Privacy notice – Business information and private investigations

Version 1.0 – October 2026. This is a translation: in case of any discrepancy, the Italian version prevails.

1. Introduction

Credit Report S.r.l. holds a licence pursuant to Article 134 of Royal Decree 773/1931 (TULPS), issued by the Prefettura (Prefecture) of La Spezia, for private investigations and business information. This notice, provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), concerns the personal data processed in two services carried out on behalf of third parties ("Clients"):

• Business information: searching, collecting, recording, organising, analysing, assessing, processing and communicating information from public sources, from publicly and generally accessible sources or provided by the data subject, to enable the Client to assess the economic and commercial reliability of a person or entity. The service complies with the Code of Conduct for the processing of personal data in the field of business information, approved by the Italian Data Protection Authority (Garante) with decision no. 127 of 12 June 2019.

• Private investigations: investigative activities carried out on the written instructions of individuals, companies, organisations or lawyers, in particular to establish facts and gather evidence for establishing or defending a legal claim, including before proceedings are started. These activities comply with the Ethical Rules for the processing of personal data carried out for defence investigations or for establishing or defending a legal claim (Garante, decision no. 512 of 19 December 2018). Credit Report does not carry out investigations in criminal proceedings, which require the specific authorisation provided for by Article 222 of the implementing provisions of the Italian Code of Criminal Procedure.

This notice is also published on the website because, in most cases, the data is not collected from the data subject: for the reasons given in section 9, informing each person individually would be impossible, would involve a disproportionate effort or would undermine the purposes of the assignment (Article 14(5)(b) GDPR).

2. Data controller and DPO

3. Who this notice is for

Privacy law only protects natural persons. Our services often concern businesses, companies and organisations: their data is not personal data, but the data of the natural persons connected to them (sole traders, shareholders, directors, contact persons) is. This notice is addressed to them.

• Natural persons, including sole traders and professionals, about whom a Client requests a business information service.

• Natural persons legally or economically linked to a business, company or organisation about which the service is requested: shareholders with significant holdings and persons with actual powers of management, direction or control, according to the criteria of the Code of Conduct.

• Natural persons involved in a private investigation: the person being investigated and, to the extent strictly necessary, other persons appearing in the facts established (for example witnesses, counterparties, connected persons).

• Clients and their contact persons, for the data needed to manage the assignment.

4. What data we process and where it comes from

Business information

• Identification and contact data, data on offices held and shareholdings in businesses and companies.

• Data on assets and on economic, financial and credit matters: financial statements, protested bills, insolvency proceedings, prejudicial acts and mortgage and land registry records (mortgages, attachments, registered payment orders), real estate and vehicle ownership.

• Data on criminal convictions and offences only if taken from public sources, within the limits of the Code of Conduct.

• Assessments and opinions on reliability, also expressed as classes or scores (rating), assigned by an analyst or taken from third-party databases (see section 5).

• We do not process special categories of data (ethnic origin, political opinions, religious beliefs, health, sex life, genetic or biometric data).

Sources: data provided by the Client; public sources (business register, electronic register of protested bills, land and property registers at the Revenue Agency, Public Vehicle Register, registry of the resident population, documents that anyone may access by law); publicly and generally accessible sources (press, directories, websites); other business information providers; data provided directly by the data subject.

Private investigations

• Identification data, data on residence, domicile and whereabouts.

• Data on employment, assets and economic resources, and on conduct and facts relevant to the assignment.

• Images and notes gathered during observation in public places or places open to the public, documented in the assignment report.

• Data on criminal convictions and offences, only if strictly necessary for the assignment and within the limits of the law.

• We do not process special categories of data (ethnic origin, political opinions, religious beliefs, health, sex life, genetic or biometric data).

Sources: data provided by the Client or their lawyer; public and publicly accessible sources; direct observation and on-site checks; information gathered from third parties in compliance with the law. No prohibited activities are carried out, such as interception or unauthorised access to computer systems and databases.

5. Why we process the data and on what legal basis

We do not ask for the data subject's consent: processing is based on the conditions shown in the table.

The data is processed for the purposes of the assignment received. If the same Client has also entrusted Credit Report with collecting its debt (Article 115 TULPS licence), the data needed for that service, for example a traced address, is also used for collection, as stated in the debt collection privacy notice.

