Dun & Bradstreet Privacy Notice

Dun & Bradstreet Privacy Notice

Dun & Bradstreet is the world’s leading source of business information and insight. Since 1841, Dun & Bradstreet has collected information about businesses to deliver products and services that assist our customers in making critical commercial decisions. Our global business database contains more than 330 million business records. Some of the information in the business records may be classified as personal information under various laws such as information relating to an individual (e.g. a sole trader, a partnership, a company director, a beneficial owner, a trustee, a professional contact.)

This privacy notice explains how we collect, share and protect business information.

Updated September 1, 2020

Back to Top

Applicability - Legal Entities and Websites

This Privacy Notice applies to the following Dun & Bradstreet legal entities: Dun & Bradstreet, Inc., Dun & Bradstreet NetProspex, Inc. ("NPX"), Avention, Inc., Hoovers Inc., Dun & Bradstreet Emerging Businesses ("DBEB"), Dun & Bradstreet Government Solutions, Inc., Mad Objectives, Receivables Intelligence, and Orb Intelligence. This Privacy Notice also applies to Lattice Engines, a subsidiary of Dun & Bradstreet whose mission is to create an AI platform that enables companies to engage their buyers with 1-to-1 omni-channel experiences and make B2B marketing as personalized as B2C marketing. These entities and lines of business will be referred to collectively as “Dun & Bradstreet” in this Privacy Notice.

This policy covers the following Dun & Bradstreet websites: dnb.com, DandB.com, accesstocapital.com, products.dandb.com, dandbeducation.com, companyupdate.com, EdAhead.org, education.dandb.com, CreditSignal.com, businesscredit.dnb.com, cart.dnb.com, yourhoovers.com,, https://www.coaction.com/, and https://www.lattice-engines.com/.

These sites may provide links to other U.S. Dun & Bradstreet websites, non-U.S. Dun & Bradstreet websites and non-Dun & Bradstreet websites that may have different privacy notices. We encourage you to carefully read the online privacy notices of these other websites to ensure that you understand their practices and the relevant distinctions.

This Privacy Notice does not apply to Dun & Bradstreet companies based in the European Union or the United Kingdom, or when any Dun & Bradstreet company processes data relating to residents of the European Union under the General Data Protection Regulation (“GDPR”). In such cases please see the EU and UK Privacy Notice. See our section regarding data transfers and Privacy Shield for more information on transfers of data under the GDPR. Our EU and UK Privacy Notice also covers transfers of data relating to residents of the European Union and United Kingdom to the United States pursuant to Dun & Bradstreet’s Privacy Shield certification.

This Privacy Notice does not apply to Market Data Retrieval (MDR), a part of Dun and Bradstreet Inc., and a provider of marketing information and services for the K-12, higher education, library, early childhood, and related education market. View MDR’s online Privacy Notice.

This Privacy Notice does not apply to Dun & Bradstreet legal entities based in the People’s Republic of China, and their collection and sale of such information. In such cases, please see the China Privacy Notice.

If you are a resident of California, please see the section entitled “California Residents” of this Privacy Notice for an overview of your California rights, including your right to make a “Do Not Sell My Personal Information” request.

Back to Top

What Information We Collect

Products and Services

Personal Information Collected through D&B Email IQ

The D&B Email IQ application helps users have more informed conversations, save time, and better prepare for meetings with seamless access to business intelligence from the Dun & Bradstreet Data Cloud, accessible through the user's email. The application uses innovative technology powered by machine learning and natural language processing to scan the prospects and customers you are interacting with to provide company firmographics, recommendations on additional contacts, and suggestions for similar companies to pursue.

When a user opts in to the installation of D&B Email IQ, the application will access limited data from the emails and calendar invites the user sends and receives in their email environment.  The data collected will be limited to email addresses found in the “To” and “From” fields of the emails, as well as the business card information contained in an email signature.  The signature of an email may include data elements such as name, job title and department, company name, email address, telephone number, fax number, company address, corporate URL, and social networking URL.  Data collected via the application may be incorporated into the Dun & Bradstreet Data Cloud and be used to enhance and improve our products by enabling businesses to manage their financial risks, protect against fraud and dishonesty, know who they are doing business with, meet their compliance and regulatory obligations and better understand organizations, industries and markets. Where permitted under applicable law, this information may also be used for sales and marketing purposes.  Based on the country of origin of the data subject, we have implemented safeguards to address additional legal obligations so that we are in compliance with applicable laws.  In certain instances, the data collected will be used purely for internal compliance with applicable laws, unless further notice or consent requirements have been fulfilled.

