Privacy Policy

The Big Whale (hereinafter "The Big Whale") attaches particular importance to the protection of the personal data of users of its websites, newsletters, events and services (hereinafter the "User"). This privacy policy (hereinafter the "Policy") sets out the conditions under which The Big Whale collects and processes the User's personal data, in accordance with the General Data Protection Regulation ("GDPR") and the French Data Protection Act No. 78-17 of 6 January 1978, as amended.

Article 1 — Data Controller

The data controller is:

The Big Whale, a simplified joint-stock company (SAS) with share capital of €43,250, having its registered office at 9 Rue des Colonnes, 75002 Paris, registered with the Paris Trade and Companies Register under number 911 651 859.

Any question relating to the processing of data may be sent to: [email protected]

Article 2 — Data Collected

The Big Whale collects only the data strictly necessary for the purposes set out in Article 3. Depending on the nature of the relationship with the User, the data likely to be collected is as follows:

• Website visitors: browsing and audience-measurement data (pages viewed, traffic source, aggregated technical data via cookies — see §7)
• Newsletter subscribers: email address, and where applicable name, first name, organisation
• Individuals booking a meeting: name, email, booked slot, information provided when booking
• Event attendees: name, email, organisation, job title, registration details
• Clients (subscriptions, services): identity, professional contact details, organisation, billing data

No sensitive data within the meaning of Article 9 GDPR (health, opinions, origin, etc.) is collected. The Big Whale carries out no profiling and no automated decision-making producing legal effects with respect to the User.

Data is collected directly from the User, on the occasion of a subscription, registration for an event, booking of a meeting, subscription to a service or contact. The Big Whale does not build any files from third-party sources.

The User is responsible for the accuracy of the data they provide and may request its rectification at any time under the conditions set out in Article 6.

Article 3 — Purposes, Legal Bases and Retention Periods

• Sending our newsletters and editorial communications — Legal basis: consent (Art. 6.1.a) — Retention: until consent is withdrawn, then 3 years from last contact
• Managing meeting bookings — Legal basis: legitimate interest / pre-contractual measures (Art. 6.1.b and 6.1.f) — Retention: 3 years from last contact
• Organising and managing events — Legal basis: service performance / consent (Art. 6.1.b and 6.1.a) — Retention: duration of the event, then 3 years for relationship purposes
• Managing the client relationship and performing subscriptions/services — Legal basis: performance of the contract (Art. 6.1.b) — Retention: duration of the contractual relationship
• Invoicing and accounting obligations — Legal basis: legal obligation (Art. 6.1.c) — Retention: 10 years (Art. L123-22 of the French Commercial Code)
• B2B commercial prospecting — Legal basis: legitimate interest (Art. 6.1.f) — Retention: 3 years from last contact
• Audience measurement and website improvement — Legal basis: consent (Art. 6.1.a, via the cookie banner) — Retention: max. 13 months for cookies; 25 months for aggregated data
• Responding to your requests (contact, support) — Legal basis: legitimate interest (Art. 6.1.f) — Retention: duration of the request handling, then 1 year

Article 4 — Recipients of the Data

The data is processed solely by authorised staff of The Big Whale. The Big Whale uses processors acting on its documented instructions, under data processing agreements compliant with Article 28 GDPR:

• Gandi SAS (63-65 bd Masséna, 75013 Paris) — Purpose: hosting — Location: France (EU) — Transfer mechanism: —
• Brevo (Sendinblue SAS) — Purpose: sending newsletters and emails — Location: European Union — Transfer mechanism: —
• Google LLC (Google Analytics 4, Search Console) — Purpose: website audience measurement — Location: United States — Transfer mechanism: EU–U.S. Data Privacy Framework
• Calendly, Inc. — Purpose: meeting bookings — Location: United States — Transfer mechanism: EU–U.S. Data Privacy Framework + Standard Contractual Clauses
• Luma (http://luma.com) — Purpose: event registrations — Location: United States — Transfer mechanism: EU Standard Contractual Clauses (Decision 2021/914)

The Big Whale does not sell or rent the User's personal data to third parties.

Article 5 — Transfers Outside the European Union

Certain processors process data within the territory of the United States. These transfers are covered by appropriate safeguards within the meaning of Articles 44 et seq. GDPR:

• Google and Calendly adhere to the EU–U.S. Data Privacy Framework, which is the subject of an adequacy decision of the European Commission; Calendly additionally relies, on a subsidiary basis, on the Standard Contractual Clauses;
• Luma frames its transfers through the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914).

As the Data Privacy Framework is an adequacy decision liable to regulatory or judicial change, The Big Whale periodically reviews its validity and updates this Policy where appropriate.

Article 6 — Rights of the User

In accordance with Articles 15 to 22 GDPR, the User has the following rights:

• right of access to the data concerning them;
• right to rectification of inaccurate or incomplete data;
• right to erasure of their data;
• right to restriction of processing;
• right to object, in particular to commercial prospecting;
• right to data portability;
• right to withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand;
• right to set directives regarding the fate of their data after their death.

These rights may be exercised by request sent to [email protected]. The Big Whale responds within one month. Proof of identity may be required in the event of reasonable doubt as to the identity of the requester.

The User may unsubscribe from the newsletters at any time using the unsubscribe link included in each communication.

A User who considers that their rights are not respected has the right to lodge a complaint with the CNIL (the French Data Protection Authority — www.cnil.fr).

Article 7 — Cookies

On their first visit, the User is presented with a banner allowing them to accept, refuse or configure non-essential cookies.

• Strictly necessary cookies: essential to the operation of the site, placed without obtaining consent;
• Audience-measurement cookies (Google Analytics 4): placed subject to the User's prior consent.

The User may change their choices at any time through the cookie management module available on the site. The retention period for cookies does not exceed thirteen (13) months, in accordance with CNIL recommendations.

Article 8 — Security

The Big Whale implements appropriate technical and organisational measures to protect the data against any unauthorised access, alteration, disclosure or destruction. Exchanges on its sites are encrypted by means of the SSL/TLS protocol.

As no information system can be deemed infallible, The Big Whale is bound by a best-efforts obligation and cannot guarantee absolute security; it undertakes to maintain a level of protection appropriate to the risks and to the state of the art. In the event of a data breach likely to result in a risk to the rights and freedoms of the User, The Big Whale carries out the notifications provided for in Articles 33 and 34 GDPR.

Article 9 — Third-Party Links and Services

The websites and communications of The Big Whale may contain links to third-party sites or services (social networks, partners, external sites), governed by their own privacy policies over which The Big Whale exercises no control. This Policy does not apply to the processing carried out by such third parties, which it is for the User to consult before any transmission of data.

Article 10 — Governing Law and Competent Jurisdiction

This Policy is governed by French law. Any dispute relating to its interpretation or performance shall, failing an amicable resolution, be subject to the exclusive jurisdiction of the courts of Paris, subject to the mandatory provisions protecting consumers and to the rights the User derives from the GDPR, including the right to refer the matter to the supervisory authority of their place of residence.

Article 11 — Minors

The services of The Big Whale are intended for a professional, adult audience. The Big Whale does not collect data concerning minors.

Article 12 — Amendment of the Policy

The Big Whale reserves the right to amend this Policy to reflect changes in its processing activities or in applicable regulation. Any material change will be brought to the User's attention. The applicable version is the one accessible online at the time of consultation.

Article 13 — Contact

For any question relating to this Policy or to the processing of their data, the User may contact: [email protected] — The Big Whale, 9 Rue des Colonnes, 75002 Paris.