- Prospect Data concerning our prospective customers, partners or individuals who visit our websites such as https://tipalti.com, https://www.approve.com, and their respective subdomains (collectively, the “Sites”) and interact with our online forms, or engage with our online ads and content, social media interactions (e.g. Facebook, LinkedIn, Twitter), emails or other communications under our control, or participate in events that we organize or take part in (collectively, “Prospects”);
- Customer User Data concerning individuals (“Customer’s Users”) who use Tipalti’s cloud platform and related services (the “Services”) on behalf of our business customers (“Customers”);
- Payee Data concerning individuals to whom (personally, or for their employer; “Payee Users”), following sign up, payments are made via the Services;
- Supplier Data concerning individuals (“Supplier’s Staff”) employed by suppliers of a Customer, or other individuals, that interact with the Services, whether or not payments are made to such suppliers or individuals.
- Data Collection
- Data Uses
- Data Location
- Data Retention
- Data Sharing
- Cookies and Tracking Technologies
- Data Security
- Data Subject Rights
- Data Controller/Processor
- Additional Information and Contact Details
1. DATA COLLECTION
How We Collect. We collect, receive, and process Personal Data about you through:
- Your interaction with us, our Sites, or our Services;
- From our Customers, who provide us with Customer Data and in some cases, Payee Data;
- Through third-party services and providers, such as business partners, credit bureaus, social media tools, analytics and other publicly available sources; and
- Events we organize or take part in, and other business initiatives (including partner promotions, communications, and events).
What We Collect. We collect, receive, and process the following Personal Data about you:
- Website usage information: technical and aggregated usage data, such as user agent, IP addresses, device data (like type, OS, device id, browser version, geolocation and language settings used), connectivity data, activity logs, session recordings, and the cookies and pixels installed or utilized on our Sites or your device;
- Prospect account information: contact and business details (full name, email address, company name and phone number) of our prospective customers and partners, which may also contain the details of their relevant internal focal persons; our communications with such Prospects (correspondences, call and video recordings and transcriptions, and analyses thereof), as well as any needs, preferences, attributes and insights relevant to our potential engagement.
Customer User Data:
- Account login information: e-mail address and, when applicable, hashed password or other information used for authentication and access control;
- Profile and contact information: full name, title, company name, e-mail and phone number, profile picture, social media accounts, role, and additional information and media submitted by Customer’s Users or their organization;
- Platform usage information: technical usage data, such as user agent, IP addresses, device data (like type, OS, device id, browser version, geolocation and language settings used), connectivity data, activity logs, session recordings, and the cookies installed or utilized on the Customer’s User’s device; and
- Direct interactions and communications with us: including recordings and transcripts of your calls and correspondence with us, e.g. for user enablement, support and training purposes.
- Account login information: e-mail address and, when applicable, hashed password or other information used for authentication and access control.
- Profile and contact information: full name, title, company name, e-mail and phone number, profile picture, role, department, and additional information and media submitted by Supplier Staff or their organization. When the supplier is a legal entity, we collect some information on contact persons. When the supplier’s data includes individual’s Personal Data, we also collect: social media accounts, field of occupation, bank and payment details, other information a user decides to share;
- Platform usage information: technical usage data, such as user agent, IP addresses, device data (like type, OS, device id, browser version, geolocation and language settings used), connectivity data, activity logs, session recordings, and the cookies installed or utilized on the Payee User’s device.
- Account login information: e-mail address and, when applicable, hashed password or other information used for authentication and access control;
- Profile and contact information: full name, title, company name, email and phone number, profile picture, and additional information and media submitted by Payee Users or their organization;
- Platform usage information: technical usage data, such as user agent, IP addresses, device data (like type, OS, device id, browser version, geolocation and language settings used), connectivity data, activity logs, session recordings, and the cookies installed or utilized on the Payee User’s device; and
- Direct interactions and communications with us: including recordings and transcripts of your calls and correspondence with us, e.g., for user enablement, support and training purposes.
