Privacy Policy

Tipalti, Inc. and our affiliated companies (including Tipalti Solutions LTD, Tipalti Payments, Inc., Tipalti Europe LTD, Tipalti Canada, Inc., and Tipalti B.V. – collectively, “Tipalti”, “we”, “our” or “us”), respects your privacy, and are committed to ensuring that the personal data we process is secure, used in accordance with this policy, and in compliance with privacy laws. Please note that this is a master privacy policy (“Privacy Policy”) and some of its provisions only apply to individuals in certain jurisdictions. Important note: Nothing in this Privacy Policy is intended to limit in any way your statutory rights, including your rights to a remedy or means of enforcement.

This Privacy Policy describes how we collect, store, use and disclose the following types of personal data relating to individuals who interact with Tipalti (collectively “Personal Data”):

Prospect Data concerning our prospective customers, partners or individuals who visit our websites such as https://tipalti.com and its respective subdomains (collectively, the “Sites”) and interact with our online forms, or engage with our online ads and content, social media interactions (e.g. Facebook, LinkedIn, Twitter), emails or other communications under our control, or whose details are received from partners or vendors, or participate in events that we organize or take part in (collectively, “Prospects”);
Customer User Data concerning individuals (“Customer’s Users”) who use Tipalti’s cloud platform, mobile application, and related services (the “Services”) on behalf of our business customers (“Customers”);
Payee Data concerning individuals to whom (personally, or for their employer; “Payee Users”), following sign up, payments are made via the Services;
Supplier Data concerning individuals (“Supplier’s Staff”) employed by suppliers of a Customer, or other individuals, that interact with the Services, whether or not payments are made to such suppliers or individuals.
Third Party Data concerning individuals (other than Customer Users, Payees or Supplier Staff (“Third Parties”) who use and interact with the Services.

Personal Data does not include information where there is no serious possibility that it can be used to identify an individual, whether on its own or in combination with other information, or personal information that has been anonymized or aggregated such as to be considered anonymized information or no longer personal information under applicable laws.

Specifically, this Privacy Policy describes our practices regarding:

If you are our Prospect, a Customer User, Payee User or Supplier Staff (“you”), please read this Privacy Policy carefully and make sure that you fully understand and agree to it.

1. DATA COLLECTION

How We Collect. We collect, receive, and process Personal Data about you through:

Your interaction with us, our Sites, our mobile application, or our Services;
Our Customers, who provide us with Customer Data and in some cases, Payee Data;
Third-party services and providers, such as business partners, credit bureaus, social media tools, analytics and other publicly available sources; and
Events we organize or take part in, and other business initiatives (including partner promotions, communications, and events).

What We Collect. We collect, receive, and process the following Personal Data about you:

Prospect Data:

Website usage information: technical and aggregated usage data, such as user agent, IP addresses, device data (like type, OS, device id, browser version, geolocation and language settings used), connectivity data, activity logs, session recordings, and the cookies and pixels installed or utilized on our Sites or your device;
Prospect account information: contact and business details (full name, email address, company name and phone number) of our prospective customers and partners, which may also contain the details of their relevant internal focal persons; our communications with such Prospects (correspondences, call and video recordings and transcriptions, and analyses thereof), as well as any needs, preferences, attributes and insights relevant to our potential engagement.

Customer User Data:

Account login information: e-mail address and, when applicable, hashed password or other information used for authentication and access control;
Profile and contact information: full name, title, company name, e-mail and phone number, profile picture, social media accounts, role, and additional information and media submitted by Customer’s Users or their organization;
Platform usage information: technical usage data, such as user agent, IP addresses, device data (like type, OS, device id, browser version, geolocation and language settings used), connectivity data, activity logs, session recordings, and the cookies installed or utilized on the Customer’s User’s device; and
Direct interactions and communications with us: including recordings and transcripts of your calls and correspondence with us, e.g. for user enablement, support and training purposes.
Identification Information: Supplemental documentation may be required by Tipalti to verify the identity of Customer’s directors, officers, or owners (who may be Customer’s Users), such as date of birth, address, a copy of a government-issued identification card, personal bank statements or other documentation serving as proof of identity or valid address. This includes any additional data you choose to provide to us directly through our Know Your Customer (“KYC”) process to comply with legal, regulatory, and other compliance-related requirements. To the extent that any of the foregoing solely relates to a non-human entity, we will not regard it as personal data, and this Privacy Policy will not apply to it.

