This text is for you, if you are a debtor in a debt-collection case with us. It sets out which information we process about you, why we may, who it can be passed on to, and how long we keep it. It also sets out what you can require of us.
§ 1
Introduction
Rieck Inkasso helps organisations collect money owed to them. This privacy policy applies to you if you are a debtor in a debt collection case with us.
We are the data controller for all the information we process about you in connection with the case. We are an authorised debt collection agency, we work in accordance with proper debt collection practice (god inkassoskik), cf. chapters 2 and 4 of Inkassoloven (the Danish Debt Collection Act), and we are supervised by Rigspolitiet (the Danish National Police).
The policy also applies to any legal proceedings that may arise out of the collection case.
§ 2
Contact details
The data controller is the party that determines the purposes for which, and the means by which, personal data may be processed. The data controller is:
We process information about you in order to obtain payment of the claim our client has assigned to us. This means that we:
Send letters and messages, enter into and follow up on payment arrangements, and record your payments.
Take legal steps if the claim is not paid — for example before the bailiff’s court (enforcement court) or the courts. It may become necessary to levy execution against your assets and to demand that they be sold at a compulsory auction.
Investigate whether you own anything that execution can be levied against.
Document that our letters and messages have reached you, and that we have complied with proper debt collection practice.
Comply with our obligations under, for example, Bogføringsloven (the Danish Bookkeeping Act) and Inkassoloven (the Danish Debt Collection Act).
We do not use the information for any other purpose. If we wish to use it for a new purpose, we will tell you before we do so.
The legal basis is Article 6(1)(f) of the General Data Protection Regulation (GDPR) — processing necessary for us and our client to pursue a legitimate interest in having an overdue claim paid. The procedure laid down in the Danish debt collection legislation ensures that your fundamental rights and freedoms are not overridden. Information that the law requires us to retain and document is also processed under Article 6(1)(c).
We use your CPR number (Danish civil registration number) only where it is necessary to identify you unambiguously — for example before the bailiff’s court (section 11(2) of Databeskyttelsesloven, the Danish Data Protection Act).
If you do not pay within the deadline in our formal demand (påkrav), we may keep track of publicly available registers — Ejerfortegnelsen (the register of owners of real property), the property location register, the assessment register, CVR and Statstidende (the Danish Official Gazette) — to see whether you acquire or dispose of real property or ownership interests in companies, or whether a property you own is put up for compulsory auction. The purpose is to assess whether legal steps and execution would serve a purpose, and the legal basis is the same. We stop when the claim has been paid, while you are complying with a payment arrangement, and if you dispute the claim.
Where it is necessary in the individual case to process special categories of data — for example health data — the basis is Article 9(2)(e) and (f): data you have manifestly made public yourself, or processing necessary for the establishment, exercise or defence of legal claims.
Your prior consent is therefore not required.
§ 4
The information we process
We process only the information that is relevant to the recovery of the claim. That may include:
Identity and contact
Name, address, CPR number, telephone number and email address. We do not disclose your CPR number to anyone other than the parties to the case and the authorities we are required to state it to.
The claim
What the claim concerns, amounts, interest, fees, payments and arrangements.
Communication and self-service
Letters, emails, text messages and conversations with you. When you open our emails, click a link in them or log in to your case, we record the time, your IP address and information about your device and browser — so that we can document that our communications have reached you.
Financial circumstances
Information about your financial circumstances, for example about real property, companies and compulsory auctions, and information from credit reference agencies, for example whether you are registered as a defaulting payer.
Legal matters
Court cases, enforcement proceedings, estates of deceased persons, bankruptcies and debt relief proceedings relating to the claim.
Employment and social circumstances
To the extent they bear on your ability to pay or on the recovery of the debt.
Special categories
Health data and any criminal law matters — only where strictly necessary in order to establish the claim or carry out the recovery, or where you have made them public yourself or provided them to us, to our representative or to our client.
The information comes from our client, who has assigned the claim to us, and from you — when you write, call or use our self-service, or during court hearings. Where your case calls for it, it may also come from:
Publicly available registers
For example Ejerfortegnelsen (the register of owners of real property) and the other property registers at Datafordeleren (the Danish state’s distributor of basic data), Det Centrale Virksomhedsregister (CVR, the Danish Central Business Register), the land register and Statstidende (the Danish Official Gazette). Of some registers we hold a copy, refreshed on an ongoing basis. The land register we look up when your case calls for it, and we keep no copy of it; what the lookup shows forms part of the case file.
Credit reference agencies
For example Experian, which operates RKI (the Danish credit register). The information comes from the agency’s own register, not from a public register.
Courts and others
Courts, bailiff’s courts, probate courts, estate administrators and trustees in bankruptcy — and others with knowledge of your circumstances, for example a lawyer.
The information in the public registers is publicly available, but that does not change the fact that it is about you, or that you have the rights set out in section 10. If a piece of information is wrong, it must be corrected at source: a correction in the register feeds through to us, and a lookup always retrieves what the register says now. If a payment default is wrong, it must be corrected with the credit reference agency.
If we receive information about you from others, we will tell you so at our first contact with you thereafter — where appropriate by referring you to this policy.
