INTERFAX DUN AND BRADSTREET – PRIVACY POLICY

These terms apply to the use of products and services distributed by Interfax Dun and Bradstreet. For the purposes of this Privacy Policy (“Privacy Policy”) “Interfax Dun and Bradstreet” / “we” / “us” / “our” means INTERFAX DUN AND BRADSTREET LLC. Our office is at build. 1, 2 Pervaya Tverskaya-Yamskaya Ul., Moscow, 127006, Russia. If you are located in the European Economic Area (EEA) or Switzerland we are represented by Interfax Deutschland GmbH with its office at Taunusstrasse 54, D-61440, Oberursel, Germany.

Interfax Dun and Bradstreet is a joint project of the Interfax Group, the leading independent provider of business and financial products in Russia and CIS, and Dun & Bradstreet, the global leader on the market of business information on legal entities. Interfax Dun and Bradstreet is the licensed exclusive supplier of Dun & Bradstreet products and services (hereinafter, the “Services”) in the Armenia, Azerbaijan, Belarus, Georgia, Kazakhstan, Kirghizia, Moldova, Russian Federation, Tajikistan, Turkmenistan, Ukraine and Uzbekistan. Some of the information incorporated into our Services as it is related to the individuals may be classified as “personal data” under General Data Protection Regulation 2016/679 (“GDPR”). We are committed to protecting and respecting your privacy. This Privacy Policy explains the basis on which we collect, process, and disclose personal data. Where we decide the purpose or means for which personal data is processed, we are the data “controller” within the meaning of the. GDPR. We will comply with all applicable data protection laws, including GDPR.

This website (the “Website”) and Services may contain hyperlinks to third party websites. These third party websites operate fully independently from us, and we cannot accept any responsibility or liability for the privacy practices of such third parties nor the availability of these external sites or resources. The appearance of such links on the Website or in any part of our Services is not an endorsement. Should you use any of these third party websites, such use is at your own risk and we would recommend that you review their respective privacy policies.

Who does this Privacy Policy apply to?

This privacy policy applies to individuals i) who use this Website ii) who use the Services and iii) whose personal information forms part of the content included within our Services. Depending on the Services, we may provide additional privacy notices and/or terms of use. This Privacy Policy should be read in conjunction with those privacy notices and terms of use, as applicable to our specific Services.

Questions?

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this Privacy Policy and the data handling of the Interfax Dun and Bradstreet. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact the DPO using the following details: contact person Maxim Kozhevnikov, email: cmd2@dnb.ru

1. How we use your personal data

Website & Customers

Your Enquiries

If you contact us about our Services, the forms you complete or the emails you send may include information about you, such as your name as the contact point for an organisation, your email address, the organisation's address, job title, telephone number and your enquiry.

In line with the legitimate interest we have in promoting and operating our business, we will process your enquiries to reply and provide you with information about the Services. We may also process enquiries to take steps you ask of us with a view to entering into an agreement to provide our Services.

We also hold such information in our CRM system which provides a single view of all our Customers (prospective or current), their contacts, contract details and other business information. The CRM system also contains information on activities and interactions with Customers (which may include emails, summaries of calls, and meetings).

You are under no obligation to provide us with any details, but if you do not provide all relevant information, we may not be able to help.

Information provided by you when using our Services

We will collect information on how you use our Services. This information helps us administer, manage, operate, protect and improve the Services (and provide customer support in connection with the Services). This information may also be used for the purposes of managing any security risks and verifying your identity when logging into and/or using the Service.

We will use information about you for providing and/or making our Services available to you under the terms of use of our Services, as well as contacting you about matters requiring attention.

Mailing List

We may use the email address we collected from you to keep you updated with our news by email unless you would like to be removed from that list (in which case please let us know by clicking unsubscribe at the bottom of each marketing email).

In line with the legitimate interest we have in promoting our business, we will use the email address we collected from you to provide you with this information.

There may also be circumstances where we will ask you for your explicit consent in respect of our use of your data in which case you will be notified at the time.

How you use our Website (Analytics)

On the Website, we use the Analytics Cookies to collect analytical information, such as your internet protocol (IP) address, to help analyse how visitors use the Website.

We process this information to understand how visitors use the Website and to compile statistical reports regarding that activity (for example, your IP address is used to approximate the country from which you access our Website, and we aggregate this information together so we know that visitors to our Website come from a specific territory). This information is not used by us to develop a personal profile of you.

We will not associate any automatically collected data gathered from the Website with any personally identifying information from any source or create personal profiles on you using this information.

You can always choose to enable or disable Cookies in your internet browser. By default, most internet browsers accept Cookies but this can be changed. For further details, please consult the help menu in your internet browser. For further information about cookies, please see: www.allaboutcookies.org, and how to adjust your browser settings here: www.allaboutcookies.org/manage-cookies.

All content you submit to us

If you send us objectionable content or otherwise behave in a disruptive manner when using our Website, we may process personal data included in your messages to respond to and stop such behaviour.

We only process personal data in this way for the legitimate interests of ensuring that use of our Website and the Services are lawful, does not disrupt our systems (and the availability of the Services), does not harass our staff or other individuals, and to enforce our legal rights and to comply with our legal obligations.

Where we reasonably believe you are or may be in breach of the law (for instance, because content you send amounts to harassment or is defamatory), we may use your personal information to inform relevant third parties such as your email/internet provider or law enforcement agencies about the content.

Information held as part of our Services

GRS (Global Reference Solution) – is a global corporate directory that helps carry out an express analysis of marketing environment, search for partners and clients, verify addresses. It covers 300 million companies all over the world. Being available on the Internet, GRS is a convenient and affordable solution for those who need basic information for making a decision “there and then” and for those who need it to cover as many partners as possible.

