Privacy policy.
This English translation is provided for convenience. The French version (version française) prevails in the event of any discrepancy.
Last updated: 12 October 2026
Himilco attaches particular importance to the protection of personal data. This policy describes the processing carried out, its purposes, its legal bases and the rights available to the data subjects.
It is addressed to three categories of people: website visitors, creditor clients and their contacts, and people who are the subject of a debt collection procedure. This last category has its own dedicated section.
1. Data controller
HIMILCO, SASU with share capital of €200
61 rue de Lyon, 75012 Paris · Paris Trade and Companies Register (RCS) 938 049 301
Contact: recouvrement@himilco.eu
Himilco has not appointed a data protection officer, as such an appointment is not mandatory given the nature and size of its business. All requests should be sent to the address above.
2. Data processed and purposes
2.1 Website visitors
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Contact form: name, company, e-mail, telephone, message | Responding to enquiries | Legitimate interest | 3 years after the last contact |
| Browsing and audience measurement data | Measuring traffic, improving the website | Consent | 13 months maximum |
2.2 Creditor clients
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Company identity, contacts' details, SIRET number, bank details | Performance of the mandate, invoicing | Performance of the contract | Duration of the relationship, then 5 years |
| Supporting documents for the claims | Proof of the claim, collection action | Performance of the contract | 5 years after the case is closed |
| Accounting documents and invoices | Accounting and tax obligations | Legal obligation | 10 years (Art. L123-22 of the French Commercial Code) |
2.3 People subject to debt collection
This section concerns debtors, whether individuals or representatives of legal entities, whose debt has been entrusted to Himilco.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Identity, postal, telephone and electronic contact details | Making contact, amicable collection | Legitimate interest of the creditor in recovering its claim | Duration of the collection, then 5 years |
| Amount, nature and due date of the claim, payment history | Monitoring and substantiating the claim | Legitimate interest | 5 years after closure |
| Written exchanges, call reports, payment commitments | Proof of the steps taken and of commitments | Legitimate interest | 5 years after closure |
| SMS and RCS messages: number, content, delivery and read statuses, replies and button clicks | Reminders, information about the case, sending the payment link | Legitimate interest | 5 years after closure |
| Recordings of telephone calls | Proof of commitments, quality control, training | Legitimate interest | 12 months maximum |
| Financial situation from public sources | Assessing solvency, adapting payment terms | Legitimate interest | Duration of the collection, then 5 years |
Source of the data. Where data is not collected directly from the data subject, it comes from the creditor who entrusted the claim, or from public sources: the national register of companies (registre national des entreprises), the INSEE SIRENE register, annual accounts filed with the commercial court registries, and the Bulletin officiel des annonces civiles et commerciales (French official gazette of civil and commercial notices). In accordance with Article 14 of the GDPR, data subjects are informed of this at the first contact.
Call recording. Telephone calls may be recorded. Anyone called is informed of this at the start of the call and may object to the recording, without this preventing the conversation from continuing.
SMS and RCS messages. Messages sent to data subjects are service messages related to the case; their terms are set out in the legal notice. The person may object to them at any time by replying STOP, without this preventing the collection from continuing by other means.
No automated decision-making. No decision producing legal effects is taken solely on the basis of automated processing. Solvency analyses are elements of assessment subject to human intervention.
2.4 Company solvency analysis
Himilco provides its business clients with a solvency analysis service covering legal entities, based on public data: annual accounts filed with the court registries, notices published in the BODACC and data from the SIRENE register.
These analyses concern companies and not individuals. Where a sole proprietorship is concerned, data relating to the entrepreneur as an individual is not displayed.
Each consultation is logged (client identifier, number consulted, date) for 5 years, in order to be able to respond to any access request from a data subject.
3. Recipients and processors
The data is accessible to authorised Himilco staff and, as required, to the following service providers:
| Provider | Role | Location |
|---|---|---|
| OVH SAS | Hosting of the website and applications | France |
| Google Ireland Ltd (Workspace) | Business e-mail | European Union, with possible transfers to the United States |
| Google Ireland Ltd (Analytics, Search Console) | Audience measurement and search referencing | Transfer to the United States |
| Allo | Telephony, call recording and sending of SMS | European Union |
| Qonto (Olinda SAS) | Banking services and SEPA direct debits | France |
| Mollie B.V. | Collection of subscription payments | Netherlands |
| Brevo (Sendinblue SAS) | Sending of e-mails | France |
| Amazon Web Services EMEA SARL (AWS End User Messaging) | Sending of RCS messages | European Union (Paris region) |
| Google (RCS for Business platform) and mobile operators | Delivery of RCS messages to the recipient's telephone | European Union, with possible transfers to the United States |
The data may also be disclosed to officers of the court, commissaires de justice (French judicial officers) and lawyers in the context of legal proceedings, and to administrative or judicial authorities upon official request.