Supplier Data:

Account login information: e-mail address and, when applicable, hashed password or other information used for authentication and access control.
Profile and contact information: full name, title, company name, e-mail and phone number, profile picture, role, department, and additional information and media submitted by Supplier Staff or their organization. When the supplier is a legal entity, we collect some information on contact persons. When the supplier’s data includes individual’s Personal Data, we also collect: social media accounts, field of occupation, bank and payment details, other information a user decides to share;
Platform usage information: technical usage data, such as user agent, IP addresses, device data (like type, OS, device id, browser version, geolocation and language settings used), connectivity data, activity logs, session recordings, and the cookies installed or utilized on the Payee User’s device.

Payee Data:

Account login information: e-mail address and, when applicable, hashed password or other information used for authentication and access control;
Profile and contact information: full name, title, company name, email and phone number, profile picture, and additional information and media submitted by Payee Users or their organization;
Payment information: Payee User name, email address, physical addresses, phone number, VAT ID, Social Security Numbers or EU Tax Identification Number, bank account number, IBAN, SWIFT code (or alternatively, account details at payment processing services such as PayPal, where applicable) and payment preferences. Supplemental documentation may be required by the Customers, such as a copy of Payee User’s government-issued identification card, personal bank statements or other documentation serving as proof of identity or valid address. This includes any additional data you choose to provide to us directly, provided to us by the relevant Customer, banks, payment processing services, your representative, or that we may require in order to properly process your payment and in order to comply with legal, regulatory, and other compliance-related requirements. To the extent that any of the foregoing solely relates to a non-human entity, we will not regard it as personal data, and this Privacy Policy will not apply to it;
Platform usage information: technical usage data, such as user agent, IP addresses, device data (like type, OS, device id, browser version, geolocation and language settings used), connectivity data, activity logs, session recordings, and the cookies installed or utilized on the Payee User’s device; and
Direct interactions and communications with us: including recordings and transcripts of your calls and correspondence with us, e.g., for user enablement, support and training purposes.

Third Party Data:

Account login information: e-mail address and, when applicable, hashed password or other information used for authentication and access control;
Profile and contact information: full name, title, company name, e-mail and phone number, profile picture, role, and additional information submitted by Customer’s Users or their organization;
Platform usage information: technical usage data, such as user agent, IP addresses, device data (like type, OS, device id, browser version, geolocation and language settings used), connectivity data, activity logs, session recordings, and the cookies installed or utilized on the Third Party’s device; and

*Tipalti processes Personal Data (1) as a processor on our Customer’s behalf, in accordance with their reasonable instructions in connection with the Services; and (2) as a controller for our own legitimate purposes, as further explained in Section 2 and Section 10 below.

For California Residents: The personal information that we may collect, or may have collected from consumers in the preceding twelve months, fall into the following categories established by the California Consumer Privacy Act and California Privacy Rights Act (collectively, “California Privacy Laws”), as applicable, depending on how you engage with Tipalti:

Identifiers, such as your name, alias, address, phone numbers, or IP address;
personal information as described in subdivision (e) of Section 1798.80 of the California Civil Code, such as a credit card number;
characteristics of protected classifications under California or US federal law, such as age or gender, for example if we conduct due diligence and other identification checks;
commercial information, such as purchase activity;
Internet or other electronic network activity information, including browsing history, search history, and information regarding your interaction with the Services;
geolocation data, such as the location of your device or computer;
audio, visual, electronic or other similar information, including when you communicate with us by phone or otherwise;
professional or employment-related information, for example data you may provide about your business;
inference data, such as information about your preferences; and
education information, such as information about enrollment status, fields of study, or degrees, honors, and awards received.

