Gloria Vogelweid

Maltem Group — Sole External Legal Lead (Commercial, Compliance & Data Protection) for 7 years

Reporting directly to Top Management. Solo legal function across the group, with contributions on HR and corporate topics. Scope: parent company + multiple subsidiaries, mixed onshore/nearshore/offshore IT services group.

Data Protection / GDPR

Built and ran the full GDPR framework across all subsidiaries: ROPA, data mapping, internal policies (retention, breach response), intra-group DTAs. Legal basis analysis, LIAs, consent logging, privacy notices (web / app / HR), DSAR procedures. Art. 28 DPAs with clients and subprocessors, vendor due diligence, subprocessor oversight. International transfers France → Madagascar / Mauritius (SCCs, contractual safeguards). DPIAs on high-risk processing, risk register. Client due diligence questionnaires on privacy & security posture.

Tech & IT Contracts

IT services agreements (T&M and fixed-price), framework subcontracting and back-to-back clauses, SOWs, change requests, acceptance and warranty regimes. Customer-side SaaS & IT procurement: liability caps and exclusions, IP indemnification, DPAs, SLAs, audit rights, reversibility and termination assistance, cyber and PI insurance. Vendor-side SaaS: drafted B2B GTC and EULA for a monitoring software product (SaaS + on-prem), tailoring licensing, liability and data-flow clauses to each model. NDAs, IP clauses on software deliverables, SaaS reseller agreements (liability alignment, reseller exposure mitigation).

AI Compliance

Drafted AI training data clauses in SaaS B2B GTC. Reviewed AI systems in the product roadmap (infrastructure anomaly detection) for AI Act classification and GDPR exposure and concluded minimal-risk, with proportionate transparency built into existing contracts.

External legal counsel to the group since its market entry into France and its on going operations today, coordinating internal teams and external specialists to ensure compliance with applicable French regulations. Recurring advisory on B2B supplier relationships, commercial activities and consumer-facing regulatory compliance.

- Commercial & Supplier Relations: Annual framework agreement negotiations under the French Commercial Code and EGAlim regulatory framework (Loi EGAlim 1 & 2), including formal "Conventions Uniques" with regulated food suppliers and tailored commercial agreements with suppliers outside the EGAlim scope (occasional suppliers).

- Product labelling compliance for food and non-food goods under Regulation (EU) 1169/2011, Regulation (EU) 1223/2009 and applicable French rules.

- Pricing display and promotional practices under the Omnibus Directive (Directive (EU) 2019/2161) and the French Consumer Code.

- Drafted responses to formal information requests and inspection letters from French consumer protection and food safety authorities (DGCCRF, DDPP, DGAL).

Built an end-to-end GDPR compliance programs for Fintech, Banking and Markeplaces clients:

- Article 30 register and data mapping.

- Privacy Impact Assessments (PIAs) and Legitimate Interest Assessments (LIAs).

- Cross-functional GDPR training across departments.

- Third-party contract review and redrafting (Article 28 alignment).

- Responded to information requests from the AEPD (Spanish data protection authority)

- Drafted privacy notices and managed DSARs end-to-end.