Privacy policy
Independent service, not affiliated with or endorsed by Dun & Bradstreet. You can get this number for free on your own.
This is a courtesy translation. The French version is the only one that binds the parties, and French law governs the contract. Where the two differ, the French text prevails. Read the French version.
Who processes your data
Hakili Labs LLC, a Delaware limited liability company with its registered office at 131 Continental Dr, Suite 305, Newark, DE 19713, USA, is the controller for the processing described below. For any question, or to exercise your rights: contact@firmpassport.com.
Data collected to fulfil your order
Company name, country, national company identifier, its registration date if you give it, and delivery email address. The email address is the only personal data in this set, the others concerning a legal person. For the creation of a number, offered in the following countries: Botswana, Eswatini, Kenya, Namibia, and South Africa, we also collect the company's telephone number, its postal address where it differs from its physical address, its website, the name and job title of a contact person if you give them, then, after payment, the registration certificate you upload and any documents you provide in reply to a request for further information. The contact person's name is personal data, as are the telephone number or address where they reach an individual. Legal basis: performance of the contract you enter into by ordering.
Website and documents attached to the order
You may, without being required to, give the company's website and attach up to three registration documents (register extract, articles of association, certificate), as PDF, JPEG or PNG. To check that the website exists, our server calls it once, without reading its content or keeping anything other than the address you entered. The documents are stored in our database as soon as you choose them, before payment, so that they accompany your order: they are used only to find or create the company's number. A document attached to a request that is not paid is erased automatically within 48 hours.
Creation of the number: your personal space and submission to the partner
For a creation, payment opens a personal space, which you reach through a secret link sent to you by email. Our database keeps only a fingerprint of it, from which the link cannot be rebuilt. The link also travels with the payment session at Stripe, which brings you back to your space once you have paid. That page is not indexed by search engines, and no audience measurement takes place on it. The certificate, the proof of address, the questionnaire and the documents you upload there are recorded in our database, accessible only to the operators, each through a personal account, and to you through your link. The Dun & Bradstreet questionnaire may contain personal data of directors, shareholders and signatories (name, position, nationality, share of capital): only enter what you are entitled to disclose. Once the request has been reviewed, the company's details, the contact person, your email address and these documents are sent by email to the local Dun & Bradstreet partner of the company's country (Botswana, Eswatini, Kenya, Namibia, and South Africa): TransUnion (Botswana, Eswatini, Kenya, Namibia, South Africa). That partner is their recipient and processes them to assign the number. That country lies outside the European Union: this transfer is necessary for the performance of the contract you have entered into. A copy of that email is kept in our mailbox. The partner may contact you to verify the request.
Recording and processing your order
Every paid order is recorded in our order-processing database, with the information entered and the payment reference. Only the operators handling the search have access to it, each through a personal account. They are alerted to each new order by a message on our private Discord channel, which contains only the order number, the country and the amount: no data concerning you appears there. We write to you at the delivery address: one email confirms your order, a second brings you the result or announces your refund. For a creation, further emails remind you to upload the certificate, announce the submission of your request and bring you the number. If your company has no number, that second email offers you the choice between a refund and our support, through a personal link. When you reply, we record your choice, its date, the version of the text you accepted and the IP address from which you replied: this is the proof of your choice, in particular of your waiver of the refund if you choose support. It is kept and deleted with the order file. The choice, its date and that address are also recorded on the payment, with our payment provider, to answer any card dispute.
Payment data
No bank card data passes through or is stored on our servers. Payment is processed by Stripe Payments Europe, Ltd., which acts as a separate controller for that data. From Stripe we receive only the confirmation of settlement and the transaction reference.
Audience measurement and session replay
With your prior agreement, and only with it, we measure the site's audience using Umami, which we host ourselves: no data is passed to a third party. This measurement includes session replay, which records your clicks, scrolling and typing in order to understand where the ordering journey fails. Input fields and the areas showing your company details are masked from the recording. You may refuse, and change your mind at any time through the "Audience measurement" link in the footer. The service is the same if you refuse.
Country and language remembered
With that same agreement, and only with it, we remember the country and language of the last country page you visited, so that on your return the home page opens in that language and on that country. They are stored in your browser, in a cookie named "duns_pays" that holds nothing else, for six months at most. Switching language with the selector in the navigation bar updates it. Refusing, or withdrawing your agreement through the "Audience measurement" link in the footer, deletes it.
Advertising origin of your visit
When you reach the site from an advertisement, the page address carries parameters that identify the campaign: the Google click identifier (gclid) and utm parameters (source, medium, campaign, ad group, keyword). If you order during that visit, these parameters are carried over to the address of the review page, sent with your order and recorded in the order file. They serve only to count orders, refunds and sales per campaign. No cookie or browser storage is used for this, and nothing is sent back to Google. They are kept and deleted with the order file.
What we do not do
We build no database of third-party D-U-N-S® numbers, no index and no cache. Your data is neither sold, nor rented, nor passed on for advertising purposes. No profiling or automated decision-making is applied to your request.
Retention periods
The D-U-N-S number searched for or created is erased from our servers as soon as the result is sent. The content of the registration certificate, of the proof of address, of the questionnaire, of the documents uploaded for a creation and of the documents attached to an order is erased when the file is closed; their name, type, size and upload date remain in the file. The order file is kept for 90 days after closure, long enough to handle any complaint, then deleted automatically. Accounting records are kept for 10 years, as article L123-22 of the French Commercial Code requires. Session recordings are kept for the period configured in our measurement instance, and for no more than 90 days.
Processors and hosting
The site is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Chypre. Payment is processed by Stripe. The emails sent to you go out through the sending server of our business mailbox, as do the creation requests sent to the local Dun & Bradstreet partner, which is not our processor but a separate recipient. The messages that flag paid orders pass through Discord, whose servers are located in the United States; they contain no personal data. Our audience measurement tool is hosted on our own infrastructure.
Your rights
You have rights of access, rectification, erasure, restriction and objection over your data, as well as the right to withdraw your consent to audience measurement at any time. Write to contact@firmpassport.com: we reply within one month. You may also lodge a complaint with the French data protection authority, Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, 75007 Paris.