{"id":36892,"date":"2026-09-29T09:22:37","date_gmt":"2026-09-29T09:22:37","guid":{"rendered":"https:\/\/www.bancomail.com\/blog\/?p=36892"},"modified":"2026-09-29T09:22:38","modified_gmt":"2026-09-29T09:22:38","slug":"lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain","status":"publish","type":"post","link":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/","title":{"rendered":"Lusha, Apollo and the Italian Data Protection Authority: Data Buyers Are Accountable for the Supply Chain"},"content":{"rendered":"\n<p>In January 2025, a small lead generation business purchased 2,500 contacts from Apollo, the US-based B2B contact platform, including names, email addresses, phone numbers and job titles. It paid $224. The contacts were used for email campaigns, with the source disclosed at the bottom of each message and an option to unsubscribe.<\/p>\n\n\n\n<p>One recipient filed a complaint with the Italian Data Protection Authority: they had never registered with Apollo, and no one had informed them that their data was being processed.<\/p>\n\n\n\n<p>Who pays? You might expect the answer to be Apollo, the company that collected and sold the data. Instead, the Authority sanctioned the buyer.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_76 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\"><\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#The_buyer_pays\" >The buyer pays<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#Same_day_different_provider\" >Same day, different provider<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#Then_it_was_the_sellers_turn\" >Then it was the seller&#8217;s turn<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#Public_does_not_mean_free_to_use\" >Public does not mean free to use<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#The_questions_to_ask_before_paying\" >The questions to ask before paying<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#Where_is_the_provider_based\" >Where is the provider based?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#Does_it_have_a_representative_in_the_European_Union\" >Does it have a representative in the European Union?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#Where_does_the_data_come_from\" >Where does the data come from?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#Is_the_data_tracked_over_time\" >Is the data tracked over time?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#Have_the_data_subjects_been_informed\" >Have the data subjects been informed?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#How_can_someone_leave_the_database\" >How can someone leave the database?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#What_about_consent\" >What about consent?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#Companies_and_professionals_the_difference\" >Companies and professionals: the difference<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_buyer_pays\"><\/span>The buyer pays<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>The defence was one many companies might have used: Apollo stated that it was GDPR compliant, participated in the EU-US Data Privacy Framework and held ISO 27001 certification. What more could the buyer have done?<\/p>\n\n\n\n<p>Quite a lot, according to the decision issued on 14 May 2026. A generic statement of compliance proves nothing. The EU-US Data Privacy Framework concerns transfers of personal data to the United States, while ISO 27001 concerns information security. Both are significant, but they address different issues. Neither tells you where a contact came from, whether the individual was informed, or whether that data could lawfully be used for the intended purpose.<\/p>\n\n\n\n<p>Another point is worth noting: the Italian Data Protection Authority explicitly stated that, within those proceedings, it could not determine whether Apollo itself had collected the data lawfully. It did not need to. The party held accountable was the company that used the data.<\/p>\n\n\n\n<p>The fine was \u20ac1,500, calibrated to the size of a sole proprietorship. It may sound modest, but the real cost lies elsewhere: a ban on processing the data, mandatory deletion and publication of the decision on the Authority&#8217;s website. The purchased list becomes unusable, campaigns stop, and the company&#8217;s name remains publicly associated with the decision.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Same_day_different_provider\"><\/span>Same day, different provider<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>The Apollo case was not an isolated one. On the same day, 14 May, the Authority concluded two almost identical proceedings against two companies that had obtained their contacts from Lusha.<\/p>\n\n\n\n<p>The first had purchased approximately 300 contacts for email campaigns: \u20ac4,000. The second, a consulting company with a single employee, had collected 700 phone numbers and 400 email addresses using the Lusha plugin on LinkedIn, and had called a professional whose phone number was not even publicly visible on LinkedIn: \u20ac1,000. Both cases resulted in a ban on processing, deletion of the data and publication of the decision.<\/p>\n\n\n\n<p>In those decisions, the Italian Data Protection Authority took a broader view. It highlighted the growth of platforms selling contact details without documenting how those contacts were collected or the legal basis on which they are transferred, alongside buyers who rely on the provider&#8217;s reputation or professional appearance. According to the Authority, supply-chain control is one of the most vulnerable points in marketing.