Anyone whose data was collected via the D&B Email IQ application may opt out of the use of their data by calling Dun & Bradstreet at 1-800-234-3867 or emailing custservprivacy@dnb.com

For more information on D&B Email IQ, please visit our D&B Email IQ FAQs page.

Our Purpose for Collecting Information

D&B collects personal information so that we can supply commercial data about organizations to other organizations. Our purpose is to enable businesses to manage their financial risks, protect against fraud and dishonesty, know who they are doing business with, meet their compliance and regulatory obligations and better understand organizations, industries and markets.

We also collect personal information so that we can license and sell professional business contact information for marketing and data management purposes.

Lattice Engines’ purpose for collecting personal information is to continually improve our AI platform and enable companies to engage their buyers with 1-to-1 omni-channel experience and make B2B marketing as personalized as B2C marketing.

How Do We Use and Share Information?

Dun & Bradstreet

Dun & Bradstreet uses the information that we collect to operate our websites, offer customers a variety of business information products and services for use in making business credit, risk management, supplier, and marketing decisions, and to carry out transactions that you request or authorize. Dun & Bradstreet also licenses professional business contact information to authorized resellers and third party businesses for marketing and data management purposes.

We may use your professional business contact information to match it with other public and private sources in order to create anonymous segments of information (this is non-personally identifying information, such as demographic, behavioral and technical information, extracted from the underlying Data) for use by Dun & Bradstreet and/or third parties to target advertising messages to you on third party sites and services. Such segments do not reveal or contain your personal information. You may opt-out from certain targeting advertising by following the instructions in the section below entitled "What are your choices regarding Cookies".

Dun & Bradstreet shares information with third party service providers, such as credit card processors, auditors, attorneys, consultants, live help/chat providers and contractors, in order to support Dun & Bradstreet's Internet websites and business operations. Dun & Bradstreet contractually requires that these recipients only use the information for the intended purpose of the disclosure and that they destroy or return the information when it is no longer needed. We may also disclose the information as required or appropriate in order to protect our website, business operations or legal rights, or in connection with a sale or merger involving Dun & Bradstreet assets or businesses.

From time to time, Dun & Bradstreet compiles online and offline transaction and registration information for internal analyses, such as market research, quality assurance, customer experience, and operational benchmarking initiatives. D&B may use IP address information collected from customers for analytical purposes and in some of our products and services.

When necessary or appropriate, we may disclose information in response to a court order, subpoena, law enforcement proceeding, regulatory inquiry or when otherwise legally required. Also, be advised that Dun & Bradstreet sometimes receives requests (e.g., court order, subpoena, law enforcement proceeding,) for personal information from public authorities to meet national security or law enforcement requirements. In responding those requests D&B's response will be limited (a) to the extent necessary to meet national security, public interest, or law enforcement requirements or (b) by statute, government regulation or case law that creates conflicting obligations or explicit authorizations.

Back to Top

D&B Hoovers

D&B Hoovers maintains a separate professional contacts directory in which your company and individual business contact information may be listed. Hoover's licenses business and professional contact information to authorized resellers and third party businesses for marketing purposes. Aggregated website visitor data may be used to determine usage patterns or interests of visitors to the website and users of our products, or for purposes related to technical support or security of the website, products and computer systems. Usage information, such as number of reports, types of reports and functions accessed by a particular UserID, may be tracked within the products. We do this to monitor authorized usage of the products, respond to questions from the user, for market research, and to improve the design and functionality of the products. We may also aggregate corporate or industry information accessed by all of our customers. We do this in order to appreciate the types of companies and industries for which our customers require information, which in turn improves the quality of the products. We do not correlate the accessed corporate or industry information to a specific user or to a particular organization.