*Tipalti processes Personal Data (1) as a processor on our Customer’s behalf, in accordance with their reasonable instructions in connection with the Services; and (2) as a controller for our own legitimate purposes, as further explained in Section 2 and Section 10 below.
For California Residents: The personal information that we may collect, or may have collected from consumers in the preceding twelve months, fall into the following categories established by the California Consumer Privacy Act (“CCPA”), depending on how you engage with Tipalti:
- Identifiers, such as your name, alias, address, phone numbers, or IP address;
- personal information as described in subdivision (e) of Section 1798.80 of the California Civil Code, such as a credit card number;
- characteristics of protected classifications under California or US federal law, such as age or gender, for example if we conduct due diligence and other identification checks;
- commercial information, such as purchase activity;
- Internet or other electronic network activity information, including browsing history, search history, and information regarding your interaction with the Services;
- biometric information, including physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns;
- geolocation data, such as the location of your device or computer;
- audio, visual, electronic or other similar information, including when you communicate with us by phone or otherwise;
- professional or employment-related information, for example data you may provide about your business;
- inference data, such as information about your preferences; and
- education information, such as information about enrollment status, fields of study, or degrees, honors, and awards received.
Legal Basis for Collection: GDPR
For Personal Data that is subject to the EU General Data Protection Regulation (“GDPR”), the lawful basis for collecting and using your Personal Data is consent, where you have provided your consent, or for fulfilling our contractual obligations in providing our Services. For instances where your consent is not obtained or there is no contractual obligation, we collect and use your Personal Data in our legitimate interests (which are not overridden by your data protection interests), such as operating our business, understanding and improving our products, direct marketing related to our products and services, hosting events, communicating with you about our products, services, events or related resources, improving our Sites, and protecting our legal rights and interests.
2. DATA USES
Tipalti processes the Personal Data described in Section 1 as necessary for the performance of our Services; to comply with our legal and contractual obligations; and to support our legitimate interests in maintaining, improving and advertising our Services.
Specifically, we use Personal Data and technical usage data, for the following purposes:
- To facilitate, operate, and provide our Services, including determining your initial and continued eligibility to use our Services;
- To authenticate the identity of our Customer Users and Payee Users,
- To facilitate and manage access to and use of our Services, including account creation, login and deletion;
- To provide you with customer care, assistance and technical support services;
- To further develop, customize and improve the Services, and to improve your user experience;
- To facilitate and optimize our marketing and advertising campaigns, ad management and sales operations, and to manage and deliver advertisements for our products and Services more effectively;
- To contact you with general or personalized service-related messages, or with promotional messages, in accordance with Section 7 below, and to facilitate, sponsor and offer certain events and promotions;
- To support and enhance our data security measures, including for the purposes of preventing and mitigating the risks of fraud, error or any illegal or prohibited activity;
- To create aggregated statistical and research data, inferred non-personal data, or anonymized or pseudonymized data (rendered non-personal), which we or our business partners and customers may use to provide and improve our respective services, or for any other purpose;
- To enforce and apply our agreements, including for billing and collection purposes; and
- To comply with our legal, regulatory, compliance and contractual obligations, including in particular as a business and a financial services provider.
For California Residents: The personal information that we may have used and/or disclosed about consumers for a business purpose in the preceding twelve months fall into the following categories established by the CCPA:
- To facilitate, operate, and provide our Services
- To verify the identity of our Users
- To determine your eligibility to use our Services
- To further develop, customize and improve our Services, and to provide you with any such enhanced Services
- To provide customer assistance and technical support
- To contact our Users, Consumers, customers, and website visitors with general and personalized service-related notices, surveys and promotional messages including marketing and advertising messages
- To create aggregated statistical data and other aggregated and/or inferred Non-personal Information, which we, our Users or our business partners may use to operate and improve our respective services
- To manage and assess risk, enhance our data security and fraud prevention capabilities, and help protect against error, fraud or any illegal or prohibited activity
- To act as permitted by, and to comply with any legal or regulatory requirements
- To conduct any additional activities that may require the use of your Personal Information, for which we will request your consent in advance
3. DATA LOCATION
We and our authorized service providers (as detailed in Section 5 below) manage, store and process personal data in the United States, Israel, the United Kingdom, Germany, and other locations as reasonably necessary for the proper performance and delivery of our Services, or as may be required by law.
