Privacy Policy
Datafalk Inc. · Last updated: 28 October 2026 · Effective date: 12 November 2026
Summary
Parallax 84 SAS and Datafalk Inc. are joint controllers of the personal data processed through datafalk.com and the Datafalk platform: Parallax 84 SAS operates the platform from France, and Datafalk Inc. sells the Services and invoices them. We collect the data needed to operate the Services, to deal with our customers, prospects and candidates, and to produce supply chain intelligence about organisations from public sources. Our data is hosted in the European Union (Germany) and is processed there by Parallax 84 SAS; Datafalk Inc. receives only the data needed for billing, through Stripe, and does not access the operational data of the platform from the United States. Transfers to our providers are covered by the safeguards described in Section 8. We do not sell the personal data of our users, contacts or applicants, and we do not use tracking for advertising. People who appear in our supply chain intelligence because of their role in an organisation, including people who have never dealt with us, have the rights described in Sections 5 and 11.
1. Who we are and where this Policy applies
1.1 The personal data described in this Policy is processed by two joint controllers within the meaning of Article 26 of Regulation (EU) 2016/679 (the "GDPR"): Parallax 84 SAS, a French société par actions simplifiée (RCS Paris 981 036 262), 9 rue des Colonnes, 75002 Paris, France, and Datafalk Inc., a corporation organised under the laws of the State of Delaware, United States of America, file number 10705991, with its address at 1272 S Governors Ave, Ste C, POB 1017, Dover, DE 19904, United States of America (together "Datafalk", "we", "us"), except where Section 2.3 applies.
1.2 Under their joint controllership agreement, Parallax 84 SAS operates the platform from France, hosts the data in the European Union, ensures its security and the support of users, builds and publishes Atlas, informs the persons mentioned in our data and handles reports, keeps the record of processing activities, notifies personal data breaches and answers the requests of data subjects. Datafalk Inc. sells the Services, invoices them and processes refunds, through Stripe, and publishes the contractual documents and this Policy. The operational data of the platform stays in the European Union; Datafalk Inc. receives only the data needed for billing. The essence of that agreement is set out in this Section; its text is available on request. You may exercise your rights against either joint controller. Parallax 84 SAS is also Datafalk's distributor for enterprise customers established in Europe: for the contracts it signs with them, their invoicing and its own prospecting, it acts as a controller under its own privacy notice.
1.3 The single point of contact for any question or request about your data is privacy@datafalk.com, administered by Parallax 84 SAS. Datafalk Inc. has also designated Parallax 84 SAS, at the address above, as its representative in the European Union under Article 27 of the GDPR, which supervisory authorities and data subjects may address in addition to or instead of Datafalk Inc. Datafalk has not appointed a representative in the United Kingdom; requests from persons in the United Kingdom are handled at privacy@datafalk.com.
1.4 This Policy is written to comply with the GDPR, the UK GDPR and the Data Protection Act 2018, the French Data Protection Act and applicable United States privacy laws. It applies to datafalk.com, app.datafalk.com, atlas.datafalk.com, demo.datafalk.com, our APIs and all related Services. It does not apply to third-party websites or services linked from the Services.
2. Whose data we process, and in which role
2.1 Website visitors, people who request a demonstration, a call back or a resource, and recipients of our communications.
2.2 Holders of self-service accounts, including free accounts, and Authorised Users of the platform under a customer's plan.
2.3 Individuals whose data appears in content uploaded by our enterprise customers under a Commercial Agreement (supplier lists, contacts, bills of materials). For that data, Datafalk acts as a processor on behalf of the customer, under the data processing agreement forming part of that Commercial Agreement; the customer is the controller and the point of contact for requests, and we direct requesters to it. The remainder of this Policy does not apply to that data. Self-service accounts do not allow the upload of such content; the parameters of self-service requests are usage data covered by Section 3.
2.4 Business contacts, prospects, partners, suppliers and advisers of Datafalk.
2.5 Job applicants and candidates.
2.6 Individuals who appear in Datafalk's supply chain intelligence data because of their role in an organisation (Section 5).