<\/p>\n\n\n\n<p>Translated from regulatory language: <strong>you are accountable for it.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Then_it_was_the_sellers_turn\"><\/span>Then it was the seller&#8217;s turn<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>In July, the Italian Data Protection Authority turned directly to Lusha Systems: a \u20ac2 million fine, a ban on processing the data of individuals in Italy and an order to delete the data. According to the Authority, the contact details offered for sale included those of senior institutional figures, public administration officials, law-enforcement personnel and members of the judiciary. An enterprise-grade way of getting noticed by exactly the wrong people.<\/p>\n\n\n\n<p>The Authority raised three main issues. <strong>Provenance:<\/strong> data had also been collected through social-media scraping and purchases from other data brokers, creating a supply chain that downstream users could not reconstruct. <strong>Use:<\/strong> rather than a one-off collection, profiles were continuously updated over time, an activity the Authority described as monitoring or tracking. <strong>Transparency:<\/strong> individuals had ended up in a database without knowing it and discovered this only when they began receiving calls and emails. The complaints included the two cases from May.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>For accuracy: the decision against Lusha is currently suspended. On 8 September, the Court of Rome issued an interim order and the proceedings challenging the decision are still pending. The final outcome concerning the seller has therefore not yet been determined. The May decisions concerning the buyers remain in place.<\/strong><\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Public_does_not_mean_free_to_use\"><\/span>Public does not mean free to use<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>In 2015, I wrote <a href=\"https:\/\/medium.com\/@andreamazzeo1\/il-signor-rossi-il-sig-bianchi-e-la-privacy-nell-email-marketing-c09fbfc8fdc3\">an article<\/a> arguing that when a company makes an email address public, even on a billboard beside a motorway, it does so to be contacted: to receive enquiries, but also potentially to receive relevant business proposals. I still believe that.<\/p>\n\n\n\n<p>A professional&#8217;s mobile number obtained through a plugin from a profile where they had not even published it is another matter. So is a continuously updated profile that follows a person from one job to the next.<\/p>\n\n\n\n<p>What matters is <strong>how the data became public, who made it public and for what purpose<\/strong>. And if the company selling it to you cannot answer those questions, the problem becomes yours.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_questions_to_ask_before_paying\"><\/span>The questions to ask before paying<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Following the investigation, the Apollo buyer introduced a preventive supplier verification process covering registered office, EU representative, privacy notices and consent. The Lusha case adds the questions that were missing: where does the data come from, is it monitored over time, and how can someone leave the database if they no longer want to be included?<\/p>\n\n\n\n<p>We have asked ourselves these questions. Here are our answers.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Where_is_the_provider_based\"><\/span>Where is the provider based?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>In Genoa, Italy. Bancomail S.p.A. has been operating since 2001 and is directly subject to the GDPR and to the Italian Data Protection Authority, without intermediaries.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Does_it_have_a_representative_in_the_European_Union\"><\/span>Does it have a representative in the European Union?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>We do not need one because we are established in the EU. We also have an appointed Data Protection Officer, who can be contacted at dpo@bancomail.it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Where_does_the_data_come_from\"><\/span>Where does the data come from?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>From validated public sources, with the provenance chain documented for every record: source, collection date, privacy notice provided and transfers made. We explain the process in detail in <a href=\"https:\/\/www.bancomail.com\/blog\/en\/transparency-creates-trust-how-we-document-the-processing-of-each-individual-data-record\/\">our article on the documented lifecycle of each individual data record<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Is_the_data_tracked_over_time\"><\/span>Is the data tracked over time?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>We verify it periodically: we check whether an email address exists and remains active, not where a person works from one job to the next. That is the difference between maintaining data and tracking an individual.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Have_the_data_subjects_been_informed\"><\/span>Have the data subjects been informed?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Yes. We provide privacy information to contacts included in our database and maintain records of those notices.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_can_someone_leave_the_database\"><\/span>How can someone leave the database?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Through our internal opt-out register: anyone who asks to be removed is removed and is not reintroduced during a subsequent update.