International Transfers of Information
Personal Data is transferred to the United States, Israel, the United Kingdom, and Germany by Tipalti in the general course of business, and in accordance with applicable laws. For Personal Data that is subject to the GDPR, Tipalti utilizes approved contractual transfer mechanisms, such as the EU adequacy decision for transfers to Israel, and the Standard Contractual Clauses approved by the European Commission for transfers to the United States.
4. DATA RETENTION
We retain Personal Data for as long as it is reasonably necessary to achieve our stated purpose (e.g. to provide you with our Services, to comply with contractual obligations, or as required for proper log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use), all in accordance with applicable laws and regulations. Where applicable, we also retain Personal Data with our Customer’s reasonable instructions and as further stipulated in our DPA and other commercial agreements with such Customer. You may delete your Personal Data or request us to delete your Personal Data, at any time. Please contact the Customer or Supplier (if you are a Customer User or Supplier Staff), or otherwise contact us as outlined in Section 11 below.
Please note that except as required by applicable law or our specific agreements with you, we will not be obligated to retain your Personal Data for any particular period, and we are free to securely delete it or restrict access to it for any reason and at any time, with or without notice to you. If you have any questions about our data retention policy, please contact us by e-mail at [email protected].
5. DATA SHARING
Tipalti shares Personal Data as provided below.
Legal Compliance: In exceptional circumstances, we may disclose or allow government and law enforcement officials access to your Personal Data in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations, with or without notice to you. All such disclosure requests will be reviewed by Tipalti to determine to what extent, if any, Tipalti is required to comply with such request. Tipalti will consult with its legal advisors on the request to determine if we are permitted to notify you about such requests. Such disclosure or access may occur if we believe in good faith that: (1) we are legally compelled to do so; (2) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, counter terrorist financing verification requirements fraud, or other wrongdoing; or (3) such disclosure is required to protect our legitimate business interests, including the security or integrity of our products and Services. Unless Tipalti is prohibited from doing so by applicable laws or the applicable legal request, Tipalti may notify you before disclosing Personal Data, so you may take the necessary steps to object or seek protection from disclosure.
Service Providers: We engage selected partners, and third-party companies and individuals to perform services complementary to our own, and to support the operation of our business. Such Service Providers include hosting and server co-location services, communications and content delivery networks (CDNs), internet service providers, operating systems and platforms, data analytics services, marketing and advertising services, data and cyber security services, fraud detection and prevention services, capital providers, and correspondents, banks, financial institutions, credit bureaus, collection agencies, customer engagement services, billing and payment processing services, web analytics, e-mail and SMS distribution and monitoring services, session or activity recording services, remote access services, performance measurement, data optimization services, social and advertising networks, content providers, support and customer relation management systems, service providers that help us verify your identity and help us comply with our legal and regulatory obligations to screen and monitor transactions; recruiters and companies that provide background checking services; and our business, legal, tax, financial and compliance advisors (collectively, “Service Providers“). These Service Providers may have access to your Personal Data, depending on each of their specific roles and purposes in facilitating, supporting, and enhancing our Services, and may only use it for such purposes.
Sharing Data with Other Users: Payee Data is typically shared with and is available to Customer Users within the relevant Customer account. Customer Data is shared with the administrator or other users of their Customer account. In such cases, sharing such data means that the administrator or other users of the account may access it on behalf of the Customer, and will be able to monitor, process and analyze the Personal Data contained therein. This includes instances where you may contact us for help in resolving an issue specific to you or to a team of which you are a member (and which is managed by the same Customer). Please note that Tipalti is not responsible for and does not control any further disclosure, use or monitoring by or on behalf of the Customer, where the Customer acts as the Data Controller of such data (as further described in Section 10 below). Supplier Data is typically shared with other users of the Services, primarily through access to the Supplier’s site in relation to the Services.