Back to Top

Lattice Engines

We may share your business contact information with third parties who provide services on our behalf to help with our business activities. These companies are authorized to use your business relevant information only as necessary to provide these services to us. 
For example, some services include the following or similar services: 

• Fulfilling orders and delivering packages
• Payment processing
• Providing customer service
• Sending marketing communications
• Web applications, firewalls and other security measures

Cloudflare may have access to application traffic of Lattice Engines public websites and service offerings.  This permits Cloudflare to provide Lattice Engines with the services of a web application firewall, providing protection against malicious use and distributed denial of service attacks.

We use Sure Shot and typically, Sure Shot does not have access to the authorized contents of our customer’s business contacts in their licensed use of either the Marketo or Eloqua marketing platforms, although there may be exceptions from time to time.

Collection of Sensitive Personally Identifiable Information

Dun & Bradstreet may collect sensitive personally identifiable information ("SPI") associated with certain customers or customers' clients, such as individuals' Social Security Numbers and dates of birth, in order to provide certain product and service offerings.  We will only collect this SPI if it is necessary to fulfill certain product orders and only when voluntarily provided by the customer.  We will only use it for the limited, permissible purpose for which it is collected and we will take commercially reasonable steps to adequately secure the information. We may also share this SPI with trusted third parties for the limited, permissible purpose of fulfilling the associated product orders. Additionally, sometimes data subjects will send us sensitive personally identifiable information without our asking. When we become aware of this, we will delete the sensitive personally identifiable information. 

Back to Top

Cookies, Web Beacons, Pixel Tags, and GIFs

What are Cookies, Web Beacons, Pixel Tags and GIFs and how are they used?

Cookie Uses

Types of Cookies

You Have Choices

Dun & Bradstreet respects your privacy preferences and offers the following ways through which you may control how we contact you and disclose your information.

Dun & Bradstreet Telemarketing, Texting or Calling

Dun & Bradstreet Direct Mail Marketing

Third Party Marketing

Access, Correction, and Deletion

To help ensure data quality and accuracy, Dun & Bradstreet provides businesses organizations and business professionals with access to their business information within the D&B databases and with an opportunity to review such information, correct verified inaccuracies, or delete any personal information within such business information if required by law. Authorized business representatives may request a complimentary copy of their company's business report.

To obtain a copy of your company’s business report or your information or, to correct or update your information:

Dun & Bradstreet Customer Service at 1-800-234-3867 or send an email to custservprivacy@dnb.com

Hoovers/Avention: Customer Support at 1-800-486-8666 or by sending an e-mail to customersupport@hoovers.com

When a business owner or principal contacts Dun & Bradstreet about a potential data error, we promptly investigate the issue, confirm the information in question, correct verified inaccuracies or delete any personal information within such business information if required by law, and respond to the original inquiry. In such a case, we may apply a "stop distribution" order regarding the relevant business report, as well as ancillary products that may be affected by the verified inaccuracy, until the matter is properly resolved. When the investigation is complete, we will also send a correction or deletion notice to businesses or others whom we know to have received the inaccurate data, as appropriate. However, some third parties and third party sites may continue to display inaccurate Data until their databases and display of data are refreshed in accordance with their update schedules.

Data Security

Dun & Bradstreet maintains commercially reasonable security measures to protect personal information against unauthorized access and disclosure and that are consistent with our business operations and generally accepted industry standards. These measures include the implementation of technical, physical and administrative security safeguards. Dun & Bradstreet requires employees to complete privacy and security training.  Dun & Bradstreet also implements a third party service provider due diligence program to ensure that our vendors likewise employ adequate data collection, processing, transfer, management and security measures in carrying out their services on our behalf.

We do not necessarily control how you send us your personal information. Therefore, we cannot always ensure or warrant the security of any information that you transmit to us. You agree that you provide this information and engage in such transmissions at your own risk. Once we receive information from you, we will endeavor to maintain its security on our systems. Dun & Bradstreet has established policies and procedures for securely managing information and protecting Data against unauthorized access and we continually assess our data privacy, information management and data security practices. We do this in the following ways:

• Establishing policies and procedures for securely managing information and as may be further addressed in our contractual relationship with a customer;
• Limiting employee access to sensitive information;
• Protecting against unauthorized access to customer data by using data encryption, authentication and virus detection technology, as required;
• Requiring service providers with whom we do business to comply with relevant data privacy legal and regulatory requirements;
• Monitoring our websites through recognized online privacy and security organizations;
• Conducting background checks on employees and providing Data Privacy training to our team members;
• Continually assessing our data privacy, information management and data security practices.

