A French executive does not choose to appear in a data market. Professional legitimacy requires public traces: a company filing, a board mandate, a conference panel, a press quote, a LinkedIn profile kept current for the sake of the role. Each trace is lawful, ordinary and individually harmless. A set of French and international companies exists to assemble those traces into something else: a structured, sellable profile of who holds influence, what they control and how to reach them directly.
None of this is a breach. The firms below operate openly, describe themselves as GDPR-compliant and sell to marketing, sales and risk teams every day. That is what makes the exposure worth mapping. It is built by design, from public material. It does not appear in any breach notification. What follows maps who assembles data about French executives and wealthy households, what each company sees, and why the combination matters more than any single source.
What the market sees when it looks at an executive
The raw material sorts into a few categories. There is identity and role: name, job title, seniority, board seat, reporting line. There is reachability: professional email, direct phone, mobile, LinkedIn. There is the corporate graph: ownership, shareholders, beneficial owners, subsidiaries, company revenue and risk signals. And there is affluence: property, luxury purchase behaviour, neighbourhood, household composition, the buying signals that mark a high-value consumer.
No one company holds all of it. Different firms specialise in different slices. The profile forms when they are combined. Recognising a data broker in Europe is harder than in the US because most of these companies do not call themselves one. They are sales-intelligence platforms, business-information providers, media groups and marketing co-ops.
Five companies, five slices of the same person
These five are illustrative, not a list. France’s data economy runs to hundreds of companies: sales-intelligence platforms, business-information providers, address and marketing firms, adtech intermediaries and sector-specific databases. No register names them all. The five below are here because each represents a distinct slice of an executive or wealthy profile, not because they are the only firms holding it. Which companies actually hold or trade data on a given person depends entirely on that person’s profile: sector, seniority, whether they own property, where they live, what they buy, how public the role is. A Paris fund director and a retired business owner in Nice generate different data. A different subset of this market finds each of them worth holding.
Nomination — the decision-maker graph
Nomination has sold French business-contact data for around 25 years. It reconstructs organisational charts, tracks executive appointments and job moves, and pairs each decision-maker with contact details, a professional biography and company structure. Its coverage is pitched at the businesses behind most of French economic activity. This is the layer that answers who holds power inside a company, and how to reach them. Nomination states its data is RGPD-compliant and carries the DMA France Privacy Protection Pact.
Altares / Dun & Bradstreet France — the ownership graph
Altares is the exclusive Dun & Bradstreet partner for France and Benelux. It maps directors, shareholders and beneficial owners, tracing ownership down to fractional stakes across complex group structures, alongside financial-risk indicators and subsidiary links. Altares reports data on more than 600 million companies worldwide, enriched from over 30,000 sources. Where Nomination shows the people, Altares shows the ownership and control behind them.
Infopro Digital Media — trade media as targeting data
Infopro Digital runs 35 professional media brands in France. The reading, downloading and event-attendance behaviour across those brands becomes a first-party data asset: the company reports around 4 million professional contacts and more than a billion behavioural data points, sold as intent-based and firmographic targeting. This is how the trade press for a sector quietly becomes a map of who in that sector is actively researching what.
Kaspr (Cognism) — contact enrichment
Founded in Paris in 2018 and part of the UK group Cognism since 2022, Kaspr turns a LinkedIn profile into direct contact data. It reports more than 160 million business contacts and around 30 million mobile numbers across France, the UK, the US, Germany and Spain. Tools like this are why a public professional profile so reliably produces a private mobile number.
Conexance — the affluent-consumer layer
Conexance, owned by WPP since 2016, operates one of France’s leading consumer-transaction data co-ops. Retailers contribute purchase histories to a shared pool the company puts at more than 25 million French household buyers and over a billion transactions from 500-plus merchants, then modelled to predict future buying behaviour. For a wealthy individual, this is the layer that infers spending power and lifestyle from what the household actually buys.