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_about_consent\"><\/span>What about consent?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>We guarantee the collection and transfer of the data up to the point of delivery. How the data is subsequently used, and through which channel, is determined by the recipient as an independent data controller. The rules applicable to different channels are explained in our <a href=\"https:\/\/www.bancomail.com\/en\/email-marketing\/permission-marketing-rules\/\">Permission Marketing guidelines<\/a>.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>This applies to every provider, including us: if the answer is just a &#8220;GDPR compliant&#8221; badge, that is not much. If the answer is documented, then there is something you can actually assess.<\/strong><\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Companies_and_professionals_the_difference\"><\/span>Companies and professionals: the difference<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Our database consists predominantly of companies, but it also includes contact details that can be attributed to natural persons acting in a professional capacity, such as doctors and independent professionals. For these records, the chain remains the same: validated public source, documented provenance, privacy information provided and internal opt-out register. No profiles built by combining social-network data with information from other brokers, and no tracking of an individual&#8217;s career over time.<\/p>\n\n\n\n<p>We tell buyers how to start correctly: by providing the information required under <strong>Article 14 of the GDPR<\/strong> before any promotional communication, identifying Bancomail as the source and giving recipients the choice to remain, specify what they wish to be contacted about, or opt out. Introduce yourself before you sell. It works better than any clever subject line.<\/p>\n\n\n\n<p>And when we transfer a database, we transfer it outright: the customer becomes the data controller and identifies Bancomail as the source in its own privacy notice. Our name therefore appears in the inboxes of the people to whom the data relates. That is the opposite of a database whose existence people discover only when their phone rings.<\/p>\n\n\n\n<p>We have documented the rest in our <a href=\"https:\/\/www.bancomail.com\/en\/database\/gdpr-compliance\">GDPR Compliance<\/a> documentation and <a href=\"https:\/\/www.bancomail.com\/en\/about\/database-policy\/\">Database Policy<\/a>.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>A famous provider is not a shield. A documented data supply chain is where due diligence starts.<\/strong><\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>In 2026, the Italian Data Protection Authority sanctioned three Italian companies for using contacts purchased from Lusha and Apollo, and later sanctioned Lusha itself. Businesses purchasing B2B data must verify its origin and the lawfulness of the entire data supply chain: provider reputation, certifications and compliance claims are not enough. Bancomail documents the source, collection date, privacy notice and subsequent transfers for each record, making the data supply chain verifiable before purchase.<\/p>\n","protected":false},"author":6,"featured_media":36893,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4630],"tags":[8711,8720,8717,8721,8713,8723,8714,8709,8719],"post_template":[],"top_category":[],"class_list":["post-36892","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-marketing-database-en","tag-apollo-data-compliance","tag-b2b-contact-database","tag-b2b-data-compliance","tag-b2b-data-providers","tag-cold-email-compliance","tag-data-provenance","tag-data-supply-chain","tag-gdpr-b2b-database","tag-lusha-gdpr"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Lusha, Apollo and the Italian Data Protection Authority: Data Buyers Are Accountable for the Supply Chain - Bancomail Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Lusha, Apollo and the Italian Data Protection Authority: Data Buyers Are Accountable for the Supply Chain - Bancomail Blog\" \/>\n<meta property=\"og:description\" content=\"In 2026, the Italian Data Protection Authority sanctioned three Italian companies for using contacts purchased from Lusha and Apollo, and later sanctioned Lusha itself. Businesses purchasing B2B data must verify its origin and the lawfulness of the entire data supply chain: provider reputation, certifications and compliance claims are not enough. Bancomail documents the source, collection date, privacy notice and subsequent transfers for each record, making the data supply chain verifiable before purchase.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/\" \/>\n<meta property=\"og:site_name\" content=\"Bancomail Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-29T09:22:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-29T09:22:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2026\/09\/Lusha-Apollo-e-il-Garante-chi-compra-dati-risponde-della-filiera-Bancomail.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"970\" \/>\n\t<meta property=\"og:image:height\" content=\"540\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Andrea Mazzeo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Andrea Mazzeo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minuti\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/\"},\"author\":{\"name\":\"Andrea Mazzeo\",\"@id\":\"https:\/\/www.bancomail.com\/blog\/#\/schema\/person\/07459a4be8f896736257b4ad10c9710b\"},\"headline\":\"Lusha, Apollo and the Italian Data Protection Authority: Data Buyers Are Accountable for the Supply Chain\",\"datePublished\":\"2026-09-29T09:22:37+00:00\",\"dateModified\":\"2026-09-29T09:22:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/\"},\"wordCount\":1401,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.bancomail.