Data Retention

Dun & Bradstreet will retain your information for as long as your account is active or as needed to provide you services. If you wish to cancel your account or request that we no longer use your information to provide you services, contact Dun & Bradstreet Customer Service at 1-800-234-3867 or custservprivacy@dnb.com. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Children

Dun & Bradstreet websites, products and services are for business purposes only. They are not targeted, intended or expected to be of use to children. User provided contributions of content or contact information regarding or about children are expressly prohibited. We do not knowingly collect information on minors under 16 years of age.  If we become aware that information we collected may be associated with a minor under 16 years of age, we will delete that information.

Changes to Data Privacy Practices

If we make material changes to our data privacy practices, this policy will be updated and posted on our website in order to keep you informed of how we collect, use, manage, disclose, and protect information. The policy effective date will be updated accordingly.

Your Use of Our Website Is Consent

By using our website, you hereby consent to our collection, use, management, retention, and disclosure of your information as described in this policy.

Sale of Assets

In the event that Dun & Bradstreet is purchased or sells parts or all of the business, the information collected will be considered an asset that can be transferred.

Transfers of Personal Information from the EU/EEA, the United Kingdom, and Switzerland to the US 

Please note that, despite the Court of Justice of the European Union’s invalidation of the EU-US Privacy Shield Framework as a mechanism for transfers of personal data between the EU and the U.S. Dun & Bradstreet is currently maintaining our self-certification under the EU-US Privacy Shield Framework and remains committed to protect personal information in accordance with the Privacy Shield Principles which offer meaningful privacy protections for EU individuals. While we will continue our participation in the Privacy Shield Framework, we will at this time only rely on Standard Contractual Clauses to cover the transfer of personal information from the EU to other jurisdictions.

For more information on the U.S. Department of Commerce’s continued administration of the Privacy Shield program, please visit the Privacy Shield website.

Dun & Bradstreet and its legal entities participate in and have certified compliance with the EU-U.S. Privacy Shield Framework and the Swiss U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom, and/or Switzerland (as applicable) to the United States, respectively, in reliance on Privacy Shield. Dun & Bradstreet is committed to subjecting personal information received from European Union (EU) member countries, the United Kingdom, and Switzerland, in reliance on the Privacy Shield Framework, to the Framework’s applicable Principles.  To learn more about the Privacy Shield Framework, visit the U.S. Department of Commerce Privacy Shield website.

Dun & Bradstreet is responsible for the processing of personal information it receives, under the Privacy Shield Framework, and subsequently transfers to a third party acting as an agent on its behalf. Dun & Bradstreet complies with the Privacy Shield Principles for all onward transfers of personal information from the EU, the United Kingdom, and Switzerland, including the onward transfer liability provisions.

In certain situations, Dun & Bradstreet may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at the TRUSTe Feedback and Resolution System.

Under certain conditions, more fully described on the Privacy Shield website, you may invoke binding arbitration when other dispute resolution procedures have been exhausted.

 To learn more about the Privacy Shield program, and to view our certification, please visit the Privacy Shielf website.

Dun & Bradstreet is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

Back to Top

General Data Protection Regulation (GDPR)

We recognize that some of the information we collect may be classified as “personal data” under European Union (EU) law as it is information relating to an individual (e.g. a sole trader, a partnership, a company director, a beneficial owner, a trustee, a professional contact etc) residing in the European Union. For additional information in relation to the processing of personal data under EU law, and specifically the General Data Protection Regulation 2016/679, please visit our EU and UK Privacy Notice.

Other Data Transfer Mechanisms

Dun & Bradstreet also complies with other various jurisdictional cross border transfer requirements by using data transfer agreements or other approved mechanisms for global transfers of personal information.

Dispute Resolution

This dispute resolution program covers both offline Data collection (e.g. personal information collected through our call centers or via postal mail) and online Data collection (e.g. personal information collected via the Internet). If you are a citizen of the EU and you have any complaints regarding our compliance with relevant aspects of the Data transfer laws and regulations surrounding Data transfers from the EU you should contact us at: EUDPO@dnb.com.

