Privacy Statement Ultimoo Incasso B.V.

Last updated: July 9, 2025

Ultimoo Incasso B.V. and its affiliates attach great importance to the protection of your privacy and personal data. This privacy statement provides insight into how we collect, process, and secure personal data, and outlines your rights regarding your information.

1. Personal Data Collected and Processed

We collect and process personal data, such as name, date of birth, address, telephone number, and financial data, as necessary for handling your applications, claims, or communications. In accordance with applicable privacy legislation (the General Data Protection Regulation, GDPR), we inform you about the processing of personal data and other relevant information. We process the following categories of personal data and information:

Personal Details:

  • Name
  • Address
  • Phone number
  • Email address
  • Date of birth

Financial Information:

  • Debts
  • Outstanding balances
  • Payment history
  • Bank account information

Complaints:

  • Letters of complaint, emails, or phone calls
  • Complaint registration and follow-up

Complex Files:

  • All relevant data, including identification data, financial statements, communication, and any legal documents

Legal Documents:

  • Summonses
  • Judgments
  • Court rulings
  • Legal correspondence
  • Evidence in legal proceedings

Credit Information:

  • Credit reports and debtor assessments
  • Risk assessments: Evaluation of the likelihood of debt repayment
  • Debt collection activity reports: Performance, status of outstanding claims, debtor payment behavior
  • Monitoring data for overseeing the efficiency of debt collection procedures

Personnel Data:

  • Name, date of birth, address, nationality, contact details
  • Employment contract details
  • Payroll and financial information
  • Employee contact information
  • Contract data related to claims
  • Job application data
  • Employee appraisals and evaluations
  • Data regarding the health status of employees
  • Legal matters, such as dismissal procedures, occupational accident reports, and disciplinary actions

Security Data:

  • Identification data
  • Access rights
  • Access logs
  • Sensitive data
  • Information regarding security settings and incidents

2. Legal Basis for Processing:

Personal data is processed based on legal grounds, including legitimate interest and the necessity for legal claims. The specific legal grounds include:

  • Performance of a contract: Personal data may be processed if necessary for the execution of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation: If the processing of personal data is necessary to comply with a legal obligation to which the data controller is subject, this constitutes a valid legal basis.

3. Automated Decision-Making

There is no automated decision-making process. Your application is assessed by a human debt collection specialist. This professional adds human insight to the decision-making process and can evaluate additional information, such as the purpose of the loan, financial data analysis, and your personal circumstances.

Decision-making: The final decision regarding your credit request is made based on the assessment by our human case manager. This approach ensures an informed decision that considers both objective data and human insights.

4. Retention Periods

We do not store your personal data longer than strictly necessary to realize the objectives of our services for which your data was collected. For administrative and fiscal purposes, we maintain a statutory retention period of 7 years. After these periods, data is generally deleted or anonymized.

Personal data is retained as long as necessary for the full processing of applications, claims, and communication, based on the nature of the request and statutory retention periods.

5. Your Rights as a Data Subject

You have the right to access your personal data, to correct it (in case of inaccuracies), and/or to have it deleted (the right to be forgotten). Additionally, you have the right to withdraw any consent for data protection or to object to the processing of your personal data. You may also submit a request for data portability, whereby we transfer the data to you in a structured, commonly used format. Requests can be submitted via avg@ultimoo.nl.

6. Sharing with Third Parties

For the processing of personal data, we utilize third parties (processors). Personal data is only shared with third parties if necessary for the performance of agreements or to comply with legal obligations, such as with bailiffs and attorneys. We enter into data processing agreements with these parties to ensure they handle your data carefully and in accordance with the General Data Protection Regulation (GDPR). Finally, under no circumstances will data be sold to third parties.

7. Security Measures

We take appropriate technical and organizational measures to prevent misuse, loss, unauthorized access, and other undesirable actions involving personal data. Our security measures include:

  • Compliance with laws and regulations
  • Physical security measures for people, resources, and confidential information
  • Anti-ransomware measures
  • Access restriction to authorized employees only
  • Reporting and evaluation of security incidents
  • Regular firewall updates
  • High employee awareness regarding the protection of personal data

8. Cookies

For information regarding cookies, please consult the cookie statement on our website.

9. Miscellaneous

Your requests regarding the storage and/or processing of your personal data can be submitted to avg@ultimoo.nl. We maintain a response period of a maximum of 4 weeks. In some cases, we may ask you to identify yourself to guarantee the security and confidentiality of your data.

If you believe your rights regarding your personal data are being violated, you always have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We emphasize that this privacy statement complies with the requirements of the General Data Protection Regulation (GDPR). Ultimoo Incasso B.V. reserves the right to update this privacy statement if necessary.