As Scaleway place great importance on keeping the internet safe and complying with legislation, it has set up a form allowing you to report illegal content or behaviour hosted on its services by one of its customers.

The aim of this notice for reporting abuse is to assist you with the submission of an abuse report and to indicate how the report will be processed.

What abuse can I report?

You can report different types of content or illegal behaviour using Scaleway services in an abusive manner, as described below:

• Brute force – you notice Scaleway services are being used for attempts to obtain your passwords and/or usernames via the mass testing of different password and username combinations.

• Open Relay – you notice a Scaleway open SMTP server would allow spam campaigns to hide behind a source which does not belong to them.

• Security Hole – you notice a security hole, which has not been corrected, in a Scaleway service which would allow non-authorized persons to connect to your system, in particular to trigger DDOS/BRUTE FORCE attacks or to gather sensitive information.

• Virus – you notice Scaleway services are being used to share a programme which disrupts the functioning of a computer and can rapidly spread between computers connected to a digital network.

• Spam – you are receiving unwanted emails from a Scaleway-owned server.

• Botnet – you notice a network of bots, connected programmes where at least one is hosted by Scaleway, that communicate between each other in order to trigger joint wrongdoing.

• Phishing – you notice a website or email simulating an official campaign is being hosted or sent using Scaleway services in order to gather banking information and/or usernames and passwords.

• Denial-of-service (DoS) – you notice a joint attack from multiple Scaleway servers that neutralizes or attempts to neutralize your service, site or applications.

• Illegal Content – you notice content or behaviour that constitutes an infraction under the fifth, seventh and eighth paragraphs of article 24 of the French Law on the Freedom of the Press dated 29 July 1881 and articles 222-33, 225-4-1, 225-5, 225-6, 227-23 and 227-24 and 421-2-5 of the French Penal Code, is being shared or is occurring via Scaleway services.

We hereby remind you that reporting content or activity as illegal in order to obtain its removal or to stop its distribution, when you know this information to be inaccurate, is punishable by one year’s imprisonment and a fine of 15,000 euros.

You can obtain information concerning the host and/or owner of the IP addresses, servers or websites on which the illegal content or behaviour is hosted, by using an online IP address or domain name search tool, commonly known as the “Who Is” service.

Where can I report abuse?

The abuse of Scaleway services must be reported via:

• the form available here: https://abuse.scaleway.com

or

• by letter to the following address: Scaleway – Equipe T&S – 8 rue de la Ville l’Evêque – 75008 Paris.

If you are a witness or victim of serious incident taking place in France that requires immediate police response (for example, an assault or accident), contact Police Secours.

If your report concerns the following items, you can report them to the French Central Office for the Fight against Crime Linked to Information Technology and Communication (OCLCTIC) via the PHAROS platform:

https://www.internet-signalement.gouv.fr/PortailWeb/planets/Accueil!input.action :

• Pedophilia or corruption of minors on the Internet
• Incitement to racial hatred or incitement to discrimination of persons because of their origin, gender, sexual orientation or disability
• Threats or incitement to violence
• Illicit trafficking (drugs, weapons, etc.)
• Endangerment of persons
• Incitement to commit crimes
• Fraud
• Terrorism (threat or apology)

If you have received spam emails, you can report this to Signal Spam : http://www.signal-spam.fr

What information should be included in my report?

In order to analyse and process your request, Scaleway requires certain information.

Reports which do not contain sufficient information will not be processed.

In order to help you provide the required information, please see the definitions provided below:

• IP address or domain name- corresponds to the IP or IP address (a series of numbers allowing for the unique identification of a computer or internet network) source of your report, or the complete domain name if the report concerns a domain name (alphanumeric name used to identify a computer (web server or email server) on the internet).

• Abuse Date – corresponds to the publication date of the illegal content or the start of the illegal behaviour. This information is essential as the services can be subscribed to and then cancelled within a few hours. The same service can therefore be used by different customers on the same day.

• Time – corresponds to the exact time of publication of the illegal content or the start of the illegal behaviour. This information is essential as the services can be subscribed to and then cancelled within a few hours. The same service can therefore be used by different customers on the same day.

• Your Email – corresponds to your electronic mail address. You are required to provide a valid email address so that you can confirm your report. Providing your email address will also allow you to receive updates about the process of your report.

• Show my Email Address to the customer – by ticking this box, you authorize Scaleway to forward your email address to our customer, this enables him to reply to you directly.

