People in our data

Last updated: 13 November 2026.

This page is for people whose name appears in the data Sirenic serves: company officers, sole traders, persons on a sanctions list, and the others named in the table below. We did not obtain this data from you: Article 14 of the GDPR requires us to tell you what we do with it. Our privacy policy is mostly about our clients.

In short

• We read official registers and lists, in France and in Europe. We collect nothing from you and buy no private database.
• We serve this data to our clients, one response at a time, when they query our API about a company or a name. We do not sell files.
• Our data is organised by company. We compute no risk score about a person: our indicators are about companies, and a sole trader is excluded from them. Screening against official lists only says how closely a name resembles that of a listed person.
• You can object at any time, without giving a reason: write to rgpd@sirenic.eu.

Who is responsible

The data controller is the publisher of Sirenic, a sole trader whose registration is in progress; their identity and address will be published in the legal notice as soon as the registration is complete.

For any question about your data: rgpd@sirenic.eu. We have not appointed a data protection officer: this address takes that role.

Who appears in our data, and what we serve about them

What we never serve, apart from deeds filed with INPI, served as published to identified accounts only (last row of the table). For these persons, birth is never served more precisely than the year, neither month nor day. Apart from the establishment address, the SIREN number, the SIRET number and the EU VAT number stated above, no personal address or national identification number is served. We never serve the name of a business under partial diffusion. Each source's licence is in our register dictionary (GET /v1/provenance/registres, free).

Our public procurement responses also name a sole trader who is a subcontractor or outgoing holder of a contract by their Sirene name, which is their own name, unless they have objected with us.

We also read people we never name: we count them, or we set them aside.

Counted, never named:

• natural-person shareholders of French companies, named in the articles of association read for the share capital, from INPI RNE (INPI, France)
• natural-person shareholders of Latvian companies, from Uzņēmumu reģistrs (Latvijas Republikas Uzņēmumu reģistrs, Latvia)
• natural-person partners, founders and shareholders of Estonian companies, from e-Business Register (Registrite ja Infosüsteemide Keskus (RIK), Estonia)
• natural persons with significant control of UK companies, from Companies House (United Kingdom)
• body members, shareholders and other natural persons entered in the Czech public register, from ISVR (Ministerstvo spravedlnosti České republiky, Czechia)
• managers who report their transactions in their company's securities, in Belgium and Germany, from FSMA (Belgium); BaFin (Germany)

Set aside, never served:

• persons named in BODACC notices, from BODACC (DILA, France)
• persons named in commercial court decisions, from Judilibre (Cour de cassation, France)
• persons named in notices of the UK Gazette, from The Gazette (TSO (The Stationery Office) sous l'autorité de HMSO / The National Archives, United Kingdom)
• natural-person debtors of the Czech insolvency register, from ISIR (Ministerstvo spravedlnosti České republiky, Czechia)
• persons named in Swiss Official Gazette of Commerce publications, from FOSC/SHAB (Secrétariat d'État à l'économie (SECO), Berne, Switzerland)
• officers, shareholders, liquidators and curators named in Polish register extracts, from Krajowy Rejestr Sądowy (Ministerstwo Sprawiedliwości, Poland)
• Estonian sole traders, whose business name is their own name, from e-Business Register (Registrite ja Infosüsteemide Keskus (RIK), Estonia)
• Spanish sole traders entered in the BORME, from BORME (Agencia Estatal Boletín Oficial del Estado, Spain)

For French companies, an artificial intelligence model reads the public articles of association to extract the share capital: a natural-person shareholder is counted there, never named, and the extraction that counts them is deleted after 90 days.

Why we process this data, and on what basis

All these purposes rely on legitimate interest (Article 6(1)(f) GDPR).

Information about companies. Knowing who runs a company and who can bind it, checking a client or a supplier, telling apart two companies with similar names. The interests pursued: ours, running a legal information service; our clients', knowing their partners; everyone's, the transparency of business life that the law intended by making these registers public.

Screening against official lists. Telling a client whether a name they search matches a person on an official sanctions list (Liste consolidée du Conseil de sécurité de l'ONU, Liste consolidée des sanctions financières de l'UE (FSF), OFAC SDN (États-Unis), UK Sanctions List (FCDO), Registre national des gels (DG Trésor) and Liste de sanctions suisse (SECO)) or on the AMF blacklists. In a due diligence file on a French company (KYB, single or in batch) and in our reports on it, we also screen, against the sanctions lists, the surname, first names and year of birth of each officer of the company, except its statutory auditors; the intelligence report also compares the company's name with the AMF blacklists, when it is a legal person. The interests pursued: letting our clients comply with sanctions and protect themselves from the frauds the AMF reports.

Monitoring of offices. A client can pay for 30, 90 or 365 days of monitoring of a company, or of a name only: the officer target. Every day, we compare what the registers publish with the day before and alert the client to a change: an officer joins or leaves a monitored company; a person bearing the monitored name takes up or leaves an office; an entry on the AMF blacklists bears the name of a monitored company. For a monitored name, the client receives, for each company concerned, its SIREN number and, in the email and the client area, its name if it is a legal person; nothing else about the person. This is monitoring over time: for the paid period, we keep the list of companies linked to that name to see what changes. A monitored name covers all its namesakes: two people with the same name are not told apart. Everything is deleted 30 days after the end, or at once if the client stops. The interests pursued: letting our clients follow their partners without rereading the registers every day.

