Compliance at Debitura covers three areas: data processing governance under GDPR, contractual agreements that define rights and obligations, and verification mechanisms that ensure only authorised users can sign legally binding documents.

Together, these safeguards ensure that personal data is processed lawfully, contracts are signed by verified individuals, and defined events, including user-management and DPA-signing events, are recorded.

If your business is based in the EU or processes personal data of EU residents, GDPR Article 28 governs the relationship between you (the data controller) and any service provider processing data on your behalf (the data processor). A Data Processing Agreement is the standard way to document those terms, and putting them in place is your responsibility as controller. Debitura provides the tools and documentation needed to meet these obligations.

When you use Debitura for debt collection, you act as the data controller and Debitura acts as the data processor under GDPR Article 28. This means you determine the purpose of the data processing (collecting outstanding debts), and Debitura processes debtor personal data on your behalf and under your instructions. Debitura does not use debtor data for its own purposes.

The data Debitura processes on your behalf includes debtor names, contact details, address information, financial claim details, and supporting documents you upload. For a deeper look at GDPR roles and obligations, see Data protection and DPA fundamentals.

A Data Processing Agreement is available to you on request. It is the standard way to document GDPR Article 28 terms if you are based in the EU or handle personal data of EU residents, but signing one is not a precondition for using Debitura's services. The Standard Debt Collection Agreement (SDCA) already sets out each party's data protection role, and a signed DPA takes precedence over it on personal data processing.

Debitura provides a self-service DPA wizard with five steps: review your company data, review and attest your signing authority, sign digitally, add a privacy policy snippet to your website, and confirm completion. Only Admin users can access and complete the DPA wizard. For step-by-step instructions, see How to request a Data Processing Agreement (DPA).

After signing, you receive a context-aware privacy policy snippet to add to your website. This is required under GDPR Article 13 to inform debtors that Debitura processes their data on your behalf. The snippet text adapts depending on whether your context is EU or non-EU.

Separately from the optional DPA, you must sign two documents before cases can be processed:

You can view and download all signed contracts from the Contracts page in the platform. For details on accessing your documents, see Where to view and download signed agreements.

Debitura records defined events, including user-management and DPA-signing events. These records are not a complete log of every case view, document download or processing activity. Fields and retention vary by event; for example, password-login audit rows do not contain an IP address.

The DPA process has its own audit log covering every step from initialisation to completion, including the signer's identity, the signing timestamp and a SHA256 hash of the signed PDF. When the client's account is anonymized, those DPA audit rows are deleted outright.

Audit logs have no fixed retention period, and there is no automatic archival, pseudonymization or deletion after a set number of years. When an account is anonymized, its DPA signing log is deleted.

As the data controller, your obligations and rights under GDPR apply to the debtor data you process through Debitura. The platform supports you in fulfilling these obligations by keeping audit records for defined events, providing access to case and document data, and supporting data portability through case exports and document downloads.

If a debtor submits a GDPR request to you, you are responsible as the data controller for responding. Debitura can support you:

The controller normally must respond within one month. Any applicable extension or refusal must be communicated under the relevant rules; acknowledgement alone does not complete the response. See the European Data Protection Board (EDPB) guidance on respecting individuals' rights.

With your SDCA and PoA in place, you are set up to use Debitura. A signed DPA and a published privacy policy snippet further document your GDPR position. If your company data changes or a new DPA template version is released, you can delete your existing DPA and complete the wizard again with updated information. Contract version updates are prompted automatically when a new version is available.

For questions about data privacy and what information is visible to different parties, see Data privacy and document visibility. If you experience issues with email verification during contract signing, see Email verification troubleshooting.