• Abuse Type – corresponds to the type of abuse you wish to report. The types of abuse are explained in detail under the question “What abuse can I report?” above.

• Describe your issue – describe what you have observed in as much detail as possible, provide information such as logs, time zones, headers, the precise location and if applicable, the email addresses to which the content is made accessible. This information will allow our customer to find the source of the reported behaviour or content and rectify it. This description will be directly forwarded to our customer, therefore do not include any confidential or personal information besides to which you don’t want him to have access. Scaleway denies all responsibility for the use which could be made by third parties of any information that you provided in this field.

In accordance with the French Law on confidence in the digital economy (LCEN), the reporting of illegal content also requires the following information to be communicated:

• if you are a natural person – your last name, first name, email address

if you are a legal entity – your corporate form, business name and your email address

if you are an administrative authority – authority name and email address

• the legal grounds on which the disputed content should be removed or made inaccessible

• a copy of the correspondence addressed to the author or publisher of the disputed information or activities requesting their interruption, withdrawal or modification, or the justification that the author or publisher could not be contacted; this condition does not apply to reporting offences mentioned in the third paragraph of 7 I of article 6, I of the French Law on confidence in the digital economy (LCEN) as well as article 24-B and the third and fourth paragraphs of article 33 of the French Law on the Freedom of the Press dated 29 July 1881.

How is my report processed?

Once you have completed the report abuse form available at this address https://abuse.scaleway.com, an email confirming the opening of your report will be sent to the contact address provided in the form.

After you confirm your report, the report is verified by the Trust & Safety team. The team verifies the exactness of the report, that all of the necessary information has been provided for the report to be processed and whether the report indeed relates to explicitly illegal behaviour or content with regard to French regulations and the evidence and information you have provided.

If your report meets the above criteria, it will be validated by the Trust & Safety team and sent to Scaleway’s customer so that the necessary corrective measures can be taken.

You will receive the customer’s answer via the email address provided in the form.

Should Scaleway’s customer not respond, or should the transferred report not be processed correctly, appropriate measures will be taken by Scaleway. These measures may vary from a simple warning to termination of all services of said customer.

If your report is rejected, you will be informed of the reasons why by email.

Please note that massively reporting the same practices or content forces the Trust & Safety team to carry out unnecessary actions which have a negative impact on their work. As such, it is counterproductive to massively report the same practices or content.

We would like to remind you that it is important to remain courteous when communicating with the Trust & Safety team. The team will not process any reports containing offensive, vulgar or threatening language.

How is the personal data I provide in the form used?

Scaleway collects the personal data that you provide in the form for the sole purposes of processing illegal content reports, this includes the receipt of abuse reports via the dedicated form and the processing and monitoring of said reports.

This processing is based on our legal obligations as well as on our legitimate interest in providing a tool for reporting abuse.

Your personal data will be processed by Scaleway for the above-mentioned purposes only. The personal data and all information that you may have provided in the field “Describe your issue” will also be transferred to Scaleway’s customer concerned by the report, along with your email address if you ticked the box relating to this. Upon request, they may also be transferred to persons and authorities whose right of access to personal data is recognized by law, regulations or provisions issued by legally-authorized authorities.

Your personal data is kept for the time period necessary to fulfill the purposes for which it is collected or to comply with Scaleway’s legal obligations and/or to meet the demands of public and governmental authorities.

Scaleway places particular importance on the security of personal data, and implements appropriate technical and organizational measures to protect the personal data it processes. Your personal data is processed electronically and/or manually, in such a way that, in all cases, their security and confidentiality is assured with regard to their sensitive nature, via administrative, technical and physical measures which prevent their loss, theft, use, divulgence or unauthorized modification.

In particular, with regard to your personal data, you may at any time access or rectify it, request its deletion or request its processing be limited for the specific reasons set out in the applicable regulations, or request the portability of your data by sending an email justifying your identity to: privacy@scaleway.com

You also have the right to object at any time, for reasons relating to your particular situation, to the processing of your personal data the legal grounds of which are of legitimate interest to Scaleway, as well as to define directives relating to the fate of your personal data after your death by writing to the above-mentioned e-mail address. In the event of a complaint to which the company Scaleway did not give you a satisfactory answer, you can turn to the French National Commission on Information Technology and Liberties (CNIL) in charge of the respect of personal data obligations.