Privacy Policy for Debitura

1. Policy Summary

Personal Data Processed:

• Invoice Data
• Debtor Data
• User Data

Purposes:

• Facilitating debt collection
• Managing and processing cases
• Providing and improving services

Services Used:

• The service providers we use, what each one does and where it processes data are listed on our Sub-processors page.

Data Controller: The data controller for this website is Debitura LLC, 300 Delaware Ave, Ste 210 #557, Wilmington, DE 19801, United States. Contact: privacy@debitura.com

2. Data Collection and Usage

Types of Data Collected:

• Invoice Data: Includes details such as invoice numbers, amounts, due dates, and descriptions.
• Debtor Data: Includes debtor's name, contact information, outstanding debt amounts, and related contract information.
• User Data: Includes the full name and contact information of users created by the Client to manage cases.

Purpose of Data Collection:

• To facilitate the debt collection process between the Client and the Debt Collector.
• To manage and process debt collection cases efficiently.
• To provide users with access to our platform and its features.
• To comply with legal obligations and resolve any disputes.

3. Data Sharing and Disclosure

Third Parties:

• We share personal data with debt collectors (law firms and debt collection agencies) who manage the debt collection process on behalf of the Client.
• Sub-processors who help us provide our services. The current list, with what each one does and where it processes data, is on our Sub-processors page.

Data Sharing Agreements:

• Each sub-processor is bound by a data processing agreement, either our own or the provider's standard data processing terms, that requires it to protect personal data in line with the GDPR.

4. Data Storage and Security

Storage Locations:

• Platform data is stored on Microsoft Azure in the European Union (Ireland, with replication to the Netherlands). Some of our sub-processors process personal data outside the EU, mainly in the USA (see International Data Transfers in section 9).

Security Measures:

• Hosted on Microsoft Azure in the EU, encrypted in transit and at rest.
• Limited data access is provided only to authorized team members.

5. Data Retention

Retention Periods:

• Personal data is retained for as long as necessary to fulfill the purposes outlined in this Privacy Policy, taking into account statutory limitations.
• Data can be deleted upon the Client's request. When the Client closes their account, personal data is anonymized 30 days after the account is closed. Amounts, payments and payouts are kept for accounting.

Fraud prevention records. Where Debitura has confirmed fraud, systematic non-payment to collection partners, or serious Terms of Service violations, we retain a limited fraud-prevention record after account deletion to prevent re-registration by the same actor. This record consists of the registered company name and company registration number, stored in clear text, and cryptographic hashes of the contact email and phone number (not the original values). It is used only to verify new registration attempts. Legal basis: our legitimate interest in fraud prevention (GDPR Art. 6(1)(f); Recital 47). Retention: maximum five (5) years from account deletion. You may object under Art. 21 by contacting privacy@debitura.com.

6. Data Subject Rights

Rights and Requests:

• Access: You have the right to request access to your personal data.
• Rectification: You can request corrections to any inaccurate or incomplete data.
• Erasure: You can request the deletion of your data under certain conditions. Erasure may be limited or refused where Debitura has an overriding legitimate interest (e.g., fraud prevention) or a legal obligation requiring retention, in accordance with GDPR Art. 17(1)(c) and Art. 17(3)(b)–(e).
• Data Portability: You have the right to request the transfer of your data to another organization.
• Restriction of Processing: You can request the restriction of the processing of your data.
• Objection to Processing: You have the right to object to the processing of your data under certain circumstances.

To exercise these rights, please contact us at privacy@debitura.com.

7. Cookies and Tracking

Cookies and Tracking Technologies:

• We use cookies and similar tracking technologies to enhance user experience, analyze website traffic, and support marketing efforts.
• Google Analytics and Google Tag Manager (Google): the _ga and _ga_* cookies measure how visitors use the website.
• Google Ads (Google): the _gcl_au cookie links ad clicks to sign-ups so we can measure our advertising.
• _dbt_attr (Debitura, our own cookie): when you arrive through a link with campaign or ad parameters, it stores those parameters and the landing page for up to 90 days, so a later sign-up can be attributed to that campaign.
• Intercom (Intercom): the intercom-id-*, intercom-session-* and intercom-device-id-* cookies run the chat widget and keep your conversation with us.
• Ahrefs Web Analytics (Ahrefs): measures website traffic without setting cookies.
• Weglot (Weglot): translates the website into other languages and may store your language choice in your browser.
• Trustpilot (Trustpilot): shows our Trustpilot reviews in an embedded widget on some pages.
• YouTube (Google): videos are embedded through youtube-nocookie.com and load only when you play them. YouTube may then set its own cookies.
• Cloudflare Turnstile (Cloudflare): checks that website forms are submitted by a person and not a bot.
• You can manage your cookie preferences through your browser settings.

Opt-Out Information:

• Users may opt out of interest-based advertising through their browser settings or with Google's opt-out tools, such as Google Ads Settings.

8. Contact Information

Contact Information for Privacy Inquiries:

• Email: privacy@debitura.com

9. Mode and Place of Data Processing

Methods of Processing:

• Data is processed using computers and/or IT-enabled tools, following organizational procedures strictly related to the purposes indicated. Access to data is restricted to authorized personnel and subprocessors.

Place of Processing:

• Data is processed in our hosting environment (Microsoft Azure in the EU) and wherever the other parties involved in the processing are located.

International Data Transfers:

• Some of our sub-processors process personal data outside the EU/EEA, mainly in the USA. We protect these transfers with the EU Standard Contractual Clauses and, where they apply, the UK Addendum or IDTA or the EU-U.S. Data Privacy Framework. The location and transfer safeguard of each sub-processor is listed on our Sub-processors page.

10. Miscellaneous

Changes to the Privacy Policy:

• Any changes to this Privacy Policy will be posted on our website with an updated revision date.
• We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data.

By using our services, you acknowledge that you have read and understood this Privacy Policy. If you have any questions or concerns about our data practices, please contact us at privacy@debitura.com.

11. Related Documents

This Privacy Policy is part of Debitura's legal documents, together with our Terms of Service, the list of sub-processors and, for clients, the Data Processing Agreement. You find all of them, and how we process data on behalf of our clients, on our Legal & data protection page.

‍