Privacy notice – Debt collection

Version 1.0 – October 2026. This is a translation: in case of any discrepancy, the Italian version prevails.

1. Who this notice is for

This notice, provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), concerns the personal data processed by Credit Report S.r.l. in its debt collection activity, carried out under a licence pursuant to Article 115 of Royal Decree 773/1931 (TULPS) issued by the Questura (Police Headquarters) of La Spezia.

It is addressed to the individuals involved in a collection case: debtors, guarantors and co-obligors, heirs, and anyone who contacts us on behalf of the debtor (family members, authorised representatives, lawyers).

The role of Credit Report depends on the debt:

• Debts owned by Credit Report, purchased through assignment: Credit Report is the data controller.

• Debts managed on behalf of third parties: the data controller is the creditor who entrusted us with the case. Credit Report acts on its behalf as processor, or sub-processor (Article 28 GDPR), following its instructions. The main privacy notice is the creditor's; this one describes how we operate.

2. Data controller and DPO

For debts managed on behalf of third parties, the controller's contact details are given in the communications received by the data subject. Requests sent to Credit Report about those debts are forwarded to the controller.

3. What data we process and where it comes from

• Identification and contact data: name, tax code, address, telephone, email.

• Data about the debt: amount, origin, contract, payments, communications and agreements made.

• Data needed to trace the debtor and to assess whether the debt can be recovered: residence, updated contact details, employment, assets.

• Content of telephone conversations, when they are recorded or transcribed (section 6).

Sources: the original creditor or the creditor we work for; the data subject; public sources (registry offices, business register, land and property registers, Public Vehicle Register, register of protested bills); publicly accessible sources; business information services provided by Credit Report under its Article 134 TULPS licence or by authorised suppliers, as described in the notice "Business information and private investigations".

We do not process special categories of data (health, ethnic origin, political opinions, religious beliefs, sex life, genetic or biometric data), nor data on criminal convictions. If the data subject spontaneously gives us information of this kind, for example to explain a difficulty in paying, we only record what is necessary to handle the request.

4. Why we process the data and on what legal basis

We do not ask for the data subject's consent: processing is based on the conditions shown in the table. For debts managed on behalf of third parties, the legal basis is that of the creditor acting as controller.

Data collected through a business information service, for example a traced address, may also be used to collect the debt of the same creditor.

We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning the data subject or similarly significantly affect them (Art. 22 GDPR).

5. How we contact the data subject

We may contact the data subject by letter, registered letter, PEC (certified email), telephone, SMS, email and WhatsApp, using the contact details provided by the creditor, by the data subject or found in the sources listed in section 3.

• We do not disclose the existence or content of the case to third parties, such as family members, neighbours or colleagues. Before discussing the case we check that we are speaking with the data subject.

• Letters are sent in sealed envelopes, with no external indication of their content.

• Contacts take place on reasonable days and at reasonable times, with a frequency proportionate to the case.

6. Call recording

Incoming and outgoing telephone calls may be recorded and transcribed. The data subject is informed of this during the call.

• Purposes: documenting the agreements made, monitoring service quality and the correct operation of the systems used, defending the controller's rights in the event of disputes.

• Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR).

• Recipients: authorised Credit Report staff and, on request or in the event of a dispute, the creditor acting as controller; in the event of litigation, the controller's lawyers and the judicial authorities. Recordings are not disclosed.

• Retention: audio recordings and transcripts are kept together with the case, for the same periods set out in section 8, because they document the agreements made and the way the case was handled. Calls with persons unrelated to the case, for example a wrong number, are deleted within 6 months.

7. Who we share the data with

The data is not disclosed to the public. It may only be shared:

• with the creditor who owns the debt, for debts managed on behalf of third parties;

• with anyone who buys the debt or is considering buying it, and their advisers, in the event of an assignment; for debts purchased by Credit Report, with the assigning creditor, to the extent necessary to manage the debt;

• with the lawyers assisting the controller, the courts and bailiffs, in legal proceedings, and with third parties involved by law in enforcement proceedings, such as the employer or the bank in an attachment of earnings or of a bank account;

• with the banks and intermediaries that handle payments;

• with the authorities and with anyone entitled to receive it by law;

• with suppliers providing services on our behalf, appointed as processors (Article 28 GDPR): postal and delivery services, telephony, sending of SMS and email, WhatsApp, management of IT systems.

Where the data is processed. The case management system is hosted on servers at our office in Santo Stefano di Magra; the other systems on servers in the European Union. Some messaging services may involve processing data outside the European Union; in these cases the transfer only takes place to countries covered by an adequacy decision of the European Commission or with the safeguards provided by Articles 46 et seq. GDPR.

8. How long we keep the data

When these periods expire, the data is deleted or anonymised.

9. Rights of the data subject

The data subject may request access to their data and the correction of inaccurate or incomplete data.

The GDPR also provides for the right to request erasure and restriction of processing and to object to processing (Articles 17, 18 and 21). As long as the debt has not been extinguished, these rights do not normally apply: the controller needs the data to protect its claim and, if necessary, to enforce it in court, and in these cases the law excludes erasure and objection (Article 17(3)(e) and Article 21(1) GDPR). After the debt has been extinguished, the data is kept only for the periods set out in section 8.

For debts managed on behalf of third parties, requests must be addressed to the creditor acting as controller; those received by Credit Report are forwarded to the controller.

Requests must be made in writing, by email or PEC, to the contact details in section 2, enclosing an identity document. Anyone acting on behalf of the data subject must also enclose a signed authorisation. We do not act on requests made by telephone or where the identity of the requester cannot be verified.

The data subject always has the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

10. Legal references

• Regulation (EU) 2016/679 (GDPR), in particular Articles 6, 13, 14, 15–22 and 28.

• Legislative Decree 196/2003 (Italian Privacy Code).

• Royal Decree 773/1931 (TULPS), Article 115.

• Italian Data Protection Authority, general decision "Lawfulness, fairness and relevance in debt collection activities" of 30 November 2005.