Rating. The reliability assessment may be expressed as a class or score (rating). The rating is assigned by one of our analysts or comes from third-party business information databases, which calculate it with their own methods described in their privacy notices; Credit Report does not use its own automated scoring systems. A rating from a third party is examined by one of our analysts before it is delivered to the Client. The rating is not a decision: whether to grant credit or start a relationship with the data subject is decided by the Client. Until delivery to the Client, the data subject may ask which data was used for the assessment and contest it; after delivery, the request must be addressed to the Client, which is the only party holding the data.

6. How we process the data and who has access to it

• Data is processed with paper and electronic tools, with security measures appropriate to the risk, and only to the extent necessary for the assignment (data minimisation).

• Each investigation is carried out on written instructions, which state the right to be established or defended and the subject of the investigation.

• Only authorised and trained Credit Report staff, and the collaborators entered in the staff list required by the licence, have access to the data.

• Suppliers providing services on our behalf (IT systems management, business information databases, correspondent agencies) are appointed as processors under Article 28 GDPR and only access the data needed for their task.

• Credit Report does not keep its own business information database: data is collected for each individual assignment.

7. Who the data may be shared with

The data is not disclosed to the public. It may only be shared:

• with the Client who requested the service and, for investigations, with their lawyer;

• with the judicial authorities, in the proceedings for which the assignment was carried out;

• with the authorities and with anyone entitled to receive it by law, within the limits provided;

• with correspondent business information and investigation agencies, in Italy or in the European Union, only when the assignment requires it.

The data is transferred outside the European Union in one case only: when the Client is based in a non-EU country, to deliver the result of the assignment. The transfer takes place to countries covered by an adequacy decision of the European Commission, with the safeguards provided by Articles 46 et seq. GDPR or, where applicable, because it is necessary for establishing, exercising or defending a legal claim (Article 49(1)(e) GDPR).

8. How long we keep the data

When these periods expire, the data is deleted or anonymised.

9. Rights of the data subject

The data subject may request access to their data and the correction of inaccurate or incomplete data.

The GDPR also provides for the right to request erasure and restriction of processing and to object to processing (Articles 17, 18 and 21). Because of the nature of our services, these rights do not normally apply: the data is processed so that the Client can protect its claim or establish, exercise and defend a legal claim, and in these cases the law excludes erasure and objection (Article 17(3)(e) and Article 21(1) GDPR). In addition, Credit Report deletes the data when the assignment is delivered: from that moment the data is held only by the Client, who processes it as an independent controller and to whom any requests must be addressed.

Requests must be made in writing, by email or PEC, to the contact details in section 2, enclosing an identity document. We do not act on requests made by telephone or where the identity of the requester cannot be verified.

Limits in private investigations. When data is processed to establish or defend a legal claim, the exercise of these rights may be delayed, restricted or excluded, with a reasoned communication, if it would cause actual and concrete prejudice to those purposes, and for as long as strictly necessary (Article 2-undecies(1)(e) and (3) of the Italian Privacy Code). In these cases the data subject may also exercise their rights through the Italian Data Protection Authority (Article 160 of the Italian Privacy Code).

When the notice is given in person. If we collect data directly from the data subject, for example in an interview, we give the notice at the time of collection, also orally and in summary form, stating who we are, on whose behalf we act and that answering is optional (Article 13 GDPR and Article 11 of the Ethical Rules). If the data comes from third parties or public sources, the notice is not sent to the person: in investigations it would defeat their purpose, in business information it would require a disproportionate effort. In these cases this notice, permanently published on the website, applies (Article 14(5)(b) GDPR).

The data subject always has the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

10. Legal references

• Regulation (EU) 2016/679 (GDPR), in particular Articles 4, 6, 10, 13, 14 and 15–22.

• Legislative Decree 196/2003 (Italian Privacy Code), Articles 2-octies, 2-undecies and 160.

• Royal Decree 773/1931 (TULPS), Articles 134 and 135.

• Code of Conduct for the processing of personal data in the field of business information, approved by the Italian Data Protection Authority with decision no. 127 of 12 June 2019 (text on the Garante's website).

• Ethical Rules for the processing of personal data carried out for defence investigations or for establishing or defending a legal claim, Garante, decision no. 512 of 19 December 2018 (web doc. no. 9069653).