Debitura

Legal & data protection

All of Debitura's legal documents in one place, and how we protect the personal data of our clients, their customers and debtors: how we handle data, who we share it with and how you can exercise your rights.

Legal documents

These are the documents that govern how you use Debitura and how we handle personal data:

  • Terms of Service: the agreement that governs your use of the Debitura platform.
  • Privacy Policy: how Debitura collects, uses and protects personal data, and how to exercise your rights.
  • Sub-processors: the third parties that process personal data for us, where they process it and how transfers are safeguarded. Sign up there to be notified of changes.
  • Data Processing Agreement (DPA): for clients. Generate and sign it in the platform; more below.
  • Standard Debt Collection Agreement: the terms for pre-legal collection cases, signed in the platform before you upload cases.
  • Partner Terms: the standard terms for collection agencies and law firms on the Debitura partner platform.

‍

How Debitura processes data

Debitura is a debt collection platform that connects creditors with local collection agencies and law firms in 183 countries. When you use Debitura, personal data flows through our platform to facilitate the collection process.

In simple terms:

  • You (the creditor) upload claim and debtor information to Debitura
  • Debitura securely stores and transmits this data to the appropriate collection partner
  • The collection partner uses this data to recover the debt on your behalf

Each party has specific responsibilities under data protection law.

‍

Roles under GDPR

Party Role Responsibility
Client (Creditor) Data Controller Determines why and how personal data is processed. Responsible for having a legal basis to share debtor data.
Debitura Data Processor Processes data on behalf of the client. Implements security measures and assists with data subject requests.
Collection Partner Independent Data Processor Processes data on behalf of the client to perform collection activities. Operates under their own data protection obligations.

What data we process

Debtor information:

  • Name and contact details (address, email, phone)
  • Invoice and claim details (amounts, due dates, reference numbers)
  • Communication history related to the collection case
  • Business identifiers (company registration numbers)

Client user information:

  • Full name and contact details of users managing cases
  • Login credentials and activity logs

We do not process special categories of personal data (health, religion, political opinions, etc.) unless strictly necessary and explicitly provided by the client.

‍

Security measures

We take the security of your data seriously. Our key measures include:

  • Encryption: All data is encrypted in transit (TLS) and at rest
  • Hosting: Platform data is hosted on Microsoft Azure in the European Union (Ireland, with replication to the Netherlands)
  • Access control: Only essential personnel have access to personal data
  • Staff training: All team members receive data protection training
  • Monitoring: We maintain logs and monitor for unauthorized access
  • Incident response: Documented procedures for identifying and responding to breaches

Sub-processors

The current list of sub-processors, with what each one does, the personal data it handles, where it processes it and how transfers are safeguarded, is on our Sub-processors page. You can sign up there to be notified before we add or replace a sub-processor.

‍

Data Processing Agreement

If you are a Debitura client, you can generate and sign a Data Processing Agreement (DPA) directly in the platform. The DPA defines our obligations as your data processor and ensures compliance with GDPR.

‍

Generate your DPA in the Debitura platform →

For debtors

Debitura is a platform used by creditors to manage their debt collection process. We do not contact debtors directly. If you have received communication about an outstanding debt, it will have come from a local collection agency or law firm – not from Debitura.

However, your data may pass through our platform as part of the collection process. If you have questions or wish to exercise your data protection rights:

Your rights:

You have the right to:

  • Access the personal data held about you
  • Correct any inaccurate information
  • Object to processing in certain circumstances
  • Request deletion where legally applicable

Who to contact:

  1. The collection agency or law firm that contacted you – they are handling your case directly
  2. Your original creditor – they are the data controller and determined that your data should be processed
  3. Debitura – if you cannot reach the above parties, contact us at privacy@debitura.com and we will help direct your request

Please note: As a platform provider, we process data on behalf of creditors. Requests such as deletion may require the creditor's approval, and some data must be retained for legal reasons related to the debt collection process.

Data retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • Active cases: Data is retained while the collection case is ongoing
  • Closed cases: Data is retained for up to 10 years for legal and compliance purposes
  • Account deletion: When a client deletes their account, the associated data is permanently removed within 30 days, unless retention is required by law. Where we have confirmed fraud or serious breaches of our Terms, we keep a limited fraud-prevention record (hashed identifiers only) for up to five years, as described in section 5 of our Privacy Policy

Contact us

For any questions about how we handle personal data, or to exercise your data protection rights:

Data Protection Contact:

‍
 Lars Holdgaard
Email: privacy@debitura.com

‍

Company details:
Debitura LLC

300 Delaware Ave

Ste 210 #557

Wilmington, DE 19801, United States

‍

Last updated: 9 October 2026

‍