Skip to content

Information on the Processing of Personal Data and Guidance on Data Subject’s Rights within the CRIBIS Application

CRIF – Slovak Credit Bureau, s.r.o., with its registered office at Mlynské Nivy 14, 821 09 Bratislava, Company Registration Number: 35 886 013 (hereinafter referred to as ‘CRIF SK’), is the operator of the Cribis Universal Register information system, available to users via the secure web portal www3 .cribis.sk; this information system comprises data on business entities, drawn both from publicly available information on legal and natural persons – business entities – and from information relating to certain aspects of the fulfilment of commercial contractual obligations provided by contributors – business entities – on a contractual basis (hereinafter referred to as ‘Cribis UR’). The contact details of the data protection officer appointed by the controller are: address: Mlynské Nivy 14, 821 09 Bratislava, email: dpo.sk@crif.com.

The personal data processed in the Cribis UR information system is provided by users of the Cribis UR information system with whom CRIF SK has concluded the relevant contracts for the use of Cribis UR, CRIF S.p.A.,  with its registered office at via della Beverara 21, 401 31 Bologna, Italy, and CRIF – Czech Credit Bureau a.s., company registration number 262 12 242, with its registered office at Štětkova 1638/18, Nusle, 140 00 Prague 4, registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, File No. 6853,  and their contractual partners.

The categories of personal data processed in the Cribis UR information system include, in particular, data such as first name, surname, permanent address, company registration number, telephone number, email address and place of business (in the case of self-employed persons), date of birth, and information on payment history; this data is provided primarily in connection with the basic report on a business entity, as well as in connection with information on insolvencies and restructurings, links between persons with shared ownership or personnel ties, information published in the Commercial Gazette and the Central Register of Enforcement Proceedings, in connection with rights to immovable property, liens and information on general meetings of commercial companies, for the purposes set out below.

The legitimate interests pursued by users of the Cribis UR information system as third parties within the meaning of the Regulation, and at the same time the purposes of the processing of personal data in the Cribis UR information system, are:

  • the protection and exercise of rights, legally protected interests and other legitimate interests of business entities and other organisations when entering into contractual relationships with third parties, during the performance of such relationships, and after their termination,
  • assessing, managing and optimising the business and reputational risks of business entities and other organisations,
  • optimising users’ decision-making processes and processes relating to financial management and cash flow management,
  • optimising the debt recovery process, assessing the risk of non-payment, and assessing the risk of default on credit or insurance products,
  • verifying and monitoring solvency, the status of assets, receivables and liabilities (including tax and social security obligations), the solvency and payment discipline of business partners of commercial and other entities, including potential business partners, as well as persons with financial or personnel links, for the purposes set out in points 1 to 4,
  • the vetting of persons and assets in connection with the fulfilment of statutory obligations relating to the observance of prudential requirements, including the prevention of money laundering and other unlawful and fraudulent conduct,
  • supporting educational processes at secondary schools and universities in the Slovak Republic, as well as at accredited educational institutions and by accredited providers of educational services,
  • providing background information and support in the provision of advisory and other services by legal, accounting and tax advisers, auditors and other advisers, consultants and intermediaries,
  • conducting audits, in particular tax, legal or accounting audits,
  • providing background information and support for the performance of bailiffs’ duties in accordance with generally binding legal regulations
  • support in the exercise of the powers of public authorities in accordance with generally applicable legal regulations,

The legal basis for the processing of personal data at Cribis UR is Article 6(1)(f) of Regulation (EU) 2016/679 of the European Parliament and of the Council (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the ‘Regulation’).

The personal data processed in the Cribis UR information system is derived primarily from publicly available sources (including information required to be disclosed by such sources), as well as from users of the Cribis UR information system with whom CRIF SK has concluded the relevant contract.

Personal data processed in the Cribis UR information system is not transferred by CRIF SK to third countries.

The period for which personal data is processed and stored in the Cribis UR information system is the period during which the specific information remains relevant to the purpose of the processing. Subsequently, the data subject’s personal data is placed in pre-archival storage in accordance with generally applicable legal regulations.

The data subject has the right to request from the controller:

  1. confirmation as to whether or not personal data concerning them is being processed in the Cribis UR information system,
  2. general information on the processing of personal data in the Cribis UR information system,
  3. information on the source from which the controller obtained the personal data for processing,
  4. the categories of the data subject’s personal data that are being processed,
  5. correction of personal data,
  6. the erasure of personal data in the Cribis UR information system:
    - which are no longer necessary for the purposes for which they were collected or otherwise processed,
    - the processing of which was carried out unlawfully,
    - which must be erased where the reason for erasure is compliance with a legal obligation,
  7. restriction of the processing of personal data,
  8. exercising the right to object to the processing of personal data.

The data subject also has the right to lodge a complaint under Section 100 of Act No. 18/2018 Coll. on the Protection of Personal Data. The specific conditions for the exercise of data subjects’ rights are set out in Chapter III of the Regulation.

Version as of June 1, 2026