Notice to Individuals
This page is for you if a business has used NACRE Intel to research you, or if you think one might have. You do not need an account to read it or to contact us, and you will not be charged for anything described here.
What NACRE Intel is
NACRE Intel is a tool that businesses use to research a named person before doing business with them — most often before an investment, a partnership, a contract or an onboarding check. When a business asks it about someone, it searches publicly accessible web pages, reads the ones it judges relevant, checks public sanctions and company registers, and assembles what it found into a report with links back to each source.
It only reads material that is already publicly available. It does not access private accounts, and it does not have data that is not on the open web or in a public register.
Who decided to research you
We did not choose to research you. A customer of ours did. Under data protection law that customer is the controller: they decided that you should be researched and why, and they are responsible for having a lawful reason. We are their processor — we run the search they asked for.
This matters for your rights: many of them are exercised against that business rather than against us. If you do not know who it was, contact us anyway and we will explain below what we can do.
Why you were not told directly
The law normally requires that you be told when an organisation obtains data about you from somewhere other than you. There is an exception where doing so would take disproportionate effort, and it applies here: we hold only what is on public pages, we frequently have no contact details for the person concerned, and writing to people to tell them they have been researched would itself be intrusive and would reveal that a business was looking at them.
The law requires that where we rely on that exception, we make the information public instead. That is what this page is.
What may be held about you
- Your name, and job title, employer and location where publicly reported.
- A photograph, only where one is openly licensed or on a public professional profile.
- Publicly listed professional contact details, social handles and web domains associated with you.
- Facts drawn from public pages about your career, education, companies, public statements and press coverage — each with a link to the page it came from.
- Whether your name appears on public sanctions, politically-exposed-person or company registers, and any adverse press coverage found.
- People and organisations publicly connected to you, and a timeline of dated public events.
- An automatically generated risk indication, based on the above.
The report is generated by a computer system and can be wrong. It may include material about a different person with the same name — the system tries hard to separate people who share a name, and records when it is unsure, but it is not infallible.
How long it is kept
A report is deleted automatically 12 months after it is produced, along with any stored images and page snapshots. The customer can delete it sooner, and may be obliged to.
What you can ask for
You have the right to ask:
- whether data about you is held, and to receive a copy of it;
- for anything inaccurate to be corrected;
- for it to be deleted;
- for its use to be restricted, or to object to it altogether;
- that your name be excluded from the service, so that future attempts to research you are refused.
Write to privacy@nacre.edda.cloud. Tell us your name and enough detail to find the right records, and say what you want. We reply within 30 days.
Because our customer is the controller, we will normally pass your request to them and support them in answering it, and we will tell you that we have done so. Where the request is one we can act on ourselves — deleting what we hold, or excluding your name from future searches — we will act on it directly.
We will ask you to establish that you are who you say you are before we disclose anything. That is to protect you: an unverified request is a way of extracting information about someone else.
Excluding your name
We maintain a list of names the service refuses to research. If you ask to be added to it, an attempt to run an investigation on you will be declined, whoever makes it. Tell us at privacy@nacre.edda.cloud if you want this, including any spellings and variants of your name.
If you are not satisfied
You can complain to a data protection supervisory authority in the country where you live or work. In France that is the CNIL. You can do that without contacting us first, though we would rather have the chance to put something right.
Who we are
Nacre, SAS, RCS Paris 941 938 839, SIRET 941 938 839 00011, 50 avenue des Champs-Élysées, 75008 Paris, France.