Data processing and suppliers

Sub-processors

Revised4 October 2026 In force from4 October 2026

The suppliers that process personal data on our behalf when you use the portal. The list is annex B to the data processing agreement, and changes are notified before a new supplier is put to use.

§ 1

About this list

Rieck uses a number of suppliers to run the portal — for hosting, operations, dispatch of email and physical letters, payment processing and support. They process personal data on Rieck’s behalf and are known as sub-processors.

This list is annex B to the data processing agreement and constitutes the general authorisation the client grants under § 6 of that agreement. It covers the suppliers that process information in the portal. Where Rieck is a processor for the client — customer due diligence and bills, cf. § 2 of the data processing agreement — they are sub-processors. Where Rieck is an independent controller for the information about the client’s debtors, the same suppliers are Rieck’s own processors.

Suppliers that Rieck uses as an independent controller in collection cases — collection agents, lawyers, hauliers, auction houses, credit reference agencies — do not appear here. They are set out in § 5 of the privacy policy for debt collection.

The list describes vendor processing and transfer safeguards. Mistral’s location information was checked against its Trust Center on 30 September 2026. Actual processing depends on the features used.

§ 2

Current sub-processors

Vendor	Purpose	Location	Transfer basis
Supabase Pte. Ltd. (Singapore), part of Supabase, Inc. (Delaware, USA)	Database, user accounts and file storage	Processed in Paris; the processor is established in Singapore and the group is US-owned	European Commission Standard Contractual Clauses (Decision (EU) 2021/914), modules 2 and 3, per the vendor’s data processing addendum
Microsoft Ireland Operations Limited (Ireland)	Reading the company’s shared mailboxes (incoming post)	EU/EFTA under Microsoft’s EU Data Boundary	European Commission Standard Contractual Clauses (Decision (EU) 2021/914) for such transfers to third countries as occur; Microsoft is also certified under the EU-US Data Privacy Framework
AC PM LLC (ActiveCampaign, USA)	Sending email	USA — Deft outside Chicago and AWS. Postmark offers no EU data location	European Commission Standard Contractual Clauses (Decision (EU) 2021/914), modules 2 and 3; AC PM is also certified under the EU-US Data Privacy Framework
No Ink AB (Ekopost, Sweden)	Printing and dispatch of physical letters	Sweden	Not applicable — EU
Telnyx LLC (USA)	Telephony and call recordings	Processed in Amsterdam; the vendor is established in the USA	European Commission Standard Contractual Clauses (Decision (EU) 2021/914)
Mistral AI (France, reg. no. 952 418 325)	AI assistance in case handling	EU/EEA by default. Infrastructure includes France, Sweden and Norway; other subprocessors may process data in the USA or globally depending on the feature. See trust.mistral.ai/subprocessors	Mistral is established in the EU. Transfers outside the EU/EEA use the safeguards described in Mistral’s data processing addendum, including European Commission Standard Contractual Clauses (Decision (EU) 2021/914) where no adequacy decision applies.
OVH SAS (Roubaix, France)	Server operations	France (Roubaix) — the RBX2 data centre	Not applicable — EU

For each supplier the table shows what it is used for, where the processing takes place, and — if information is processed outside the EU/EEA — the basis on which the transfer occurs.

§ 3

Vendors outside the portal

Rieck also operates a copy of public property and business registers. It is not part of the portal, and Rieck is an independent controller for it — not a processor for the client. That processing is described in the privacy policy for register data.

The copy is held on a server operated by OVH SAS in Roubaix, France. It does not leave the EU/EEA, and information from it is not stored in the portal — it is fetched on lookup and displayed without being retained along the way.

§ 4

Changes and objections

Rieck gives at least 30 days’ notice of new and replaced sub-processors before they are put to use. Notice is given on this page and by email to the client’s registered contact address.

The client may object before the notice period expires by writing to us. If we cannot find a solution, the client may terminate the use of the affected parts of the portal at no cost, cf. § 6 of the data processing agreement.

Rieck is liable for the sub-processors’ processing as for its own and has entered into a written data processing agreement with each of them.

Questions about the terms

Shall we take you through them
before you sign?

Call us, and an advisor will go through them with you — including the ones that are not in your favour. Better that you know now than in the first case.

Talk to an advisor

Call on any business day or write — we reply within 2 hours on any business day.

35 15 47 65 rieck@rieckflow.com

See the pricing

Subscriptions, card price and success fee are itemised in the price matrix. The terms of business refer to the price overview for the card price.

Pricing

Complain about collection conduct

Rieck is an authorised debt-collection firm. Rigspolitiet (the Danish National Police) supervises our compliance with god inkassoskik (proper debt-collection practice).

politi.dk