DBAI (Dun and Bradstreet Access for the Internet) is designed to find the best answers with easy-to-understand analytics and scores powered by the world’s largest commercial database. The systems provides our standard credit (BIR – Business Information Report), compliance (KYC – Know Your Customer) reports on businesses as well as the Dun & Bradstreet country risk researches. The report structure may vary depending on a local legislation and specifics of a business under investigation.

DIT (Data Integration Toolkit) is a system that gives the opportunity to integrate data from D&B global database into inner systems of customer company, providing access to different departments (risks, security, marketing, lawyers, financial experts, accounting).

The information that is contained in the Services is primarily focused on businesses. However, the Services also hold information on directors and shareholders. Such information may include full name, current and previous business position, current and previous share participation in companies, taxpayer identification number, date of birth, address, nationality.

We process this information in line with the legitimate interests pursued by us or by our Customers: to enable businesses to manage their financial risks, protect against fraud, know who they are doing business with, meet compliance and regulatory obligations and better understand organisations, industries and markets.

2. Lawful Basis

We have provided further detail on the lawful reason for processing your personal information below.

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on your privacy (and right to a private life), unless we have your consent or are otherwise required or permitted to by law.

Consent means that we ask for your consent to specific uses of personal information where we need to. We will collect it separately and make it clear that we are asking for consent.

Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.

Public Interest means processing your personal data for the performance of a task in the public interest that is set out in law.

3. Do we share your personal information with anyone else?

We may disclose personal data to the Interfax Group or Dun and Bradstreet and its respective personnel, suppliers or subcontractors insofar as it is reasonably necessary for the purposes set out in this Privacy Policy, provided that they do not make independent use of the information.

We only permit them to process your personal data for specified purposes and in accordance with our instructions. All our third party service providers are required to take appropriate security measures to protect your personal information in line with our policies. Activities which are carried out by third party service providers include: CRM management software, website hosting, and IT support.

We share the information incorporated into the Services (and that may include personal data) with our Customers (businesses and organisations with whom we enter into agreements to access our Services). The use of our Services by the Customers is always subject to our applicable terms of service which relate to the particular Service in question.

In addition, we may disclose your information to the extent that we are required to do so by law (which may include to government bodies and law enforcement agencies); in connection with any legal proceedings or prospective legal proceedings; and to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention).

If we are involved in a merger, acquisition, or sale of all or a portion of our business or assets, the information we hold may be included as part of that sale, in which case you will be notified via email and/or a prominent notice on the Website of any changes in ownership or use of your information, as well as any choices you may have regarding that information.

Except as provided above, we will not provide your information to third parties.

4. Your rights in relation to personal data which we process relating to you

We will honour your rights under applicable data protection laws. These rights are not absolute and they do not always apply in all cases.

Ask for a copy of the data we are processing about you and have inaccuracies corrected

You have the right to request from us i) confirmation of whether we are processing your personal data, and if so ii) a copy of the personal information we hold about you, and iii) correction of any inaccuracies.

We will use reasonable efforts to the extent required by law to supply or correct personal information held about you on our files (and with any third parties to whom it has been disclosed to).

Object to us processing data about you

You can ask us to restrict, stop processing or delete your personal data if:

• you consented to our processing of the personal data and have withdrawn that consent;

• we no longer need to process that personal data for the reason it was collected;

• we are processing that personal data (including profiling) because it is in the public interest or it is in order to pursue a legitimate interest of Interfax or a third party, and you do not agree with that processing and you believe there is no overriding legitimate interest for us to continue processing it;

• the personal data was unlawfully processed;

• you need the personal data to be deleted in order to comply with legal obligations;

• the personal data is processed in relation to the offer of a service to a child.

In some cases you can delete your personal data from your account by following the instructions in your account settings.

Obtain a machine-readable copy of your personal data, which you can use with another service provider

• If (i) we are processing data in order to perform our obligations to you or because you consented and (ii) that processing is carried out by automated means, we will help you to move, copy or transfer your personal data to other IT systems at your request.

Make a complaint to a Supervisory Authority

• If you are unhappy with the way we are processing your personal data, please let us know by contacting us.

• If you do not agree with the way we have processed your data or responded to your concerns, an alternative is to submit a complaint to a Data Protection Supervisory Authority.

5. Children

We do not use the Website or any Service to knowingly solicit data from or market to children under the age of 13. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us. We will delete such information within a reasonable time.

6. Security

We will take all reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information. For example, our databases are password protected and limited to essential employees only. Please be aware that although we endeavour to provide reasonable security for information we process and maintain, no security system can prevent all potential security breaches.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

7. Changes

This Policy may be updated from time to time. We will notify you of any changes by posting the new policy here and, where feasible, letting you know by email.

8. International Data Transfers

In the course of business we may transfer information (which may include personal data) to other entities in our group in based in different countries.

Where we transfer your personal information to entities in our group in countries which have not been deemed to have an adequate level of protection under an adequacy decision of the EU Commission, we have put in place specific contracts containing the EU Commission’s standard contractual clauses (the “Model Clauses”) (or an alternative compliance mechanism, such as binding corporate rules) (“BCRs”) to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects the EU and UK laws on data protection, in particular the GDPR.

If you require further information about these protective measures, please contact email: cmd2@dnb.ru, phone: 8-495-646-21-14.

9. Retention Periods

We will hold your personal information on our systems for as long as is necessary for the relevant purpose, or as otherwise described in this Privacy Policy.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.