§ 1Introduction
Rieck Inkasso helps organisations collect money owed to them. This privacy policy applies to you if you are a debtor in a debt collection case with us.
We are the data controller for all the information we process about you in connection with the case. We are an authorised debt collection agency, we work in accordance with proper debt collection practice (god inkassoskik), cf. chapters 2 and 4 of Inkassoloven (the Danish Debt Collection Act), and we are supervised by Rigspolitiet (the Danish National Police).
The policy also applies to any legal proceedings that may arise out of the collection case.
§ 2Contact details
The data controller is the party that determines the purposes for which, and the means by which, personal data may be processed. The data controller is:
- Company
- RIECK INKASSO ApS
- Address
- Østergade 4, st., 8370 Hadsten
- Company reg. no.
- 41645369
§ 3Purpose and legal basis
The purpose of processing information about you is to obtain payment of our client’s outstanding claim. We do not use the information for any other purpose.
We obtain ordinary master data, including your CPR number (Danish civil registration number), so that we can identify and locate you if that becomes necessary. In that connection it may become necessary to levy execution against your assets and to demand that they be sold at a compulsory auction.
The legal basis is Article 6(1)(f) of the General Data Protection Regulation (GDPR) — processing necessary for us or our client to pursue a legitimate interest. Our client’s interest in being paid carries substantial weight, and the procedure laid down in the Danish debt collection legislation ensures that your fundamental rights and freedoms are not overridden.
Where it is necessary in the individual case to process special categories of data — for example health data — the basis is Article 9(2)(e) and (f): data you have manifestly made public yourself, or processing necessary for the establishment, exercise or defence of legal claims.
Your prior consent is therefore not required.
§ 4The information we process
We process only the information that is relevant to the recovery of the debt. That may include:
- Identification and contact
- Name, address, email, telephone number and CPR number.
- Financial circumstances
- Information about the debt and about your other financial circumstances, including information from public sources.
- Employment and social circumstances
- To the extent they bear on your ability to pay or on the recovery of the debt.
- Special categories
- Health data and any criminal law matters — only where strictly necessary in order to establish the claim or carry out the recovery, or where you have made them public yourself or provided them to us, to our representative or to our client.
The information comes from you — in writing, in telephone conversations or during court hearings — from our client, to whom you owe the money, from others with knowledge of your circumstances, for example a lawyer, and from public registers and other publicly available sources.
If we receive information about you from others, we will tell you so at our first contact with you thereafter — where appropriate by referring you to this policy.
§ 5Recipients of personal data
While the case is being handled, it may become necessary to disclose information about you to:
- The creditor — our client, to whom you owe the money.
- The courts, if the case is to be brought before the bailiff’s court (enforcement court), the civil court or the probate and bankruptcy court.
- Approved debt collection agents.
- Lawyers or others appearing in court on our behalf.
- A haulier, a locksmith or other tradespeople engaged in connection with an enforcement case.
- Your landlord, Skattestyrelsen (the Danish Tax Agency) or others who must be notified of an attachment of a receivable.
- An auction house conducting the compulsory sale of an attached asset.
- Credit reference agencies, including the Danish credit register (RKI), in accordance with the applicable rules.
- Public authorities, to the extent we are required to do so by law.
Every disclosure is justified by the specific circumstances of the case, and only relevant and necessary information is disclosed. The recipient is bound by full confidentiality. Several of the recipients — for example lawyers and the courts — are independent data controllers for their own processing.
We use external data processors, for example for hosting, and we have entered into data processing agreements with them. No personal data is sent to recipients outside the EU.
§ 6Retention period
The information is erased once it is no longer necessary for the purpose. It is not possible to state precisely how long that is — it depends on the individual case, including whether we risk facing a claim arising from our handling of it. The following periods are indicative:
- 5 years
- As a general rule we retain the information, including the CPR number, for up to 5 years after the collection case has been closed.
- 10 years
- Depending on the specific circumstances, we may retain the information for 10 years after the case has been finally closed — for example where the claim has been established by judgment, by settlement or by a payment order endorsed by the bailiff’s court, or where payment can only be realised at a later date, cf. Forældelsesloven (the Danish Limitation Act).
- Specific legislation
- Information that must be retained under other legislation is not erased until that requirement has been met — for example the documentation obligation in Bogføringsloven (the Danish Bookkeeping Act) of 5 years from the end of the financial year to which the material relates.
Information that forms part of court proceedings or another legal dispute is not erased until the case has been finally concluded and a reasonable period thereafter has elapsed.
§ 7Use of AI in case handling
We use artificial intelligence as an aid in case handling and support — to handle cases faster, not to handle them without people. The framework is:
- No automated decisions
- AI does not take decisions in your case and is not used for profiling that affects your legal position.
- A person decides
- Complex or legally significant decisions — for example the handling of an objection — are always taken by a case handler, who bears the final responsibility.
- Limited use of data
- Only the information required to handle your case is used. Your information is not used to train AI models.
- Right to a manual review
- You can always ask for a case handler to review your case manually. Call us or write to us.
§ 8Security
We protect your personal data by both technical and organisational measures — including encryption and access control. Your data is protected against accidental or unlawful destruction, loss, alteration and unauthorised disclosure or access.
We impose equivalent requirements on the suppliers that process data on our behalf.
§ 9Public authorities
The police and other authorities may request access to information held by us. We assess each individual request under fixed internal procedures and consult our legal advisers.
We disclose only information that is strictly required by law, and only on the basis of a valid court order or an equivalent legal document.
§ 10Your rights
Under the GDPR you have a number of rights when we process information about you:
- Right of access
- You have the right to access the information we process about you, together with a range of further information.
- Right to rectification
- You have the right to have incorrect information about you corrected.
- Right to erasure
- In special cases you can have information about you erased before the time of general erasure falls due.
- Right to restriction
- In certain cases you can have the processing of your information restricted — with the exception of storage. If you are entitled to this, we may from then on process the information only with your consent, or in order to establish a legal claim, to protect a person or to safeguard important public interests.
- Right to object
- You have the right to object to our processing of your information.
- Right to data portability
- In certain cases you have the right to receive your information in a structured, commonly used and machine-readable format and to have it transmitted to another data controller.
If you wish to exercise your rights, please contact us — see § 2. Please write "GDPR" in the subject line. The law gives us one month to reply; we aim to reply sooner.
You can read more about your rights in the guidance on the rights of data subjects published by Datatilsynet (the Danish Data Protection Agency) at datatilsynet.dk.
§ 11Complaints
If you are dissatisfied with our processing of your information, please contact us first — most things can be settled with a phone call. If we cannot help you, you can complain to Datatilsynet:
- Authority
- Datatilsynet (the Danish Data Protection Agency)
- Address
- Borgergade 28, 5., 1300 København K
Complaints about proper debt collection practice are handled by Rigspolitiet (the Danish National Police), which supervises authorised debt collection agencies.
§ 12Changes
We update the policy on an ongoing basis, among other things when the legislation changes. The policy always states the date of the most recent version. It was last updated on 12 July 2026.