If you are not a citizen of the EU and you have a question or concern regarding Dun & Bradstreet's data privacy practices, please contact the Chief Privacy Officer at privacyofficer@dnb.com or call the Customer Service center at 1-800-234-3867 or send an email to custservprivacy@dnb.com. We will do our best to resolve any complaints or issues as quickly as possible.

If we cannot resolve your complaints, you may have rights to independent dispute resolution or arbitration under certain circumstances as described below in the sections titled “Independent Dispute Resolution” and “Arbitration.”

Privacy Shield Independent Dispute Resolution

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, you may invoke binding arbitration under certain circumstances. Please contact our U.S.-based third party dispute resolution provider (free of charge) at the TRUSTe Feedback and Resolution System, and the section below titled “Arbitration.”

Arbitration

In accordance with the Privacy Shield, individuals may invoke binding arbitration as a final recourse for claims that a Privacy Shield organization has violated its obligations under the Principles and the claim is not fully resolved by other Privacy Shield recourse mechanisms. The arbitration will be implemented in accordance with the rules established under the Privacy Shield.

California Residents

Starting January 1, 2020, under the California Consumer Privacy Act (the CCPA) residents of the state of California have the following rights: 

You have the “Right to Know” or the “Right to Access Information About Collection, Disclosure and Sale of your Personal Information” over the past 12 months. Refer to the additional details below.  Fill out the form to complete your Right to Information about Collection, Disclosure and Sale of your Personal Information request. The information you provide will only be used to fulfill your CCPA request.

You have the Right to Deletion of information you have shared with us, subject to certain exceptions. Refer to the additional details on these exceptions below. Fill out the form to complete your Right to Deletion request. The information you provide will only be used to fulfill your CCPA request.

You have the Right to Opt Out of the Sale of Your Personal Information, unless such personal information was collected from a government source.

• Visit the Communication Preferences to opt out of marketing.
• Fill out the form to complete your Right to Opt Out of the Sale of Your Personal Information request. The information you provide will only be used to fulfill your CCPA request.
• If you have opted out of the sale of your personal information but would like to Opt Back in, please fill out the CCPA Opt-In form. The information you provide will only be used to fulfill your CCPA request.
  

You also have a Right Not to be Discriminated Against for exercising your CCPA rights. You do not need to request this right, this a is a right we will always give you in regard to any CCPA rights request. 

If you would like to exercise your CCPA rights over the phone, please call us at 1-855-549-8900 and clearly state that you are a resident of the state of California and wish to exercise your CCPA rights. We will ask for additional information to verify your identity.

An authorized agent may make a CCPA request on your behalf.  The authorized agent will need to provide the information necessary to confirm your identity, as well as written and signed permission to act on your behalf.  An “authorized agent” must also be a natural person or business registered with the Secretary of State in California.

We reserve the right to use a third party to verify your identity and this third party may require additional information for verification purposes. The data you provide will only be used to fulfill your CCPA request. 

Please see below for the categories of personal information about California consumers that we have collected, sold and disclosed for a business purpose over the past 12 months.

Please see below for additional information on how we collect, sell and disclose personal information on California Residents.

Please see below for the categories of personal information about California consumers that Lattice Engines has collected, sold and disclosed for a business purpose over the past 12 months.

Please see below for additional information on how Lattice Engines collects, sells and discloses personal information on California Residents:

California Civil Code Section 1798.83 also known as the “Shine the Light” law permits customers who are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please see the Access and Correction section above for contact information.

Contact

For more information regarding this Privacy Notice, you can contact:

Privacy Officer
Dun & Bradstreet, Inc.
103 JFK Parkway
Short Hills, NJ 07078
privacyofficer@dnb.com

If you are an EU citizen and have questions regarding your personal information or about Dun & Bradstreet's EU Privacy Policy, you can contact: 

EU Data Protection Officer at EUDPO@dnb.com

Effective Date:

Effective Date of this Privacy Notice: September 1, 2020

This update to the Privacy Notice incorporates updates to address the Court of Justice of the European Union’s invalidation of the EU-US Privacy Shield Framework and the D&B for Outlook plug-in.

This Privacy Notice was previously updated July 1, 2020.