Hosting and network
GDPR Scaleway
In an indie stack, Scaleway is used for European cloud (compute, storage, databases). Entity cited: Scaleway, S.A.S.. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Scaleway
Yes. Public PDF, also linked from the contracts page.
Stated role
The customer acts as controller or processor, Scaleway as processor or sub-processor. Processing that Scaleway carries out as controller is covered by its privacy policy.
Personal data
The DPA covers any category of data uploaded in connection with a service subscribed through the Scaleway account. More detailed list: not disclosed.
Sub-processors of Scaleway
The Trust Center announces a Subprocessors document. The names were not in the public text retrieved on the day of the check.
Transfers outside the EU
Hosting / location
The DPA (version of 1 June 2024) states that the services are located in the European Union by default. When several regions or zones are offered, the customer chooses the location when ordering.
EU–United States Data Privacy Framework
Official search for “Scaleway” and “Scaleway SAS” on the Data Privacy Framework list: no participant. Not registered.
Cookies
not disclosed
Typical use, written by StackLégal and not by the vendor: European cloud (compute, storage, databases).
History
Last update: October 4, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Scaleway a processor within the meaning of the GDPR?
The customer acts as controller or processor, Scaleway as processor or sub-processor. Processing that Scaleway carries out as controller is covered by its privacy policy.
What DPA does Scaleway publish?
Yes. Public PDF, also linked from the contracts page. https://www-uploads.scaleway.com/DPA_2024_ENG_b0abb5cc26.pdf
Which further sub-processors does Scaleway publish?
The Trust Center announces a Subprocessors document. The names were not in the public text retrieved on the day of the check. https://security.scaleway.com/
Where does Scaleway state that it processes data, including outside the EU?
The DPA (version of 1 June 2024) states that the services are located in the European Union by default. When several regions or zones are offered, the customer chooses the location when ordering.
Is Scaleway registered under the EU–United States Data Privacy Framework?
Official search for “Scaleway” and “Scaleway SAS” on the Data Privacy Framework list: no participant. Not registered.
Which personal data does Scaleway mention?
The DPA covers any category of data uploaded in connection with a service subscribed through the Scaleway account. More detailed list: not disclosed.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.