How the data is assembled
The supply chain is unremarkable. Public company registers provide directors and ownership. Trade publications and events capture professional interest. Website tracking and browser extensions turn visits and LinkedIn views into contact records. CRM enrichment fills gaps in a client’s existing lists. Retailer co-ops pool purchase histories. Third-party partnerships move data between all of them. Each step has a lawful basis its operator can point to. The profile is an emergent property of the whole chain, not the product of any one deliberate act.
Why executives leave the traces themselves
Executives are unusually exposed for a reason that is hard to avoid: the job requires visibility. A company cannot file accounts privately. A director’s mandate is a matter of public record. Credibility is built through interviews, conference appearances, board listings, press releases and a maintained professional profile. Those same credibility signals are what a targeting profile is built from. Reducing exposure is therefore not a matter of getting offline. It is a matter of understanding which traces feed the profile and which can be reduced without cost to the role. That is the reconnaissance an attacker runs before an approach, and how executives get targeted across Europe. It is also the exposure the corporate security stack cannot hunt past the company edge.
If the goal is exposure reduction rather than a single deletion, the work starts by mapping the profile: seeing what the market already holds before deciding what to remove.
See what’s exposedWhy the wealthy are mapped indirectly
For a high-net-worth individual without an executive role, the data is more oblique. There is rarely a company filing to anchor the profile. Instead it is inferred: property ownership and value, neighbourhood, luxury purchase signals, subscriptions, travel patterns, charitable giving, household composition and modelled income bands. The consumer-transaction layer does this by design, scoring households as high-value buyers from what they purchase rather than from anything they declare. The result is a profile assembled entirely from indirect signals, each of which the person never knowingly provided to anyone building it. This is the mosaic effect applied to wealth: no single data point is sensitive, but the combination describes a life.
The French legal line: lawful, and mostly by design
France does not treat all of this the same way, but the framework is the pan-European GDPR, applied here by a single national authority, the CNIL. Most brokers active in France work to those GDPR standards rather than any France-only rules. Business-to-business contact data sits on comparatively firm ground. The lawful basis is legitimate interest. Professionals can be approached about matters related to their role without prior consent, provided they are informed and can object. That is the space Nomination, Altares, Infopro and Kaspr operate in. Consumer marketing is stricter, generally requiring opt-in consent, which is why the affluent-consumer layer leans on contributed transaction data and modelling rather than open profiling of named individuals.
The practical point for an exposed person is that the right to object and the right to erasure apply across all of it. But they must be exercised one source at a time, against sources that are not obliged to advertise themselves. GDPR gives Europeans strong rights. It does not hand them a map of who to point them at. Deciding whether removal is even the right route under GDPR, and against which of these categories, is the work that precedes any opt-out. A general EU data broker opt-out list is a useful starting point for the known categories, not a substitute for that mapping.
The exposure is the join
No single broker in this picture knows everything, and none needs to. Nomination knows the role. Altares knows the ownership. Infopro knows the professional interest. Kaspr knows the direct line. Conexance knows the spending. The exposure is the join.
It also means there is no fixed list to work from. Because most of these companies are B2B and sell to other businesses, their holdings are not visible from the outside. It is rarely possible to confirm from open sources that a named broker holds a specific person’s record. What can be reasoned about is likelihood: given a profile of a certain shape, which categories of company are highly likely to hold or sell data on it. This is why a US-style broker list, built for a different market, misses most of it, and why effective removal in Europe starts from the profile and works outward to the likely holders rather than from a preset roster. The risk appears only when someone with reason to profile that person (a fraudster preparing an approach, a litigant, a hostile counterparty) assembles the slices. The slices they can buy depend on who that person is. Germany’s market has the same shape but a different centre of gravity, built around credit bureaux and address traders.
From mapping to removal
Understanding the ecosystem is the first half of the work. Reducing it is the second. It has to start from the same investigative footing: knowing which layers hold data about a specific person before deciding what to remove and in what order. For executives, founders, families and the advisors who protect them, this goes beyond routine privacy housekeeping. It is exposure reduction against a market working as designed, entirely within the law.