What it is
Data privacy in Debitura refers to how personal and business information is handled, stored, and shared throughout the debt collection process. Document visibility defines which parties can access the files and case details you upload to the platform.
Under GDPR and applicable data protection laws, you as the client are the data controller for debtor information. This means you determine why and how personal data is processed. Debitura acts as a data processor, handling data on your behalf under your instructions. When a collection partner is assigned to your case, they also act as an independent data processor.
For detailed definitions of these roles, see Data protection and DPA fundamentals.
Why it matters
When you submit a case for collection, you share sensitive information about your business relationship with a debtor. Knowing how this data flows and who can access it allows you to:
Comply with your own data protection obligations as data controller
Understand what collection partners see and when
Maintain confidentiality of commercially sensitive documents
Fulfil GDPR requirements such as informing debtors about third-party processors
How it works
Data sharing with collection partners
When you sign the Standard Debt Collection Agreement (SDCA), you authorise Debitura to share all case data with the assigned collection partner. This includes debtor contact details, claim amounts, uploaded documents, and any notes you add. The partner needs this information to pursue recovery on your behalf.
If your case requires legal action or quotes from multiple partners, Debitura may share case data with its network of local attorneys to source proposals. You acknowledge this when signing the SDCA.
Document visibility rules
Documents you upload are visible to:
You and your team - any user with access to your organisation can view case files
The assigned collection partner - once your case moves to Pending Verification or later, the partner can access all uploaded files
Debitura staff - backend administrators can view documents for quality control and support purposes
Importantly, collection partners cannot see your case until Debitura completes internal validation. Cases in the initial internal review stage are hidden from partners entirely.
File permissions and deletion
Only the party that uploaded a document can delete it. If you upload a contract, you can remove it later. If a collection partner uploads evidence, only they can delete that file. This rule protects both parties from losing important documents.
Debitura tracks who uploaded each file (client, partner, or admin) along with the uploader's organisation. This provides an audit trail and ensures the correct permissions apply.
Chat and communication
Debitura provides a built-in chat for each case where you and the assigned partner can exchange messages and attachments. Both parties see the same conversation thread. Files shared in chat follow the same visibility rules: both you and the partner can view them, and only the sender can delete their own uploads.
Data protection measures
Debitura and collection partners implement technical and organisational measures to protect your data. These include:
Processing data only for debt recovery purposes under your instructions
Maintaining audit trails of user actions for 7 years to meet legal requirements
Restricting access based on user roles (team members only see cases assigned to them)
Complying with GDPR principles such as data minimisation and accuracy
All information exchanged under the SDCA is confidential and cannot be disclosed to third parties without consent, except as required by law.
Data Processing Agreement (DPA)
EU clients can sign a separate Data Processing Agreement with Debitura to formally document GDPR requirements. The DPA wizard lets you generate, review, and digitally sign this agreement online. After signing, you receive a privacy policy snippet to add to your website informing debtors that Debitura processes data on your behalf.
To sign a DPA, see How to request a Data Processing Agreement.
What to expect
As a client using Debitura, you should expect:
Shared visibility with partners - once your case is validated and assigned, the collection partner sees all case files and details
Protected deletion rights - only you can delete files you uploaded; partners cannot remove your documents
Confidential handling - data is used only for collection purposes and kept confidential
Audit compliance - actions are logged and retained for regulatory purposes
GDPR support - optional DPA available, and privacy policy guidance provided after signing
Your responsibilities
Under the SDCA, you agree to:
Provide accurate information about yourself, the debtor, and the case
Check the platform regularly for updates and respond to requests within 72 business hours
Notify the collector if the debt is disputed or becomes disputed
Inform the collector within 3 days if you receive payment directly from the debtor
Meeting these obligations ensures smooth case handling and helps partners recover your claims effectively.