2.7 People who send us a report, a correction request or a rights request.
3. The personal data we collect
| Category | Data | Source |
|---|---|---|
| Registration and account data | Email address, first and last name, organisation, role where given, hashed password or federated login identifier, account identifier, IP address and timestamp of registration, version of the terms accepted and timestamp of acceptance | You; our identity provider, operated on our own infrastructure |
| Billing data | Billing identity and address, country, VAT number, customer identifier and transaction references assigned by Stripe, type and last four digits of the payment method transmitted by Stripe, order and invoice history (we do not store full card numbers) | You; Stripe |
| Credit register | Operations on credits, with their date, nature, reason and reference | The Services |
| Usage events | Map generation requests (scope entered, date, status and duration), page unlocks, views and exports, technical processing log (number of calls and searches, estimated cost) | The Services |
| Security logs | Connection logs, technical events, IP addresses | The Services |
| Communications | Transactional emails (order confirmations, receipts, map status, renewal and expiry reminders), support exchanges, reports and requests | You; our tools |
| Prospecting data | Professional email address, preferences, campaign events | You; your employer's website; business data providers |
| Recruitment data | CV, cover letter, interview notes, references | You; recruiters; referees |
| Supply chain intelligence data about individuals | See Section 5 | Public sources |
The names of companies, products and materials entered for a map generation designate organisations and are not, in themselves, personal data. The search event associated with your account (who searched what, and when) is usage data about you and is protected as such. Where a scope entered designates a natural person (a sole trader, a named executive), the information about that person is processed in accordance with Section 5.
We do not seek to collect special categories of personal data (such as health, religion or political opinions) or data relating to criminal convictions and offences, and we ask you not to submit them.
4. Why we use personal data, and on which legal basis
| Purpose | Legal basis (GDPR and UK GDPR) |
|---|---|
| Create and manage accounts, authenticate users, keep evidence of the terms accepted | Performance of a contract (Art. 6(1)(b)) where you are yourself the customer; legitimate interest (Art. 6(1)(f)) in providing the Services to the organisation on whose behalf you act, in security and in evidence |
| Perform the Services: generate maps, unlock pages, deliver alerts and briefs, keep credit balances | Performance of a contract; legitimate interest where you act for an organisation |
| Invoice, collect payment, prevent fraud, keep accounting and tax records | Performance of a contract; legal obligation (Art. 6(1)(c)) for invoicing and tax under EU and Member State law; legitimate interest in preventing fraud |
| Secure, monitor and improve the Services, detect and handle incidents and abuse, measure quality and costs from aggregated data | Legitimate interest |
| Respond to requests, provide support and training | Performance of a contract; legitimate interest |
| Inform business contacts about Datafalk's offers, research and events | Legitimate interest in business-to-business prospecting, with a right to object at any time; consent (Art. 6(1)(a)) where the law requires it |
| Recruit | Steps prior to a contract at the candidate's request; legitimate interest; employment law obligations |
| Produce and provide supply chain intelligence about organisations, including the identification of the people who run or represent them | Legitimate interest of Datafalk, of its customers and of the public in sourced economic information on supply chains (Section 5) |
| Comply with legal obligations, respond to lawful requests, establish, exercise or defend legal claims | Legal obligation under EU or Member State law; legitimate interest in complying with other laws applicable to Datafalk and in defending its rights |
| Handle reports, correction requests and rights requests | Legal obligation; legitimate interest |
Where we rely on legitimate interest, we have assessed that our interest is necessary and not overridden by your rights, and we document that assessment. You may object at any time (Section 11).
5. Individuals who appear in our supply chain intelligence data
5.1 What we do. Datafalk maps supplier networks and monitors supply chain risk. To do so, we collect information about organisations from sources accessible to the public and from licensed datasets: company websites and product documentation, corporate registries and filings, customs and trade records, press and specialist publications, regulatory, certification and sanctions lists, and professional networks. Maps and Atlas pages describe companies and their relationships. They may mention natural persons in their professional capacity: directors, legal representatives, signatories or persons quoted by a public source, with their name, role, organisation and the public statements attributed to them, each with its source cited in the map or page.
