Privacy policy for the invoicing service

This notice does not cover debt collection. If the business passes an unpaid claim to us for debt collection, you will be told separately, and our privacy policy for debt collection then applies.

1Who is responsible

Rieck Inkasso ApS (CVR 41645369), Østergade 4, 8370 Hadsten is the controller for the processing of your information in the invoicing service. The business that issued the invoice is responsible for its own processing, such as its bookkeeping and its customer relationship with you. If you have questions, write to rieck@rieckflow.com. We have not appointed a data protection officer.

2What we use the information for

• to send the business's invoices, credit notes, reminders and statements of account to you by email, e-Boks, letter or e-invoice
• to receive and record your payment, including when you have registered a payment card for recurring payments
• to give you access to the business's customer portal and to the payment page
• to document that the documents were sent and delivered
• to keep the invoices as accounting records

We do not use the information for marketing, profiling or credit scoring, and we do not combine it with information from our other customers.

3Why we may do so

We process the information because we and the business have a legitimate interest in the business's invoices being sent to you, paid and documented (Article 6(1)(f) of the General Data Protection Regulation). We have weighed that interest against yours: the information comes from a business you deal with yourself, it is used only for that invoicing, and the business could lawfully have sent the invoice itself.

We keep invoices and payments because the Danish Bookkeeping Act requires it (Article 6(1)(c)). We only use your Danish personal identification number (CPR number) if the business has provided it, and only to deliver the document to your digital mailbox (section 11(2) of the Danish Data Protection Act).

If you register a payment card for recurring payments, we process the card details on the basis of your registration (Article 6(1)(a)). You can withdraw it at any time by cancelling the card. This does not affect payments already made.

4Which information we process

• identity and contact details: name, address, email address, telephone number, CVR number and, only if the business has provided it, CPR number
• the invoices: what you bought, amounts, due dates, reminders, fees and interest
• payments: when and how you paid; if you have registered a payment card, the card type, the last digits, the expiry date and the payment provider's reference to the card. We never see the full card number
• use of the invoice: when you open the payment page or the customer portal or download the invoice as a PDF, including your IP address and information about your browser, and whether our emails were delivered

5Where the information comes from

• the business that issued the invoice, from its own customer or accounting system or entered by it
• the Danish Central Business Register (CVR), which is publicly available, if you trade as a business
• you, when you pay, use the customer portal or write to us

6Who we share the information with

• the business that issued the invoice, for example whether the invoice was sent, opened and paid
• the business's accounting software, if the business has connected it
• payment providers and acquirers that carry out your payment
• e-Boks, NemHandel and postal operators, when the document is sent that way
• our suppliers, who process information on our behalf, for example to run our systems and send emails, text messages and letters
• public authorities, when we are required to

7Transfers outside the EU

Some of our suppliers, for example for sending emails, process information in the USA. This is based on the European Commission's decision on the EU-U.S. Data Privacy Framework or on the Commission's standard contractual clauses. Write to us if you would like a copy of the safeguards.

8How long we keep the information

• invoices, credit notes, payments and settlements: 5 years from the end of the financial year they relate to, because the Danish Bookkeeping Act requires it. We delete them once that period has expired and the business has stopped using the invoicing service, or you have asked for deletion
• information about how you used the payment page, the customer portal and the invoice PDF: 5 years from the date of the invoice
• your contact details and your CPR number: for as long as the accounting records must be kept. They are then removed, and the CPR number is made unreadable

9Automated decisions

Reminders are sent automatically according to the rules and deadlines the business has chosen, and fees and interest are calculated according to fixed rules. Whether an unpaid claim is sent for debt collection is decided by the business. We do not use profiling.

10Your other rights

• to access the information we process about you
• to have incorrect information corrected
• to have information erased that we may no longer process
• to have the processing restricted, for example while we look into an objection
• in certain cases, to receive your information in a machine-readable format

You can exercise your rights by writing to rieck@rieckflow.com. It is free of charge, and we reply within one month.

11Complaints

You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, telephone +45 33 19 32 00, dt@datatilsynet.dk, www.datatilsynet.dk. You are welcome to contact us first.

12Changes

We update this notice when we change the way we process your information. If we want to use it for a new purpose, we will tell you before we do so. The date of the version is shown at the top.