Protecting Rights and Safety: We may share your Personal Data with others if we believe in good faith that this will help protect the rights, property or personal safety of Tipalti, any of our Customers, their users, Payees, our Prospects, or any members of the general public.
Additional Sharing: Tipalti may share your Personal Data in additional manners, pursuant to your explicit consent, or if we are legally obligated to do so, or if we have successfully rendered such data non-personal, non-identifiable and anonymous.
6. COOKIES AND TRACKING TECHNOLOGIES
Cookies are small text files that are stored through the browser on your computer or mobile device (for example, Google Chrome or Safari) when you visit a website. Some cookies are removed when you close your browser session – these are the “Session Cookies”, others last for longer periods and are called “Persistent Cookies”. We use both types of cookies to facilitate the use of the Services’ features and tools (for example, we use Persistent Cookies to remember your login details and make it easier for you to login the next time you access the Platform).
The following describes different categories of cookies and how we might use them on our Sites and within our Services.
Required Cookies: These cookies are necessary for the functionality of our Sites, and include session cookies needed to transmit authentication and security cookies. These cookies cannot be opted out of, as they are required for website functionality.
Functional Cookies: These cookies assist us with enhancing the function and performance of our Sites, including capturing analytics of website traffic, assisting with market research, and providing non-targeted advertising.
Advertising Cookies: These cookies track a user’s activity across websites in order to understand a user’s interests, and to direct marketing to the user. More information on how we use advertising cookies in relation to interest-based advertising is outlined below.
Interest-Based Advertising: Interest-based ads are sometimes referred to as personalized or targeted ads. We and our marketing partners may show interest-based ads to display features, products, and services that might be of interest to you. In providing interest-based ads, we follow the Self-Regulatory Principles for Online Behavioral Advertising developed by the Digital Advertising Alliance (a coalition of marketing, online advertising, and consumer advocacy organizations). Some of these companies deliver advertising and content based on your activity across websites, devices, and over time. These companies may process your information for their own purposes of operating their advertising networks in accordance with their own privacy policies.
Opting Out. You can manage your cookies preferences, including whether or not to accept them and how to remove them, through your browser settings. Please bear in mind that disabling cookies may complicate or even prevent you from using the Services. Please note that opting-out of cookies may require that you first accept cookies from a provider, because your opt-out preference may be stored in the form of a cookie. Likewise, when you get a new computer, install a new browser, erase or otherwise alter your browser’s cookie file (including upgrading certain browsers), you may also clear the opt-out cookies installed once you opt-out, so an additional opt-out will be necessary to prevent additional tracking. For more information regarding cookies, you may find the following websites useful: www.allaboutcookies.org, www.youronlinechoices.co.uk.
If you do not want to receive interest-based advertising, you may opt out by visiting www.aboutads.info/choices (US), https://youradchoices.ca/ (CAN), or https://www.youronlinechoices.com/ (Europe). If you opt out of interest-based advertising, you may still see ads that are less tailored for you as you browse the internet. In addition, our advertising partners may have methods to opt out on their individual websites, links to which are listed below as of February 11, 2021:
- Verizon Media
- Microsoft Corporation
- LinkedIn Corporation
- Facebook (on and off their service)
We engage in service and promotional communications, through e-mail, phone, and notifications within the Services.
Service Communications: We may contact you with important information regarding our Services. For example, we may send you notifications (through any of the means available to us) of changes or updates to our Services, billing issues, payment issues, login attempts or password reset instructions. Our Customers and their users on the same Customer account may also send you notifications, messages and other updates regarding their or your use of the Services.
Notifications and Promotional Communications: We and our authorized partners (e.g., event or webinar co-sponsors) may also notify you about new features, additional offerings, events, webinars, special opportunities or any other information we think you will find valuable. We may provide such notices through any of the contact means available to us (e.g. phone, mobile or email), through the Services, or through our marketing campaigns on any other third party sites or platforms.