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2026\/09\/Lusha-Apollo-e-il-Garante-chi-compra-dati-risponde-della-filiera-Bancomail.webp\",\"keywords\":[\"Apollo data compliance\",\"B2B contact database\",\"B2B data compliance\",\"B2B data providers\",\"cold email compliance\",\"data provenance\",\"data supply chain\",\"GDPR B2B database\",\"Lusha GDPR\"],\"articleSection\":[\"Marketing Database\"],\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/\",\"url\":\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/\",\"name\":\"Lusha, Apollo and the Italian Data Protection Authority: Data Buyers Are Accountable for the Supply Chain - Bancomail Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.bancomail.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2026\/09\/Lusha-Apollo-e-il-Garante-chi-compra-dati-risponde-della-filiera-Bancomail.webp\",\"datePublished\":\"2026-09-29T09:22:37+00:00\",\"dateModified\":\"2026-09-29T09:22:38+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#breadcrumb\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#primaryimage\",\"url\":\"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2026\/09\/Lusha-Apollo-e-il-Garante-chi-compra-dati-risponde-della-filiera-Bancomail.webp\",\"contentUrl\":\"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2026\/09\/Lusha-Apollo-e-il-Garante-chi-compra-dati-risponde-della-filiera-Bancomail.webp\",\"width\":970,\"height\":540},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.bancomail.com\/blog\/en\/homepage-en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Lusha, Apollo and the Italian Data Protection Authority: Data Buyers Are Accountable for the Supply Chain\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.bancomail.com\/blog\/#website\",\"url\":\"https:\/\/www.bancomail.com\/blog\/\",\"name\":\"Bancomail Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.bancomail.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.bancomail.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.bancomail.com\/blog\/#organization\",\"name\":\"Bancomail Blog\",\"url\":\"https:\/\/www.bancomail.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.bancomail.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2025\/06\/bancomail-logo-q400.png\",\"contentUrl\":\"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2025\/06\/bancomail-logo-q400.png\",\"width\":400,\"height\":400,\"caption\":\"Bancomail Blog\"},\"image\":{\"@id\":\"https:\/\/www.bancomail.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/bancomail\/?viewAsMember=true\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.bancomail.com\/blog\/#\/schema\/person\/07459a4be8f896736257b4ad10c9710b\",\"name\":\"Andrea Mazzeo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.bancomail.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2025\/11\/andeea-mazzeo-150x150.png\",\"contentUrl\":\"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2025\/11\/andeea-mazzeo-150x150.png\",\"caption\":\"Andrea Mazzeo\"},\"description\":\"CEO of Bancomail SpA \u2013 He began his career in commercial roles within the automotive and business software sectors, later becoming Sales Director at Whitesun Spa, where he managed the expansion of a national franchising network of beauty centers. Convinced of the importance of technical training in sales, he developed a passion for programming and specialized in database engineering. In 2001, he founded Neosoft and, combining his technical and commercial expertise, created the first European e-commerce prototype dedicated to B2B data, launching it under the Bancomail brand. In 2021, he transformed Bancomail into a joint-stock company (SpA).\",\"url\":\"https:\/\/www.bancomail.com\/blog\/author\/andrea\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Lusha, Apollo and the Italian Data Protection Authority: Data Buyers Are Accountable for the Supply Chain - Bancomail Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/","og_locale":"it_IT","og_type":"article","og_title":"Lusha, Apollo and the Italian Data Protection Authority: Data Buyers Are Accountable for the Supply Chain - Bancomail Blog","og_description":"In 2026, the Italian Data Protection Authority sanctioned three Italian companies for using contacts purchased from Lusha and Apollo, and later sanctioned Lusha itself. Businesses purchasing B2B data must verify its origin and the lawfulness of the entire data supply chain: provider reputation, certifications and compliance claims are not enough. Bancomail documents the source, collection date, privacy notice and subsequent transfers for each record, making the data supply chain verifiable before purchase.","og_url":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/","og_site_name":"Bancomail Blog","article_published_time":"2026-09-29T09:22:37+00:00","article_modified_time":"2026-09-29T09:22:38+00:00","og_image":[{"width":970,"height":540,"url":"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2026\/09\/Lusha-Apollo-e-il-Garante-chi-compra-dati-risponde-della-filiera-Bancomail.webp","type":"image\/webp"}],"author":"Andrea Mazzeo","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Andrea Mazzeo","Est. reading time":"8 minuti"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#article","isPartOf":{"@id":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/"},"author":{"name":"Andrea Mazzeo","@id":"https:\/\/www.bancomail.com\/blog\/#\/schema\/person\/07459a4be8f896736257b4ad10c9710b"},"headline":"Lusha, Apollo and the Italian Data Protection Authority: Data Buyers Are Accountable for the Supply Chain","datePublished":"2026-09-29T09:22:37+00:00","dateModified":"2026-09-29T09:22:38+00:00","mainEntityOfPage":{"@id":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/"},"wordCount":1401,"commentCount":0,"publisher":{"@id":"https:\/\/www.bancomail.