Privacy Policy

This policy describes GetBill's processing for its website and business relationships, and its role in the collection services provided to clients. For debtor files entrusted by a client, that client determines the purposes and rules of processing; GetBill acts as a processor within the agreed scope.

**PUBLISHER:** GetBill SAS, registered under SIRET 941 074 098 00018, with its registered office at 22 rue Barrault, 75013 Paris, France. Contact: contact@getbill.io. **PUBLICATION DIRECTOR:** Joachim Mercier. **HOSTING PROVIDER:** Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg.

GetBill is the controller for processing related to its website and its relationships with clients and prospects. For debtor files entrusted to the platform, the relevant client is the controller and GetBill processes the data on its behalf. Contact GetBill about data protection at contact@getbill.io.

When you subscribe to our services, the following data may be processed: - Identification data: first and last name, professional email address and phone number - Billing data: VAT number, postal address and country - Technical data: IP addresses, domain name, account identifier and authentication data - Usage data: login and navigation records, orders, complaints, incidents and subscription information.

Depending on the services enabled, files provided by a client may contain identities, contact details, debt references and amounts, collection history and payments. Calls may produce a recording and a transcript needed to conduct the conversation and check service quality. GetBill does not currently retain a transcript corpus to improve scenarios across clients. A person may spontaneously disclose sensitive information during a conversation; such information is not requested to provide the service.

For processing controlled by GetBill, data needed to manage client accounts and provide the service is processed on the legal bases applicable to the relationship concerned. For debtor files, the client controller defines the purposes and legal basis; GetBill carries out the agreed instructions.

When GetBill is the controller, its legitimate interests may support service security, abuse prevention, and improvements to its website and commercial relationship, subject to individuals' rights. Data in client files is not reused for GetBill's own cross-client improvement purposes without specific written authorization from the relevant controller.

Cookies requiring consent are used according to the choices made on the website. Call recording, notices to individuals and other processing of debtor files are defined with the client controller under the applicable legal basis. GetBill also processes data needed to meet its legal obligations and assist with data subject requests.

GetBill shares data with technical suppliers needed to provide the service and, for debtor files, within the scope agreed with the client controller. GetBill does not sell or rent personal data to third parties for their marketing. Suppliers that may be used and their roles are listed in the supplier documentation; applicable processing agreements are available on request. Disclosures required by law are handled under the applicable rules.

Debt files are not automatically deleted because of their age: clients can delete them in the interface or ask GetBill to do so, subject to their obligations and agreed instructions. Audio in the main storage currently expires after 180 days for current objects; previous versions may remain for 180 days after replacement or deletion. A 180-day limit covering all versions has not yet been activated. A daily job requests deletion of Retell calls once they reach seven days, with possible deferral if a required local archive is missing; this request does not prove deletion of backups or copies held by its subprocessors. Quality-control reports are purged after 30 days. Previews and exports are cleaned up by the application after seven days, their storage copies expire after 14 days for current objects, followed by one day after replacement for previews and 14 days after replacement for exports. Automatic database backups have a 30-day retention period; recurring expiry of manual snapshots after 30 days has not yet been activated. Other categories follow the applicable contractual periods and obligations.

The main application infrastructure is hosted in the AWS Paris region. Some suppliers involved in the service may process or access data outside the European Economic Area. Relevant transfers are governed by the mechanisms in the applicable agreements, including standard contractual clauses where used. The supplier list and applicable contractual documents may be requested from GetBill.

GetBill applies measures suited to service risks: encryption at rest and in transit, role-based access control, logging, backups and incident handling. Each client company may require multifactor authentication for its users. An external penetration test was conducted in July 2026. Detailed measures are described in the supplier documentation.

The platform may automate collection steps and use a voice agent according to rules agreed with the client. Decisions with financial or legal effects follow the rules and approvals defined for each service. To dispute a collection contact or request human intervention, contact the creditor named in the message or write to contact@getbill.io so that your request can be forwarded.

You may request access, rectification, erasure or restriction of your data, object to certain processing, request portability where applicable, and complain to the CNIL. For data in a file entrusted to GetBill, the relevant client is responsible for the response; GetBill assists under the agreed instructions. You may write to contact@getbill.io or use the website form. Access and erasure requests are reviewed with the client controller before any client file is disclosed or changed. Additional identity evidence is requested only when identity cannot otherwise be established. Responses are provided within the applicable legal time limits.

The voice agent identifies its artificial nature and uses the identity agreed with the client. Advance notice, contact channels and recording rules depend on the service. Transfer or live takeover by a human is configurable by the client, which arranges available advisers and their working hours. Available audio is used to document exchanges, check service quality and examine client feedback. Bugs reported through the portal follow a technical process separate from data subject requests. Any reuse to improve services depends on the applicable agreements; where an agreement excludes all secondary use, that exclusion also covers data described as anonymized. GetBill does not currently fine-tune models. Voice-chain suppliers are not authorized to train their models on entrusted data.

GetBill has an incident-management procedure and an annual control plan. A restoration test dated 2 September 2026 and an access review dated 4 September 2026 are documented. The external VAADATA penetration test of July 2026 and the remediation of its recommendations are confirmed by the CTO; no second audit has been performed at this stage. GetBill is insured, as confirmed by management; coverage is governed by the applicable policy. Quality-review tools are available; formalization of the quality system and AI documentation is targeted for Q1 2027, and non-discrimination testing for Q2 2027. These targets do not attest that the controls have already been performed. Risk assessment and assessment of AI uses are adapted to each client's scope.