This is what you can do

Your rights are extensive. Our obligations are bigger.

1. Right of access

You have the right to know when your personal data is processed by us. You should be notified when your data is collected or used for the first time. You also have an ongoing right of access which means you can request information about the processing of your data whenever you want to. We will also inform you about the categories of recipients we shared your data with. 

Also, in certain cases, like for example if a data breach (or similar) occurs on our end, you can expect to receive special information from us. 

The information we provide to you is free of charge and in written or electronical format. It is our obligation to explain why we process your data and on what legal basis.

2. Right to rectification

You have the right to ask us to correct all inaccurate information about you. You also have the right to add any missing data that is relevant for us to have. We are responsible for keeping the data correct and up to date. 

3. Right to erasure

You have the right to request that your data are completely removed from our database in the cases listed below:

  • Data is no longer needed for our purpose
  • The consent for processing the data has been withdrawn by you
  • Your data is used in direct marketing and you object to this
  • Your data is used illegally
  • The erasure of data is needed to meet a legal obligation

There are some exceptions to the right to erasure and the right to inform others; when it is important to protect other fundamental rights such as the freedom of speech, to meet a legal obligation, to perform a task within the public interest or in exercise of authority.

4. Right to restriction of processing

You have the right to request that the processing of your personal data is restricted for certain purposes. This means that, going forward, we will no longer use your data for the restricted purposes. 

Right to restriction is valid, for example, when you find records that are incorrect and you have asked us to correct these. In such cases, you have the right to require that we do not process the data while its quality is being verified. 

When the data has been corrected and validated, you will be informed and the restriction can be removed. 

5. Right to data portability

In certain situations, your data has been provided by you directly. For this kind of data, you have the right to extract this data from our databases. At Dun & Bradstreet, we very seldom collect data directly from you.

6. Right to object

You have the right to object to certain types of data processing. If you do so, we will not be allowed to process your data unless it is required for reasons such as legal claim or tasks of public interest. 

You always have the right to know if your personal data is used for direct marketing. Objection to this can be made at any time. 

7. Automated decision-making, including profiling

You have the right to request not to be a part of automated decision making, including profiling. It is important to know that although Dun & Bradstreet delivers solutions for automated decision making, it is our customers and users of the solutions (and not Dun & Bradstreet) that will make the actual decisions. 

For example, an automated decision can be made to decline an online application for credit or a job application without any personal contact.

Automated decision making can be allowed if it is necessary for fulfilling an agreement between yourself and a company (our customers).

Automated decisions can be made with or without profiling. Profiling can be used without it leading to an automated decision. Profiling refers to every form of automated processing of personal data for the purpose of providing information about personal characteristics. The aim is to analyze or predict a person's work performance, reliability, behaviour, city of residence or movements.

8. Complaints

If you think that we are processing your data without the right to do so, you have the right to file a complaint to your national Data Protection Authority (DPA).

The DPA will receive your complaint and investigate what should be done in the next step. If a supervision is initiated, you will be notified within three months. In case you do not receive a notification within this time, you can turn to the court in order to require an answer.

In accordance with GDPR, your request will be processed within 30 days of us receiving the necessary information. If your request is complex, this period can be extended by a maximum of two months, but we will inform you beforehand.