Reading articles of association. To state the share capital and corporate shareholders of a French company, an artificial intelligence model reads the latest deed filed with INPI. The people the deed names are neither kept nor served: a natural-person shareholder is only counted.

We make no decision about you based on this data, and we do not use it to market to you.

Prospecting. We also write to companies to offer them our service. We choose companies, never people, and write to an address they publish themselves. From 23 October 2026 to 12 November 2026, a program, built on an artificial intelligence model from Anthropic in the United States, read the company's website to find, preferably, a named person and the business address the site publishes, and wrote to them through Brevo; since then, we only write to a generic address of the company, and each message is sent by hand. We keep, with no time limit set to date, the address we wrote to, the replies received and the working notes of that program: what it read on a company's website or in a reply, including the name of a person the site names, even if we did not write to them. Our basis is legitimate interest (Article 6(1)(f) GDPR): offering a professional, at an address they publish, a service related to their business. To stop receiving anything, reply STOP to one of our messages: we then keep a fingerprint of your address, with no time limit, so as never to write to you again. For your other rights, write to rgpd@sirenic.eu.

Who receives this data

• Our clients: companies and individuals with an account, and software that pays per call without an account, whose identity and country we do not know. They receive the answer to their request and are themselves responsible for what they do with it.
• Our providers: OVHcloud, our host, in France; Brevo, in France and Belgium, for monitoring alert emails, which name neither an officer nor a listed person, only a name a client monitors themselves (some of its sub-processors may access them from outside the Union, under standard contractual clauses); Anthropic, in the United States, for reading articles of association, under standard contractual clauses.

How long

• The last column of the table states, row by row, how long data stays with us. What we read live from a register is not kept the same way everywhere: served from our cache for 24 hours at most, then deleted by our daily maintenance at most 48 hours after it was read; kept in memory for 24 hours for the AMF blacklists, then read again from the source; or read from the source at each request, and never kept.
• Our copies of a register are replaced at each update of the source: what the source removes disappears from our copy at the next update.
• Exception: for the Spanish companies gazette (BORME), we keep the whole history published since 2009, as the gazette itself does.
• Our encrypted backups keep a copy of the database for 30 days. Our working machine, at OVHcloud in France, also keeps a restored copy of it, rebuilt from these backups on day 3 of each month to check that they can be read back and for our analyses: each restoration replaces the previous one, which stays in place if the next one fails.
• A name a client searches is written in our front-end server log; it starts a new file every 20 MB and, at each new file, deletes the closed files older than 7 days and keeps only the 5 most recent.
• The accounting journal of our crypto-asset settlements is kept 10 years (Article L123-22 of the French Commercial Code); it holds the identifier of the company looked up (SIREN or SIRET number, foreign company number, association number or INPI document number), a sole trader's SIREN number included. Older lines hold it in clear; it is replaced by a keyed hash since 31 October 2026 for SIREN and SIRET, and since the version of our privacy policy dated 2 November 2026 for the other numbers. The hash only lets a sale be found from a number already known, and lines already written are never rewritten (accounting record).
• Until 18 October 2026, an unencrypted copy of this journal was also sent every night to a branch of our code's private repository at GitHub, in the United States. This branch was deleted on 27 October 2026; GitHub may keep its files until it erases them, which we asked it to do on 12 November 2026.
• If you object, we keep your request, with no time limit, so that the objection keeps applying.

Your rights

You have the right to access your data, to have it rectified or erased, to restrict its use and to object to its processing (Articles 15 to 18 and 21 GDPR). Write to rgpd@sirenic.eu with your surname, first name and, if possible, the SIREN number of the company concerned. We answer within 30 days at most. Before telling you what we hold, we check your identity.

What an objection does: we stop serving your data in our responses, we stop writing it in our copies at the next update, and our daily processing erases what was already there. What it does not do:

• it does not remove you from an official sanctions list or from the AMF blacklists, which our clients must be able to check;
• it does not erase what a monitoring has already kept: the events that name you stay there until the monitoring is deleted, 30 days after it ends, and an alert already sent to a client is not taken back;
• it does not change the original registers, nor the deeds filed with INPI, which we serve as INPI publishes them.

To act with every reuser at once, also contact the source: INSEE for a sole trader's diffusion status, INPI for the national company register and its deeds. An objection made with us applies to Sirenic only.

If data about you is inaccurate, ask us to rectify it (Article 16 GDPR) at the same address: as we serve data as the registers publish it, we then stop serving yours, by the same step as an objection, until the source has corrected it. Also ask the source for the correction: we pick it up at its next update. You may also lodge a complaint with the CNIL (cnil.fr).

Why this information is public rather than sent to each person

Article 14 allows us not to inform each person individually where that is impossible or would take disproportionate effort, provided the information is made public: that is the purpose of this page. For most of you, we have no way to write to you: the registers we read publish no personal address, or we do not read it, and we will not look for one for this sole purpose. For a sole trader, we hold the establishment address that INSEE publishes. If you write to us, we give you this information in full, with the list of what we hold about you.

Versions

• 13 November 2026: first version