§ 5
Recipients of personal data
While the case is being handled, it may become necessary to disclose information about you to:
The creditor — our client, to whom you owe the money.
The courts, if the case is to be brought before the bailiff’s court (enforcement court), the civil court or the probate and bankruptcy court.
Approved debt collection agents.
Lawyers or others appearing in court on our behalf.
A haulier, a locksmith or other tradespeople engaged in connection with an enforcement case.
Your landlord, Skattestyrelsen (the Danish Tax Agency) or others who must be notified of an attachment of a receivable.
An auction house conducting the compulsory sale of an attached asset.
Credit reference agencies, for example Experian, which operates RKI (the Danish credit register) — if, after prior notice, you are registered as a defaulting payer.
Public authorities, to the extent we are required to do so by law.
Our suppliers, which process information on our behalf — for example to run our systems and to send emails and text messages.
Every disclosure is justified by the specific circumstances of the case, and only relevant and necessary information is disclosed. The recipient is bound by full confidentiality. Several of the recipients — for example lawyers, the courts and the credit reference agencies — are independent data controllers for their own processing.
Some of our suppliers — for example for sending emails — process information in the USA. That takes place on the basis of the European Commission’s decision on the EU-U.S. Data Privacy Framework or the Commission’s standard contractual clauses. Write to us if you would like to know which suppliers are involved, or to receive a copy of the safeguards.
§ 6
Retention period
We do not keep the information for longer than the purpose requires. The periods are:
The case information
Throughout the case and for 5 years after it has been closed — including your CPR number and our correspondence with you. If the case is reopened, the 5 years run from the most recent closure. While the case is open, including while it is before the courts, we do not erase the case information.
Use of emails, links and self-service
Information about how you have used our emails, links and self-service is kept for 5 years after the case has been closed.
Findings from public registers we keep track of
Each finding is erased after 12 months.
Registration with a credit reference agency
Until the claim has been paid, but no longer than 5 years. The period follows the rules that apply to credit reference agencies.
Specific legislation
Information that must be retained under other legislation is not erased until that requirement has been met — for example the documentation obligation in Bogføringsloven (the Danish Bookkeeping Act) of 5 years from the end of the financial year to which the material relates.
§ 7
Automated decisions and AI
Our system sends letters and messages and calculates interest and fees automatically according to fixed rules and deadlines. Decisions on legal steps — for example to file the case with the bailiff’s court — are always taken by a member of staff. We do not use profiling to take decisions about you.
Where we use artificial intelligence as an aid in case handling or support — for example to suggest replies to your enquiries — the framework is:
No automated decisions
AI does not take decisions in your case and is not used for profiling that affects your legal position.
A person decides
Complex or legally significant decisions — for example the handling of an objection — are always taken by a case handler, who bears the final responsibility.
Limited use of data
Only the information required to handle your case is used.
Right to a manual review
You can always ask for a case handler to review your case manually. Call us or write to us.
§ 8
Security
We protect your personal data by both technical and organisational measures — including encryption and access control. Your data is protected against accidental or unlawful destruction, loss, alteration and unauthorised disclosure or access.
We impose equivalent requirements on the suppliers that process data on our behalf.
§ 9
Public authorities
The police and other authorities may request access to information held by us. We assess each individual request under fixed internal procedures and consult our legal advisers.
We disclose only information that is strictly required by law, and only on the basis of a valid court order or an equivalent legal document.
§ 10
Your rights
Under the GDPR you also have the following rights when we process information about you:
Right of access
You have the right to access the information we process about you, together with a range of further information.
Right to rectification
You have the right to have incorrect information about you corrected.
Right to erasure
In special cases you can have information about you erased before the time of general erasure falls due.
Right to restriction
In certain cases you can have the processing of your information restricted — with the exception of storage. If you are entitled to this, we may from then on process the information only with your consent, or in order to establish a legal claim, to protect a person or to safeguard important public interests.
Right to data portability
In certain cases you have the right to receive your information in a structured, commonly used and machine-readable format and to have it transmitted to another data controller.
If you wish to exercise your rights, please contact us — see § 2 — or write to us through your case at debtor.rieckflow.com. Please write "GDPR" in the subject line. It is free of charge, and the law gives us one month to reply; we aim to reply sooner.
You can read more about your rights in the guidance on the rights of data subjects published by Datatilsynet (the Danish Data Protection Agency) at datatilsynet.dk.
§ 11
Complaints
If you are dissatisfied with our processing of your information, please contact us first — most things can be settled with a phone call. If we cannot help you, you can complain to Datatilsynet:
Complaints about proper debt collection practice are handled by Rigspolitiet (the Danish National Police), which supervises authorised debt collection agencies.
§ 12
Changes
We update the policy on an ongoing basis, among other things when the legislation changes. The policy always states the date of the most recent version. It was last updated on 4 October 2026.
Questions about your data
If there is something you do not understand, call us — even if you do owe the money.
You will reach a case handler who knows your case and can answer what you ask.
Contact us
Call on any business day or write — we reply within 2 hours on any business day.
Rieck is an authorised debt-collection firm. Rigspolitiet (the Danish National Police) supervises our compliance with god inkassoskik (proper debt-collection practice).