5.2 Data concerned. Name, role or title, organisation represented, professional contact details where published by the organisation, and public documents or statements made in that role. We do not collect private contact details, home addresses or personal financial data. We exclude special categories of personal data and data relating to the criminal convictions and offences of natural persons from our intelligence products: adverse information about sanctions, corruption, forced labour or similar matters is recorded and displayed at the level of the organisation concerned, and where a public source incidentally contains such information about an identifiable person, it is not extracted into our data about that person. Recording information under an organisation does not remove this restriction where an individual remains directly or indirectly identifiable; incidental material of that kind is restricted, assessed and deleted, and is not reused merely because its source is public.
5.3 Legal basis and balancing. We process this information on the basis of our legitimate interest, and that of our customers and of the public, in producing and disseminating sourced economic information on supply chains, a need recognised by supply chain due diligence legislation, after balancing it against the rights and interests of the persons concerned. We limit the data to public and professional information, we do not profile individuals, we make no decision about them, we cite sources, and we honour objections as described below. On that basis we consider that your interests and fundamental freedoms do not override this interest. We document this assessment for each processing operation concerned.
5.4 How you are informed. We provide the information required by Article 14 GDPR within a reasonable period after obtaining the personal data and no later than one month, or earlier at the first communication with the person concerned where the data is used to communicate with them, or at the first disclosure to another recipient where disclosure is envisaged, publication through the Services counting as such a disclosure. Where we hold a person's contact details, we inform that person directly within those time limits. For the categories of persons of whom we hold only the information published by their sources, without contact details, we have examined and documented, category by category, whether individual information is possible without disproportionate effort; where it is not, we rely on the exception provided by Article 14(5)(b), and this Policy, the warning displayed on each map and page, the systematic reference to sources and the correction form constitute the appropriate measures intended to protect your rights. This assessment is reviewed when our means of information or the categories of persons concerned change.
5.5 How the data is used. It is used to identify organisations and the links between them, to document sources and to display company profiles, including Atlas pages. Maps and pages are produced by automated processing with the assistance of artificial intelligence, under Datafalk's editorial responsibility, and are identified as AI-assisted where the law requires it.
5.6 Retention. Information about a person is kept while it remains relevant to the organisation it describes, and is reviewed against its sources at least every twenty-four months. Information whose source is no longer available and which cannot be confirmed from another source is removed from the active data or archived with restricted access. Where you object, we keep the minimum data needed to ensure that your objection is honoured.
5.7 Your rights. You may ask us which data we hold about you, request its correction, object to its processing or request its deletion, through the "Report an error or request a correction" form on each map and page or at privacy@datafalk.com. We respond within one month. In case of serious doubt, the disputed information is suspended from the public version during our review. We act on objections unless we demonstrate compelling legitimate grounds that override your interests, which we explain in our reply; objections to prospecting are always honoured. Where a rectification, erasure or restriction is required under Articles 16 to 19 GDPR, we apply it to the data and versions under our control, including in our customers' workspaces, we notify it to the recipients of the data in accordance with Article 19 unless an applicable and documented exception applies, and we keep only the copies needed to establish, exercise or defend legal claims, with restricted access.
6. Cookies and similar technologies
The Services use cookies strictly necessary to authentication, to maintaining your session and to remembering your choices, placed by the platform and by its identity provider operated on Datafalk's infrastructure. Online payment is handled by Stripe on its own pages. We place no audience measurement or advertising tracker. Details are in our Cookie Policy.