No data is sold, rented or transferred to third parties for commercial purposes.
4. Transfers outside the European Union
Some processing involves a transfer of data to the United States, in particular the use of Google Analytics and Google Workspace.
These transfers are governed by the European Commission's adequacy decision of 10 July 2023 on the Data Privacy Framework, Google LLC being certified under this framework, and by the European Commission's standard contractual clauses.
Data relating to debt collection cases, claims and people subject to collection is hosted in France, with OVH. RCS messages are sent by AWS from its Paris region; their delivery to the recipient's telephone goes through Google's RCS for Business platform and the mobile operator, which may involve a transfer to the United States, governed by the Data Privacy Framework and by the European Commission's standard contractual clauses.
5. Cookies and trackers
- Strictly necessary cookies for the operation of the website and session security. They do not require consent.
- Audience measurement cookies (Google Analytics), set only after consent has been obtained, and kept for a maximum of 13 months.
Consent may be withdrawn at any time via the cookie management banner or the browser settings.
6. Security
Himilco implements appropriate technical and organisational measures: encryption of communications (HTTPS), access control through authentication and role management, logging of access to sensitive data, regular backups, and hosting with a European provider.
7. Rights of data subjects
Everyone has the following rights: access, rectification, erasure, restriction of processing, objection, and portability where the processing is based on the contract or on consent.
These rights may be exercised by contacting: recouvrement@himilco.eu
A response is provided within one month, which may be extended by two months for complex requests. Proof of identity may be requested where there is reasonable doubt about the identity of the person making the request.
Limits specific to debt collection. The right to erasure cannot be exercised while the data is necessary for the establishment, exercise or defence of legal claims, or for compliance with a legal obligation. An unpaid claim therefore cannot be erased simply at the debtor's request.
Anyone may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL, French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
8. Data from connected Google accounts
When a client connects their Google e-mail account to the Himilco application, the authorisation requested is strictly limited to sending messages on their behalf (gmail.send). Himilco does not access or read the content of their inbox.
The use of data obtained from Google APIs complies with the Google API Services User Data Policy, including the limited use requirements (Limited Use). This data is not sold, not used for advertising purposes, nor passed on to third parties, and is used exclusively for the feature for which the authorisation was granted.
The connection may be revoked at any time from the client portal or from the Google account settings.
Google data retained and retention periods
| Data | Purpose | Retention |
|---|---|---|
| OAuth access and refresh tokens | Allowing messages to be sent on the user's behalf | Duration of the connection. Deleted immediately and permanently upon revocation or deletion of the account |
| E-mail address of the connected account | Identifying the sender of the reminders | Duration of the connection, then immediate deletion |
| Technical identifier of sent messages | Proof of sending in the event of a dispute | 5 years, in line with the limitation period of Article 2224 of the French Civil Code |
No inbox content is viewed, transmitted or stored. The authorisation requested is limited to sending (gmail.send). Himilco has no read access whatsoever to the user's mailbox.
Revoking the connection results in the immediate and irreversible deletion of the tokens and the associated address. It may be requested at any time from the client portal, from the Google account settings, or by e-mail to recouvrement@himilco.eu.
Artificial intelligence and Google data
Himilco uses a language model that is exclusively self-hosted (qwen2.5:3b, run via Ollama) on its own server, in France, with OVH. Processing is carried out locally: no data is transmitted to a model provider, and no call is made to any third-party artificial intelligence service.
This model is used for character recognition on invoices submitted by clients and for summarising debt collection cases. It never processes data obtained from Google APIs.
In accordance with the Google API Services User Data Policy and the limited use requirements, data obtained through Google APIs is not used, transferred or sold to create, train or improve any machine learning or artificial intelligence model, whether general-purpose or specialised.
9. Changes
This policy may be amended to reflect legal, technical or organisational changes. The date of the last update appears at the top of the document.
One claim, or your whole ledger.
Start with the claim that weighs on you most, or hand us the lot. Either way, five minutes is enough, and you judge us on the results.
Free, with no commitment. You are only charged on the sums we recover.