You can typically control your communications and notifications settings from your Tipalti profile settings, or otherwise by following the instructions typically included in the communications sent to you. If you do not wish to receive promotional communications, you may also notify Tipalti at any time here, or by sending an e-mail to: [email protected].
8. DATA SECURITY
We and our hosting services implement appropriate technical, organizational, and administrative systems, applications and procedures to secure your personal data, to minimize the risks of theft, damage, loss of information, or unauthorized access or use of information. Among other things, we:
- Offer HTTPS secure access to most areas on our Services;
- Use industry standard SSL/TLS encrypted connections to protect the transmission of information that we believe in good faith to be of a sensitive nature;
- Use encryption tools to protect such sensitive information stored with us;
- Regularly monitor our systems for possible vulnerabilities and attacks; and
- Seek new ways and tools for further enhancing the security of our Services and the integrity of the personal data that we hold.
We believe that these measures provide sound industry standard security, confirmed also by Tipalti’s SOC 2 Type I compliance certification. That said, regardless of our continuous efforts to protect your privacy, we cannot guarantee that our Services will be immune from any wrongdoings, malfunctions, bugs, unlawful interceptions or access, or other kinds of abuse and misuse which may compromise your privacy. As the security of information depends in part on the security of the computer, device, or network you use to communicate with us and the security you use to protect your user IDs and passwords, please make sure to take appropriate measures to protect this information.
9. DATA SUBJECT RIGHTS
Individuals have the following rights concerning their personal data under global privacy laws, including but not limited to, California Consumer Privacy Act (“CCPA”) and GDPR.
- The right to access personal data held about you. Your right of access may normally be exercised free of charge; however we reserve the right to charge an appropriate administrative fee where permitted by applicable law.
- The right to request that we rectify any personal data we hold that is inaccurate or misleading.
- The right to request the erasure/deletion of your personal data (e.g., from our records). Please note that there may be circumstances in which we are required to retain your personal data, for example for the establishment, exercise or defense of legal claims.
- The right to object, to or to request restriction, of certain processing activities.
- The right to data portability. This means that you may have the right to receive your personal data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller.
- The right to object to profiling.
- The right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
- For individuals subject to GDPR, the right to request certain details of the basis on which your personal data is transferred outside the European Economic Area, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality.
- The right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
If you wish to exercise your privacy rights under any applicable law, including CCPA and GDPR, in relation to Personal Data held with Tipalti, please login to your account via the Services or the relevant website (where you originally uploaded this personal data) and view, edit or deactivate the data saved in that account. If you do not have such an account, or if you wish to exercise your right to restrict or object to such processing, to port such personal data (if applicable), or to exercise any similar rights afforded to data subjects under the laws that apply to you – please contact us by e-mail at: [email protected]. If you provided personal information to a Tipalti Customer and believe it is being processed by Tipalti on behalf of that Customer, please make any requests or queries regarding personal data to that Customer directly.
Please note that we may require additional information, including certain personal data, in order to authenticate and process your request. Such additional information may be then retained by us for legal purposes (e.g. as proof of the identity of the person submitting the request), in accordance with Section 4 above. We may redact any personal data related to others from the data which we will make available to you.
Please also note that such rights are not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal data that we hold about you. In the event that we cannot accommodate your request, we will inform you of the reasons why, subject to any legal or regulatory restrictions.
We will respond within thirty (30) days upon receipt of your personal data request; or (b) if additional time is required to meet your request, we will notify you by mail or electronically of the reason and extension period, provided, however, such extension shall not exceed forty-five (45) days.
We do not charge a fee to process or respond to your personal data request, provided that it is not excessive, repetitive, or manifestly unfounded.
For California consumers: For specific inquiries concerning the CCPA, you must submit a Verifiable Consumer Request to Tipalti via email to [email protected] and include all of the following information:
- Your relationship with Tipalti (payer, payee, or advertising recipient);
- The email address through which Tipalti communicates with you;
- The name you have registered with Tipalti or to whom Tipalti addresses you;
- A contact phone number so Tipalti may call you in order to verify your identity; and
- Which rights you are exercising:
- Your Right to Access your Data, and/or
- Your Right to Delete your Data.