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2026\/09\/Lusha-Apollo-e-il-Garante-chi-compra-dati-risponde-della-filiera-Bancomail.webp","keywords":["Apollo data compliance","B2B contact database","B2B data compliance","B2B data providers","cold email compliance","data provenance","data supply chain","GDPR B2B database","Lusha GDPR"],"articleSection":["Marketing Database"],"inLanguage":"it-IT","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/","url":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/","name":"Lusha, Apollo and the Italian Data Protection Authority: Data Buyers Are Accountable for the Supply Chain - Bancomail Blog","isPartOf":{"@id":"https:\/\/www.bancomail.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#primaryimage"},"image":{"@id":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#primaryimage"},"thumbnailUrl":"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2026\/09\/Lusha-Apollo-e-il-Garante-chi-compra-dati-risponde-della-filiera-Bancomail.webp","datePublished":"2026-09-29T09:22:37+00:00","dateModified":"2026-09-29T09:22:38+00:00","breadcrumb":{"@id":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#breadcrumb"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/"]}]},{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#primaryimage","url":"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2026\/09\/Lusha-Apollo-e-il-Garante-chi-compra-dati-risponde-della-filiera-Bancomail.webp","contentUrl":"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2026\/09\/Lusha-Apollo-e-il-Garante-chi-compra-dati-risponde-della-filiera-Bancomail.webp","width":970,"height":540},{"@type":"BreadcrumbList","@id":"https:\/\/www.bancomail.com\/blog\/en\/lusha-apollo-and-the-italian-data-protection-authority-data-buyers-are-accountable-for-the-supply-chain\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.bancomail.com\/blog\/en\/homepage-en\/"},{"@type":"ListItem","position":2,"name":"Lusha, Apollo and the Italian Data Protection Authority: Data Buyers Are Accountable for the Supply Chain"}]},{"@type":"WebSite","@id":"https:\/\/www.bancomail.com\/blog\/#website","url":"https:\/\/www.bancomail.com\/blog\/","name":"Bancomail Blog","description":"","publisher":{"@id":"https:\/\/www.bancomail.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.bancomail.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"it-IT"},{"@type":"Organization","@id":"https:\/\/www.bancomail.com\/blog\/#organization","name":"Bancomail Blog","url":"https:\/\/www.bancomail.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.bancomail.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2025\/06\/bancomail-logo-q400.png","contentUrl":"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2025\/06\/bancomail-logo-q400.png","width":400,"height":400,"caption":"Bancomail Blog"},"image":{"@id":"https:\/\/www.bancomail.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/bancomail\/?viewAsMember=true"]},{"@type":"Person","@id":"https:\/\/www.bancomail.com\/blog\/#\/schema\/person\/07459a4be8f896736257b4ad10c9710b","name":"Andrea Mazzeo","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.bancomail.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2025\/11\/andeea-mazzeo-150x150.png","contentUrl":"https:\/\/www.bancomail.com\/blog\/wp-content\/uploads\/2025\/11\/andeea-mazzeo-150x150.png","caption":"Andrea Mazzeo"},"description":"CEO of Bancomail SpA \u2013 He began his career in commercial roles within the automotive and business software sectors, later becoming Sales Director at Whitesun Spa, where he managed the expansion of a national franchising network of beauty centers. Convinced of the importance of technical training in sales, he developed a passion for programming and specialized in database engineering. In 2001, he founded Neosoft and, combining his technical and commercial expertise, created the first European e-commerce prototype dedicated to B2B data, launching it under the Bancomail brand. In 2021, he transformed Bancomail into a joint-stock company (SpA).","url":"https:\/\/www.bancomail.com\/blog\/author\/andrea\/"}]}},"_links":{"self":[{"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/posts\/36892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/comments?post=36892"}],"version-history":[{"count":3,"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/posts\/36892\/revisions"}],"predecessor-version":[{"id":36897,"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/posts\/36892\/revisions\/36897"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/media\/36893"}],"wp:attachment":[{"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/media?parent=36892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/categories?post=36892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/tags?post=36892"},{"taxonomy":"post_template","embeddable":true,"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/post_template?post=36892"},{"taxonomy":"top_category","embeddable":true,"href":"https:\/\/www.bancomail.com\/blog\/wp-json\/wp\/v2\/top_category?post=36892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}