceding 12 months.
• Global Privacy Control (GPC): In accordance with CCPA regulations, our website detects and honors the GPC browser signal. When a recognized GPC signal is detected, we automatically suppress marketing and targeting trackers for that browser or device and, where we can associate the browser with you, for your profile.
• Your US Privacy Rights:
  • Opt-Out of Sale/Sharing: You have the right to direct us not to sell or share your personal data by clicking the “Your Privacy Choices” link in our website footer or by enabling GPC.
  • Right to Know, Delete, and Correct: You may request details on the categories and specific pieces of data collected, request deletion, and request correction of inaccurate data.
  • Right to Limit the Use of Sensitive Personal Information: We collect only business-contact identifiers and technical browsing metrics necessary to deliver our website services and process your business inquiries. We do not collect or process sensitive personal information (as defined by California law) to infer characteristics about consumers or for purposes other than authorized under CCPA Section 1798.121 and its implementing regulations. Consequently, the statutory right to limit the use of sensitive personal information is not applicable to our website data collection.
  • Non-Discrimination: We will not discriminate against you for exercising statutory privacy rights.

2. EUROPEAN UNION & EUROPEAN ECONOMIC AREA (GDPR)

These provisions supplement the General Provisions for individuals located in the EU/EEA pursuant to Regulation (EU) 2016/679 (GDPR).

• Data Controller: SCALITY S.A., 11 Rue Tronchet, 75008 Paris, France.
• Legal Bases for Processing:
  • Consent (Art. 6(1)(a)): Deployment of non-essential cookies (Analytics, Targeting) and subscription to direct marketing materials.
  • Legitimate Interests (Art. 6(1)(f)): Network security, IT troubleshooting, optimizing web presentation, and conducting B2B lead generation.
  • Pre-contractual Steps (Art. 6(1)(b)): Processing business contact submissions requesting software demonstrations, technical specifications, or commercial quotes.
  • Legal Obligation (Art. 6(1)(c)): Compliance with accounting, tax and regulatory record-keeping obligations and responses to requests from competent authorities.
• Supervisory Authority: You maintain the right to lodge a complaint with your local data protection supervisory authority (e.g., the CNIL in France) if you believe our processing violates GDPR.

3. UNITED KINGDOM (UK GDPR & DPA 2018)

These provisions apply to website visitors located in the United Kingdom.

• UK Entity: SCALITY Limited, Quadrant House, Floor 6, 4 Thomas More Square, London, United Kingdom, E1W 1YW.
• Data Protection Officer: Pierre DEROME (dpo@scality.com or legal@scality.com).
• UK Standards: Processing of UK data subjects complies with the UK GDPR and the Data Protection Act 2018. Non-essential tracking mechanisms require prior consent via our cookie banner. UK visitors may escalate unresolved privacy concerns to the Information Commissioner’s Office (ICO).

4. JAPAN (APPI)

These provisions apply to website visitors located in Japan pursuant to the Act on the Protection of Personal Information (APPI).

• Entity: SCALITY Japan K.K., 〒100-0004 C/O FINOLAB, 4th Floor, Otemachi Building, 1-6-1 Otemachi, Chiyoda-ku, Tokyo. Representative Director: Jérôme LECAT.
• International Transfers & OECD Compliance: Where personal data is transferred among group companies, our foreign affiliates (Scality, Inc. in the US, Scality S.A. in France, and Scality Ltd. in the UK) uphold equivalent standards aligned with the 8 OECD Privacy Principles (Collection Limitation, Data Quality, Purpose Specification, Use Limitation, Security Safeguards, Openness, Individual Participation, and Accountability).

PART IV – AMENDMENTS AND UPDATE HISTORY

We review and update this Website Privacy & Cookie Policy at least annually to reflect changes in our legal obligations, tracking technologies, or operational practices. Any revisions will be published here with an updated effective date.

• November 5, 2026: Comprehensive policy overhaul, delineated website coverage from Software & Service, synchronized corporate headquarters and US addresses, integrated GPC automated opt-out recognition, established category-specific data retention schedules, published an itemized Cookie Schedule, and removed deprecated third-party code references.
• March 12, 2026: Last update of our Scality Software & Services Privacy Policy.