We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a Verifiable Consumer Request does not require you to create an account with us. We will only use Personal Information provided in a Verifiable Consumer Request to verify the requestor’s identity or authority to make the request.
Please note that any disclosures we provide will only cover the 12-month period preceding the Verifiable Consumer Request.
10. DATA CONTROLLER/PROCESSOR
Certain data protection laws and regulations, such as the GDPR, typically distinguish between two main roles for parties processing Personal Data subject to those laws and regulations: the “Data Controller”, who determines the purposes and means of processing; and the “Data Processor”, who processes the Personal Data on behalf of the Data Controller. Below we explain how these roles apply to our Services, to the extent that such laws and regulations apply.
Tipalti is both a Data Controller and Data Processor of Payee Data. Payee Data is processed by Tipalti as a (1) Data Processor on our Customer’s behalf, in accordance with their reasonable instructions in connection with Customer’s specific use of the Services, and as further stipulated in our agreements with such Customer; and (2) Data Controller for Payee Data gathered by Tipalti for our own legitimate purposes.
Tipalti is both a Data Controller and Data Processor of Customer Data and platform usage data. Such Personal Data is processed by Tipalti for its own purposes (as described in Section 2 above), as an independent Data Controller; whilst also processing certain portions of it on the Customer’s behalf, as its Data Processor.
Both Tipalti and the Customer are responsible for meeting any legal requirements applicable to Data Controllers (such as establishing a legal basis for processing and responding to Data Subject Rights requests concerning the data they control). Where Tipalti processes Customer Data and Payee Data solely on behalf of our Customer, we would do so strictly in accordance with such Customer’s reasonable instructions and as further stipulated in our agreements with the Customer.
For the avoidance of doubt, each Customer is responsible for the security, integrity and authorized use of Payee Users’ information in their control, and for providing adequate notice to their users and Payees whose personal data may be processed – including sufficient reference to the processing of their personal data via the Services, and any other information necessary to comply with all applicable privacy and data protection laws; and to obtain all approvals and consents from such individuals as required under such laws.
11. ADDITIONAL INFORMATION AND CONTACT DETAILS
Our Services are not designed to attract children under the age of 16: We do not knowingly collect personal data from children and do not wish to do so. If we learn that a person under the age of 16 is using the Services, we will attempt to prohibit and block such use and will make our best efforts to promptly delete any personal data stored with us with regard to such child. If you believe that we might have any such data, please contact us by e-mail at [email protected].
EU Representative: Tipalti has appointed VeraSafe as a representative in the European Union for data protection matters pursuant to Article 27 of the GDPR. VeraSafe may be contacted only on matters related to the processing of Personal Data. To make such an inquiry, please contact VeraSafe here. Alternatively, VeraSafe can be contacted at: VeraSafe Czech Republic s.r.o, Klimentská 46, Prague 1, 11002, Czech Republic. If you are a GDPR-protected individual, you also have the right to lodge a complaint with an EU supervisory authority.
California Consumers: The following disclosures are required by the California Consumer Privacy Act and are effective as of February 9, 2021:
- No sale of personal information. In the preceding twelve months, we have not sold any personal information of consumers, as those terms are defined under the California Consumer Privacy Act.
- No Discrimination. We will not discriminate against any consumer for exercising their rights under the California Consumer Privacy Act..
- Designating an Authorized Agent. Only you or a person or entity that is either (i) registered as an agent with the California Secretary of State that you authorize to act on your behalf; or (ii) that you have provided power of attorney to pursuant to Probate Code Sections 4000 to 4465 (“Authorized Agent”) may submit a Verifiable Consumer Request related to your Personal Information. If you choose to use an Authorized Agent, Tipalti may require that you provide the Authorized Agent with written permission to do so, and verify the identity of the Authorized Agent directly with you.
How to opt-out of receiving Promotional Messages from Tipalti:
- Opt-out landing page, or
- Send an email to [email protected] and request to no longer receive promotional emails and/or phone calls.
Effective Date: August 25, 2021