Privacy Policy

This Privacy Policy governs the way GetBill collects, uses, stores and protects the personal information of users of its debt collection orchestration services, including AI telephone calls to individual and corporate debtors. By using our services, you consent to the collection and use of your data in accordance with this policy.

**PUBLISHER:** The website getbill.com is published by: GetBill company [Legal form and capital] [Registration number] Registered office: [Address] Intra-Community VAT number: [Number] Email address: contact@getbill.com **PUBLICATION DIRECTOR:** [Name and function] **HOSTING PROVIDER:** The website getbill.com is hosted by: [Name and contact details of the host]

When you browse our website or for customer relationship management, the data controller is GetBill, a company registered under number [number] in the trade and companies register of [city] and whose registered office is located at [address] ("We"). However, when we provide our services to our clients, we process personal data on their behalf and for their own purposes. Our clients therefore act as data controllers, in accordance with Article 4 of the GDPR, while we act as processors. If you have any questions, please contact our data protection officer: contact@getbill.com.

When you subscribe to our services, the following data is collected and managed: - Identification data: first name, last name, professional email address, professional phone number - Billing data: intra-Community VAT number, postal address, country - Technical data: IP address(es) and domain name, username, password - Usage data: connection and navigation data, order history, complaints, incidents, subscription information

As part of our debt collection orchestration service, we collect and process the following data concerning debtors: - Identification data: first name, last name, company name (for companies), email address, phone number - Transaction data: amount due, due date, payment history, invoice references - Communication data: collection history, AI call recordings, exchange transcripts - Behavioral data: responses to collections, communication preferences, payment commitments. Some data is collected automatically due to your activity on the site. The submitted data must not include sensitive personal data, such as government identifiers, full credit card numbers, medical records or information related to care requests.

**On the basis of performance of a contract to which you are a party:** - Provide our debt collection orchestration services - Manage customer accounts and contractual relationships - Facilitate performance, including verifications concerning you - Process transactions and payments - Enable the use of our AI call technology for telephone collections

**On the basis of our legitimate interest:** - Improve our services, content and tools - Analyze the use of our services to optimize performance - Personalize the user experience - Ensure the security of our networks and information - Prevent fraud and manage risks - Inform you about our services and promotional offers (for professional clients) - Establish statistics and performance analysis of collection campaigns

**On the basis of your consent:** - Use cookies, as described in our cookie policy - Record telephone conversations with our AI system (for debtors) - Use collected data for the purpose of improving our AI technology **On the basis of compliance with our legal obligations:** - Prevent, detect and investigate any potentially prohibited or illegal activity - Comply with legal obligations regarding data retention - Respond to the exercise of data subject rights - Comply with obligations regarding anti-money laundering and terrorism financing

Personal data concerning you collected on our website is intended for GetBill's own use and may be transmitted to GetBill's partner companies so that we can obtain assistance and support in the provision of our services. GetBill ensures that clear data protection requirements are in place for all its third-party suppliers. We do not sell or rent your personal data to third parties for marketing purposes. Furthermore, GetBill does not disclose your personal data to third parties, except if: - You (or your account administrator acting on your behalf) request or authorize their disclosure - Disclosure is required to process transactions or provide the services you have requested - GetBill is required to do so following a request issued by a government authority or regulatory body, in the case of a court decision, subpoena or any other similar request - The third party is a contractor or subcontractor of GetBill in the performance of services

**For creditor companies (GetBill clients):** - Personal data collected for service execution: during the entire duration of the contractual relationship and up to 3 years after account closure (unless otherwise provided by law) - Personal data collected to send newsletters and direct marketing: 3 years from data collection or last active contact - Personal data collected for evidential purposes: duration of the legal limitation period (generally 5 years) **For debtors (individuals and companies):** - Identification and transaction data: during the time necessary for debt collection and up to 5 years after full settlement or case closure - AI call recordings and transcripts: 6 months after the end of the collection procedure - Behavioral data: 2 years after the end of the collection procedure. If you exercise your right to object to direct marketing, we retain this information for 3 years.

The host servers on which GetBill processes and stores its databases are located exclusively within the European Union. Regarding the tools we use, your personal data may be transferred outside the European Union. The transfer of your data in this context is secured by the following guarantees: - This data is transferred to a country considered to offer an adequate level of protection by the European Commission - Or we have concluded with our subcontractors a specific contract governing the transfer of your data outside the European Union, based on standard contractual clauses approved by the European Commission

As part of its services, GetBill attaches the highest importance to the security and integrity of the personal data of its clients and debtors. Thus and in accordance with the GDPR, GetBill undertakes to take all relevant precautions to preserve data security and, in particular, to protect it against any accidental or illegal destruction, any accidental loss, any corruption, any unauthorized disclosure or access, as well as against any other form of illegal processing or disclosure to unauthorized persons. To this end, GetBill implements industry-standard security measures to protect personal data against any unauthorized disclosure, including: - Encryption of sensitive data - Strong authentication for system access - Strict access controls based on the principle of least privilege - Regular security audits - Staff training in security best practices - Continuous system monitoring to detect suspicious activities

As part of our debt collection orchestration services, GetBill uses automated systems, particularly to: - Determine the most appropriate collection strategies - Generate automated phone calls via our AI technology - Analyze debtor responses and behaviors. This activity corresponds to profiling activity leading to automated decision-making. GetBill implements this activity due to its contractual obligations to its creditor clients. You can contest the automated decision made based on this profiling by contacting our customer service at support@getbill.com.

In accordance with data protection laws and the European General Data Protection Regulation 2016/679 (GDPR), you have several rights related to the collection of your personal data: - Right to be informed - Right of access - Right of rectification - Right to restriction of processing - Right to erasure ("right to be forgotten") - Right to lodge a complaint with a competent supervisory authority (in France, the CNIL) - Right to define instructions regarding the retention, deletion and communication of your personal data after your death - Right to withdraw your consent at any time - Right to data portability - Right to object. **How to exercise your rights:** You can exercise these rights by sending us an email at contact@getbill.com. Your requests will be processed within 30 days. We may require that your request be accompanied by a photocopy of proof of identity.

GetBill uses artificial intelligence technology to make automated phone calls as part of its debt collection services. In this regard, we wish to clarify the following points: 1. **Transparency**: During each call, our AI system clearly identifies itself as a GetBill virtual assistant acting on behalf of the creditor. 2. **Consent**: Debtors are informed that the conversation is recorded and can at any time request to be connected with a human advisor. 3. **Voice data processing**: Voice recordings are used to document exchanges, improve the quality of our AI technology and resolve any disputes. 4. **Limited retention**: Voice recordings are kept for a maximum period of 6 months after the end of the collection procedure. 5. **Specific rights**: In addition to the general rights mentioned above, you have the right to request a copy of the recording, request deletion of the recording and refuse automated calls.