Privacy Policy for Debitura

1. Policy Summary

Personal Data Processed:

• Invoice Data
• Debtor Data
• User Data

Purposes:

• Facilitating debt collection
• Managing and processing cases
• Providing and improving services

Services Used:

• Google Analytics, Facebook Pixel, LinkedIn Pixel for analytics and marketing
• Microsoft Azure for hosting (in the EU)
• Twilio SendGrid and Google Workspace for communication
• OpenAI for AI services

Data Controller: The data controller for this website is Debitura LLC, 300 Delaware Ave, Ste 210 #557, Wilmington, DE 19801, United States. Contact: privacy@debitura.com

2. Data Collection and Usage

Types of Data Collected:

• Invoice Data: Includes details such as invoice numbers, amounts, due dates, and descriptions.
• Debtor Data: Includes debtor's name, contact information, outstanding debt amounts, and related contract information.
• User Data: Includes the full name and contact information of users created by the Client to manage cases.

Purpose of Data Collection:

• To facilitate the debt collection process between the Client and the Debt Collector.
• To manage and process debt collection cases efficiently.
• To provide users with access to our platform and its features.
• To comply with legal obligations and resolve any disputes.

3. Data Sharing and Disclosure

Third Parties:

• We share personal data with debt collectors (law firms and debt collection agencies) who manage the debt collection process on behalf of the Client.
• Sub-processors who help us provide our services. The current list, with what each one does and where it processes data, is on our Sub-processors page.

Data Sharing Agreements:

• Each sub-processor is bound by a data processing agreement, either our own or the provider's standard data processing terms, that requires it to protect personal data in line with the GDPR.

4. Data Storage and Security

Storage Locations:

• Platform data is stored on Microsoft Azure in the European Union (Ireland, with replication to the Netherlands). Some of our sub-processors process personal data outside the EU, mainly in the USA (see International Data Transfers in section 9).

Security Measures:

• We use Microsoft Azure for secure data hosting, which includes state-of-the-art security measures such as data encryption, access controls, and regular security audits.
• Internal policies and regular staff training ensure data protection.
• Limited data access is provided only to authorized senior staff members.

5. Data Retention

Retention Periods:

• Personal data is retained for as long as necessary to fulfill the purposes outlined in this Privacy Policy, taking into account statutory limitations.
• Data can be deleted upon the Client's request or automatically once the Client deletes their account.

Fraud prevention records. Where Debitura has confirmed fraud, systematic non-payment to collection partners, or serious Terms of Service violations, we retain a limited fraud-prevention record after account deletion to prevent re-registration by the same actor. This record consists solely of cryptographic hashes of contact identifiers (email, phone) and the registered company name — not the original values — and is used only to verify new registration attempts. Legal basis: our legitimate interest in fraud prevention (GDPR Art. 6(1)(f); Recital 47). Retention: maximum five (5) years from account deletion. You may object under Art. 21 by contacting privacy@debitura.com.

6. Data Subject Rights

Rights and Requests:

• Access: You have the right to request access to your personal data.
• Rectification: You can request corrections to any inaccurate or incomplete data.
• Erasure: You can request the deletion of your data under certain conditions. Erasure may be limited or refused where Debitura has an overriding legitimate interest (e.g., fraud prevention) or a legal obligation requiring retention, in accordance with GDPR Art. 17(1)(c) and Art. 17(3)(b)–(e).
• Data Portability: You have the right to request the transfer of your data to another organization.
• Restriction of Processing: You can request the restriction of the processing of your data.
• Objection to Processing: You have the right to object to the processing of your data under certain circumstances.

To exercise these rights, please contact us at privacy@debitura.com.

7. Cookies and Tracking

Cookies and Tracking Technologies:

• We use cookies and similar tracking technologies to enhance user experience, analyze website traffic, and support marketing efforts.
• Tools used include Google Analytics for website analysis and Facebook/LinkedIn pixels for targeted advertising.
• You can manage your cookie preferences through your browser settings.

Opt-Out Information:

• Users may opt-out of interest-based advertising through their browser settings or by using opt-out tools provided by services like Google and Facebook.

8. Contact Information

Contact Information for Privacy Inquiries:

• Email: privacy@debitura.com

9. Mode and Place of Data Processing

Methods of Processing:

• Data is processed using computers and/or IT-enabled tools, following organizational procedures strictly related to the purposes indicated. Access to data is restricted to authorized personnel and subprocessors.

Place of Processing:

• Data is processed at our operating offices and any other places where the parties involved in the processing are located.

International Data Transfers:

• Some of our sub-processors process personal data outside the EU/EEA, mainly in the USA. We protect these transfers with the EU Standard Contractual Clauses and, where they apply, the UK Addendum or IDTA or the EU-U.S. Data Privacy Framework. The location and transfer safeguard of each sub-processor is listed on our Sub-processors page.

10. Miscellaneous

Changes to the Privacy Policy:

• Any changes to this Privacy Policy will be posted on our website with an updated revision date.
• We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data.

By using our services, you acknowledge that you have read and understood this Privacy Policy. If you have any questions or concerns about our data practices, please contact us at privacy@debitura.com.

11. Related Documents

This Privacy Policy is part of Debitura's legal documents, together with our Terms of Service, the list of sub-processors and, for clients, the Data Processing Agreement. You find all of them, and how we process data on behalf of our clients, on our Legal & data protection page.

‍