Last updated: November 2026
CollectOnline builds software for invoices, payment reminders and collection cases. That work involves personal data — often about people who owe money and are in a difficult position. We take that responsibility seriously.
This page explains how we approach the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”): what our role is, how we protect the data processed in our platforms, and how you can exercise your rights.
For how we handle personal data collected through this website, see our Privacy Policy. For cookies, see our Cookie Policy.
Who we are
CollectOnline NV
Potvlietlaan 5B, 2600 Antwerp, Belgium
Enterprise number: 0835.721.415
Email: hello@collectonline.eu
Our two roles under the GDPR
The GDPR distinguishes between a controller (who decides why and how personal data is used) and a processor (who processes data on the controller’s behalf). CollectOnline is both, depending on the situation.
When we are the controller
We decide how personal data is used when it concerns:
- visitors to this website;
- people who contact us, request a demo or sign up for our communications;
- contact persons at our customers and partners (for contracts, billing and support);
- job applicants.
Our Privacy Policy explains what we collect in these cases and why.
When we are the processor
Our customers — companies, finance teams, collection agencies, law firms, bailiffs and public bodies — use DunningOnline and RecoverOnline to manage their invoices, reminders and collection cases. The data about their customers and debtors belongs to them. They are the controller; we process that data only on their documented instructions, under data processing terms in line with Article 28 GDPR.
Received a reminder or collection letter?
If you received a payment reminder, collection letter, email or text message sent through one of our platforms, it was sent by the organisation you owe money to, or by the collection agency, law firm or bailiff acting on its behalf. That organisation decides how your data is used.
To ask about your data, correct it or object to its use, please contact that organisation first — its details are on the message you received.
If you contact us instead, we will refer your request to the organisation concerned. We cannot change or delete data in a customer’s account without that customer’s instruction.
How we protect data in our platforms
- Clear agreements. Our agreements with customers set out what we may and may not do with their data, as required by Article 28 GDPR.
- Access control. Customers manage their own users, roles, business units and teams, so people only see the cases and data they need.
- Security measures. We apply technical and organisational measures appropriate to the risk, to protect data against loss, misuse and unauthorised access.
- Service providers. Where we use service providers — for example for hosting or for sending emails and text messages — they are bound by a contract with the same data protection obligations. Customers can request the list of these providers.
- Confidentiality. Everyone who works with personal data on our behalf is bound by confidentiality obligations.
- Incidents. If a personal data breach affects a customer’s data, we notify that customer without undue delay, so they can meet their own obligations under the GDPR.
International transfers
Where a service provider processes personal data outside the European Economic Area, we make sure appropriate safeguards are in place, such as an adequacy decision of the European Commission or the EU Standard Contractual Clauses.
How long we keep data
Data processed on behalf of our customers is kept for as long as the customer instructs. At the end of the contract, it is returned and/or deleted in line with our agreement with that customer, unless the law requires us to keep it.
For data we control as a company, see our Privacy Policy.
Your rights
Where CollectOnline is the controller, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, where there is no longer a valid reason to keep it;
- restrict how we use your data;
- receive your data in a portable format (data portability);
- object to processing based on our legitimate interests, including direct marketing;
- withdraw your consent at any time, where processing is based on consent;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects for you.
To exercise any of these rights, email hello@collectonline.eu. We respond within one month. For complex requests this may be extended by up to two further months; we will tell you if that happens. We may ask you to confirm your identity before we act on a request.
Where we act as processor, we will pass your request on to the customer concerned and support them in responding.
Complaints
If you are not satisfied with how we handled your data or your request, please contact us first — we would like the chance to put it right.
You also have the right to lodge a complaint with a data protection authority. In Belgium, this is:
Gegevensbeschermingsautoriteit / Autorité de protection des données
Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels
contact@apd-gba.be · +32 2 274 48 00
www.dataprotectionauthority.be
You may also contact the data protection authority in the EU country where you live or work.
For customers and prospects
Need our data processing terms, the list of service providers or answers to a security questionnaire? Contact us at hello@collectonline.eu and we will help.
Changes to this page
We may update this page when our services or the law change. The date at the top shows when it was last updated.