7. With whom we share personal data
7.1 Between the two joint controllers, as described in Section 1.2, and with the service providers acting on our instructions: Hetzner Online GmbH (Germany), our hosting provider, engaged by Parallax 84 SAS, whose data centres that we use are located in Germany; Stripe, Inc. (United States) and its affiliates, engaged by Datafalk Inc. for payment collection, invoicing and fraud prevention (Stripe acts as a controller for its own regulatory obligations); providers of language models and of research and enrichment tools, established in the United States or in the European Union, engaged by Parallax 84 SAS, which receive the scope of requests and the extracts of public sources necessary to produce maps and pages, without the identity of the user, and which are bound by contract not to reuse that data to train their models; our transactional email system, operated on our own infrastructure; our legal and accounting advisers, bound by professional secrecy. Authentication and security monitoring are performed by software operated by us on the hosting infrastructure described above, without any additional external provider for those functions. The list of our processors, kept up to date, is available on request at privacy@datafalk.com; customers for whom we act as processor are informed of changes as provided in their data processing agreement.
7.2 Our customers, where the data forms part of Datafalk Data (Section 5), under licence terms that prohibit its use to monitor or profile individuals or to make decisions about them.
7.3 Professional advisers, auditors and insurers, under confidentiality obligations.
7.4 Public authorities, courts and regulators, where required by law or to protect our rights, our users or the public.
7.5 A successor or acquirer, in the event of a merger, acquisition, financing or sale of all or part of our business, under confidentiality and subject to this Policy.
7.6 We do not sell the personal data of our users, contacts or applicants, and we do not share personal data with third parties for their advertising. Our supply chain intelligence products contain professional information about individuals drawn from public sources, which we license to our customers as described in Section 5.
8. International transfers
8.1 Account data, deliverables and backups are stored and processed on our servers in Germany, by Parallax 84 SAS. Datafalk Inc., although established in the United States, receives only the data needed for sales, invoicing and refunds, collected and processed by Stripe, and does not access or process the operational data of the platform from the United States; should that change, an appropriate transfer safeguard will be put in place before the change takes effect and this Policy will be updated. Some of our providers (payment, language models, research tools) process data in the United States.
8.2 These transfers are covered, depending on the recipient, by the EU-U.S. Data Privacy Framework and its UK Extension where the recipient is certified, and otherwise by the standard contractual clauses adopted by the European Commission (or the UK International Data Transfer Addendum), together with the technical and organisational measures described in Section 10 and a transfer impact assessment. For each transfer, we verify that the mechanism relied on is applicable to the recipient and to the processing transferred before the transfer takes place. You may obtain information on these safeguards, and a copy of the relevant clauses with proportionate redactions, at privacy@datafalk.com.
9. How long we keep personal data
| Data | Retention |
|---|---|
| Account data (registration, profile, access) | Duration of the account. On closure, access is deactivated and the account data is placed in an intermediate archive with restricted access, separate from day-to-day processing, for at most twelve months, for the sole purposes of preventing the abusive re-allocation of promotional credits and handling claims; it is then deleted, except the archives below |
| Contractual evidence (terms accepted, orders, credit register operations, exchanges relating to a claim) | For the duration of the account as regards rights still in force, then five years from the operation evidenced or, if later, from the closure of the account, in a restricted-access archive; records needed for a dispute are kept until its final resolution |
| Invoices and accounting and tax records | Ten years from the end of the financial year, in a restricted-access archive, or the longer period required by the law applicable to the entity holding them |
| Usage events and technical log | Twelve months in identifying form, then aggregation or anonymisation |
| Security logs | Twelve months; items relating to an incident are kept until its closure and for the applicable limitation period |
| Maps and pages delivered | Duration of the account. After closure, only the copies needed to handle claims are kept, in a restricted-access archive, for at most twelve months; the delivered version and the requested scope needed as evidence follow the regime of contractual evidence; the other copies associated with the account are deleted. Online access and any export period are governed by the Terms of Sale or the Commercial Agreement; the relationships, facts and sources from public sources integrated into the knowledge base are kept there, the data about natural persons it contains being subject to Section 5.6 |
| Closed accounts | Account identifier, email address, organisation, opening and closure dates, promotional credits allocated and pending claims, kept for at most twelve months after closure in a restricted-access archive, for the purposes stated above; this retention does not extend the contractual access to maps and pages, and rights requests are handled under their own regime without waiting for the end of this period |
| Prospecting data | Three years from the last contact |
| Recruitment data | Two years from the end of the recruitment process, unless you agree to a longer period |
| Reports and requests | Duration of their handling and the applicable limitation period |
| Backups | Stored on Datafalk's servers in Germany, encrypted, restricted access, limited duration; data deleted from the active database is erased from backups at the end of that period and is not restored to ordinary use |
10. Security
We apply technical and organisational measures proportionate to the risks: encryption of data in transit and at rest, separation of customer environments, role-based access control and least-privilege access, single sign-on through an identity provider operated on our own infrastructure, endpoint detection and security monitoring on all our servers, security logs normally kept for twelve months, with incident-related retention as described in Section 9, encrypted backups with restricted access stored on our own servers in Germany, confidentiality obligations for our staff and contractors, and data processing agreements with our providers. No system is perfectly secure; we notify personal data breaches to the competent authority and to the persons concerned where the law requires it, and, where we act as processor, we notify the controller without undue delay. Security researchers may report vulnerabilities under our Vulnerability Disclosure Policy.
