Privacy Statement Ultimoo B.V.

Last updated: July 1, 2026

Ultimoo B.V. and its affiliated companies attach great importance to the protection of your privacy and personal data. In this privacy statement, we provide insight into how we collect, process, and secure personal data, and what rights you have regarding your data.

1. Personal data that is collected and processed

We collect and process personal data, such as name, date of birth, address, telephone number, and financial data, if necessary for the processing of your requests, claims, or communication. In accordance with the applicable privacy legislation (the General Data Protection Regulation, GDPR), we inform you about the processing of personal data and other relevant data. We process the following categories of personal data and information:

Personal details:

Name
Address
Telephone number
Email address
Date of birth

Financial information:

Debts
Outstanding amounts
Payment history
Bank account information

Complaints:

Complaint letters, emails, or phone calls
Complaint registration and follow-up

Complex files:

All relevant data, including identification data, financial statements, communication, and any legal documents

Legal documents:

Legal summons
Judgments
Court rulings
Legal correspondence
Evidence in legal cases

Credit information:

Credit reports and debtor assessments
Risk assessments: Evaluation of the likelihood of debt repayment
Reports on debt collection activities: Performance, status of outstanding claims, payment behavior of debtors
Monitoring data to oversee the efficiency of debt collection procedures

Personnel data:

Name, date of birth, address, nationality, contact details
Details of the employment contract
Payroll and financial information
Employee contact information
Contract details related to the claims
Job application data
Employee assessments and evaluations
Data regarding the health status of employees
Legal issues, such as dismissal procedures, occupational accident reports, disciplinary measures

Security data:

Identification data
Access rights
Access logs
Sensitive data
Information about security settings and incidents

2. Legal bases

The processing of personal data takes place based on legal bases, including legitimate interest and the necessity for legal claims. Specific legal bases are not mentioned in this statement.

Performance of a contract: Personal data may be processed if this is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to concluding a contract.
Legal obligation: If the processing of personal data is necessary to comply with a legal obligation to which the controller is subject, this is a valid legal basis.

3. Automated decision-making

There is no automated process. Your application is assessed by a human debt collection specialist. This professional adds human insights to the decision-making process and can assess additional information, such as the purpose of the loan, the analysis of financial data, and your personal circumstances.

Decision-making: The final decision regarding your credit request is made based on the assessment of our human file handler. This approach ensures that we can make a well-considered decision that takes both objective data and human insights into account.

4. Retention periods

We do not store your personal data longer than is strictly necessary to achieve the goals of our service, for which your data is collected. For administrative and tax purposes, we apply a statutory retention period of 7 years. After these periods, the data will generally be deleted or anonymized.

Personal data is stored for as long as necessary for the full handling of requests, claims, and communication, based on the nature of the request and statutory retention periods.

5. Your rights as a data subject

You have the right to access, correct (in case of inaccuracies), and/or delete (right to be forgotten) your personal data. In addition, you have the right to withdraw any consent for data protection or to object to the processing of your personal data. You can also submit a request for data portability, in which we transfer the data to you in a structured, commonly used format. Requests can be submitted via avg@ultimoo.nl.

6. Sharing with third parties

We use third parties (processors) for the processing of personal data. Personal data is only shared with third parties if this is necessary for the performance of agreements or to comply with legal obligations, for example with bailiffs and lawyers. We conclude processing agreements with these parties to ensure that they handle your data carefully and in accordance with the General Data Protection Regulation (GDPR). Finally, data is under no circumstances sold to third parties.

7. Security measures

We take appropriate technical and organizational measures to prevent misuse, loss, unauthorized access, and other unwanted actions with personal data. Our security measures include:

Compliance with laws and regulations
Physical security measures for people, assets, and confidential information
Measures against ransomware
Restricting access to authorized employees
Reporting and evaluation of security incidents
Regular firewall updates
High employee awareness regarding the protection of personal data

8. Cookies

For this, you can consult the cookie statement on our website.

9. Other

You can submit your requests regarding the retention and/or processing of your personal data via avg@ultimoo.nl. We apply a response period of a maximum of 4 weeks. In some cases, we may ask you to identify yourself to ensure the safety and confidentiality of your data.

If you believe that your rights regarding your personal data are being violated, you always have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We emphasize that this privacy statement complies with the requirements of the General Data Protection Regulation (GDPR) and the GDPR Implementation Act. Ultimoo B.V. reserves the right to update this privacy statement if necessary.