Legal

Privacy Policy

Last updated: March 18, 2026

01

Data controller

This website is operated by TriggerScale, a trade name (DBA) of BK Consulting, represented by Sara Boukhchat.

BK Consulting (doing business as TriggerScale)

Represented by Sara Boukhchat

41 rue des Apennins, 75017 Paris, France

Email: sara@triggerscale.com

BK Consulting is the data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the French Data Protection Act (Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés, as amended).

02

Scope of this policy

This privacy policy applies to all personal data collected through the website triggerscale.com and any related services, including diagnostic call bookings, contact forms, and email correspondence. It explains what data we collect, why we collect it, how we use it, and what rights you have over your data.

03

Personal data we collect

We collect personal data only when it is necessary for the purposes described below. We follow the GDPR principles of data minimisation and purpose limitation.

Data type Examples Source
Identity data First name, last name, job title, company name Provided by you (booking form, emails)
Contact data Email address, phone number Provided by you
Booking data Appointment date, time, notes Calendly (scheduling platform)
Technical data IP address, browser type, operating system, pages visited Automatically collected via server logs
Usage data How you navigate the site, referring page, session duration Analytics tools (if applicable)

We do not collect any special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation).

04

Purposes and legal basis for processing

Under the GDPR, every processing activity must have a lawful basis. We process your personal data for the following purposes:

Purpose Legal basis (GDPR Art. 6)
Responding to your enquiries and scheduling diagnostic calls Performance of pre-contractual measures at your request (Art. 6(1)(b))
Delivering consulting services under a signed engagement Performance of a contract (Art. 6(1)(b))
Sending follow-up communications related to your enquiry Legitimate interest (Art. 6(1)(f)) — maintaining professional relationships
Improving the website and understanding usage patterns Legitimate interest (Art. 6(1)(f)) — improving our services
Complying with legal and regulatory obligations Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interest, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interest at any time.

05

Data sharing and third parties

We do not sell, rent, or trade your personal data. We may share your data with the following categories of third-party service providers, solely to the extent necessary for the purposes described above:

Service provider Purpose Location
Calendly Scheduling diagnostic calls United States (EU-US Data Privacy Framework)
Hosting provider Website hosting and delivery EU / EEA
Email service provider Professional email communications EU / EEA or adequate safeguards

Where personal data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR, such as EU adequacy decisions, standard contractual clauses (SCCs), or equivalent mechanisms.

06

Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specifically:

Data category Retention period
Enquiry and booking data 24 months from last contact, unless a contract is signed
Client engagement data Duration of the contract + 5 years (legal archiving obligation)
Technical and usage data 13 months maximum
Invoicing and accounting data 10 years (French commercial law obligation)

After these periods, your data is securely deleted or anonymised.

07

Cookies and tracking technologies

This website uses only strictly necessary cookies required for the website to function properly. These cookies do not require your consent under Article 82 of the French Data Protection Act and the CNIL guidelines.

If we introduce analytics or marketing cookies in the future, we will update this policy and implement a consent mechanism in compliance with CNIL recommendations before any such cookies are placed on your device.

Third-party services embedded on this site (such as Calendly) may set their own cookies. We encourage you to review their respective privacy policies for more information.

08

Your rights under the GDPR

Under the GDPR and the French Data Protection Act, you have the following rights regarding your personal data:

Right of access
Obtain confirmation of whether your data is being processed and receive a copy of it (Art. 15).
Right to rectification
Request correction of inaccurate data or completion of incomplete data (Art. 16).
Right to erasure
Request deletion of your data when it is no longer necessary for its original purpose (Art. 17).
Right to restriction
Request limitation of processing in certain circumstances (Art. 18).
Right to data portability
Receive your data in a structured, commonly used, machine-readable format (Art. 20).
Right to object
Object to processing based on legitimate interest or for direct marketing purposes at any time (Art. 21).
Right to withdraw consent
Where processing is based on consent, withdraw it at any time without affecting prior lawfulness (Art. 7(3)).
Post-mortem directives
Under French law, you may define directives regarding the fate of your personal data after death (Art. 85 Loi Informatique et Libertés).

To exercise any of these rights, please contact us at sara@triggerscale.com. We will respond to your request within one month, in accordance with the GDPR. If your request is complex, we may extend this period by two additional months and will inform you accordingly.

09

Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with Article 32 of the GDPR. These measures include encrypted communications (TLS/SSL), access controls, and regular review of our security practices.

While we take all reasonable precautions, no method of transmission over the internet or electronic storage is entirely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.

10

Right to lodge a complaint

If you believe that the processing of your personal data violates your rights under the GDPR, you have the right to lodge a complaint with the French data protection authority:

Commission Nationale de l'Informatique et des Libertés (CNIL)

3 Place de Fontenoy, TSA 80715

75334 Paris Cedex 07, France

Website: www.cnil.fr

11

Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, services, or applicable law. Any significant changes will be indicated by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

12

Contact

For any questions regarding this privacy policy or the processing of your personal data, please contact:

Sara Boukhchat

BK Consulting (doing business as TriggerScale)

41 rue des Apennins, 75017 Paris, France

Email: sara@triggerscale.com