11. Your rights
11.1 If you are in the European Economic Area, the United Kingdom or another jurisdiction granting such rights, you may: access the personal data we hold about you and obtain a copy; have inaccurate data corrected; have your data deleted; restrict processing; receive data you provided to us in a portable format; object to processing based on legitimate interest, including to prospecting at any time; withdraw consent at any time, without affecting prior processing; and define directions on the fate of your data after your death where national law provides for it.
11.2 Write to privacy@datafalk.com, or by post to the address in Section 1. We may ask you to confirm your identity where we have reasonable doubts, in proportion to the sensitivity of the request. We respond within one month, extendable by two months for complex or numerous requests, in which case we tell you why within the first month. A rights request does not by itself close an account or end a subscription.
11.3 You may lodge a complaint with a supervisory authority, in particular the Commission nationale de l'informatique et des libertés (CNIL, France), the Information Commissioner's Office (ICO, United Kingdom) or the authority of your place of residence. We would appreciate the opportunity to address your concern first.
12. Residents of the United States
12.1 Where a state privacy law applies to you, you may request access to, correction, deletion and a portable copy of your personal information, opt out of the sale or sharing of personal information and of profiling where those practices exist, and you will not be discriminated against for exercising those rights. You may designate an authorised agent to act for you. We honour opt-out preference signals such as Global Privacy Control where the law requires it.
12.2 In the twelve months preceding the date of this Policy, we have collected the categories of personal information listed in Section 3 for the purposes in Section 4, and disclosed them to the categories of recipients in Section 7. We do not sell the personal information of our users, contacts or applicants, we do not share personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes requiring a right to limit under California law. Professional information about individuals contained in our supply chain intelligence products is drawn from sources lawfully available to the general public and is licensed to our customers as described in Section 5.
12.3 Requests may be submitted at privacy@datafalk.com or by telephone at +1 (629) 324-1710. If we decline a request, you may appeal by replying to our decision; we explain the outcome of the appeal and, where applicable, how to contact your state attorney general.
13. Children
The Services are intended for professionals and are not directed to anyone under 18. We do not knowingly collect personal data from children.
14. Automated decision-making
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Datafalk Data describes organisations and is not used by us to evaluate natural persons; our terms prohibit our customers from using it for that purpose.
15. Changes to this Policy
We may update this Policy. Material changes are announced by email to account holders and by notice within the Services at least fifteen days before they take effect. The date of the current version appears above, and previous versions are available on request. An update of this Policy does not by itself create a new legal basis or authorise a new purpose.
16. Contact
Single point of contact for both joint controllers: privacy@datafalk.com. Parallax 84 SAS, 9 rue des Colonnes, 75002 Paris, France, joint controller and representative of Datafalk Inc. in the European Union. Datafalk Inc., Privacy, 1272 S Governors Ave, Ste C, POB 1017, Dover, DE 19904, United States of America, joint controller. Datafalk has not designated a data protection officer; the privacy contact above handles all requests.
17. Language
This Policy is drafted in English and published with translations for the persons concerned. In case of discrepancy, the English version prevails, without prejudice to the information that the law requires to be given in your language.