Sensitive Personal Information: The Sensitive Personal Information (as defined under California Privacy Laws) that we may collect, or may have collected from consumers in the preceding twelve months is as follows:

Copies of identification documentation, such as passports or driver’s licenses; and
Financial Account information, such as account number, transit and routing numbers and contact information related to banking details.

Legal Basis for Collection: GDPR

For Personal Data that is subject to the EU General Data Protection Regulation (“GDPR”), the lawful basis for collecting and using your Personal Data is consent, where you have provided your consent, or for fulfilling our contractual obligations in providing our Services. For instances where your consent is not obtained or there is no contractual obligation, we collect and use your Personal Data in our legitimate interests (which are not overridden by your data protection interests), such as operating our business, understanding and improving our products, hosting events, communicating with you about our products, services, events or related resources, improving our Sites, and protecting our legal rights and interests.

You are not legally required to provide us with any personal data and may do so (or avoid doing so) at your own free will. If you provided your consent for us to collect and use your Personal Data, you may withdraw that consent at any time. If you do not wish to provide us with your personal data, or to have it processed by us or any of our service providers (per Section 5 below), please contact the applicable Customer or Supplier (if you are a Customer User or Supplier Staff) and contact us (if you are a Prospect or Payee) about your personal data request (per Section 11 below). By accessing and/or using any of the Services, you signify and affirm your informed consent to the collection and processing of your Personal Data as defined and explained in this Privacy Policy.

2. DATA USES

Tipalti processes the Personal Data described in Section 1 as necessary for the performance of our Services; to comply with our legal and contractual obligations; and to support our legitimate interests in maintaining, improving and advertising our Services. Tipalti also uses artificial intelligence and similar technologies for processing Personal Data within the Services.

Specifically, we use Personal Data and technical usage data, for the following purposes:

To facilitate, operate, and provide our Services, including determining your initial and continued eligibility to use our Services;
To authenticate the identity of our Customer Users, Third Parties and Payee Users, which may include verifying Personal Data against third party data, such as data belonging to credit reference agencies or other public sources;
To facilitate and manage access to and use of our Services, including account creation, login and deletion;
To provide you with customer care, assistance and technical support services;
To further develop, customize and improve the Services, and to improve your user experience;
To facilitate and optimize our marketing and advertising campaigns, ad management and sales operations, and to manage and deliver advertisements for our products and Services more effectively;
To contact you with general or personalized service-related messages, or with promotional messages, in accordance with Section 7 below, and to facilitate, sponsor and offer certain events and promotions;
To support and enhance our data security measures, including for the purposes of preventing and mitigating the risks of fraud, error or any illegal or prohibited activity;
To create aggregated statistical and research data, inferred non-personal data, or anonymized or pseudonymized data (rendered non-personal), which we or our business partners and customers may use to provide and improve our respective services, or for any other purpose;
To enforce and apply our agreements, including for billing and collection purposes; and
To comply with our legal, regulatory, compliance and contractual obligations, including in particular as a business and a financial services provider.

For California Residents: The personal information that we may have used and/or disclosed about consumers in the preceding twelve months fall into the following business purposes, as established by the California Privacy Laws:

To facilitate, operate, and provide our Services;
To verify the identity of our Users;
To determine your eligibility to use our Services;
To further develop, customize and improve our Services, and to provide you with any such enhanced Services;
To provide customer assistance and technical support;
To contact our Users, Consumers, customers, and website visitors with general and personalized service-related notices, surveys and promotional messages including marketing and advertising messages;
To create aggregated statistical data and other aggregated and/or inferred Non-Personal Information, which we, our Users or our business partners may use to operate and improve our respective services, or for any other purpose;
To manage and assess risk, enhance our data security and fraud prevention capabilities, and help protect against error, fraud or any illegal or prohibited activity;
To act as permitted by, and to comply with any legal or regulatory requirements;
To conduct any additional activities that may require the use of your Personal Information (as that term is defined under California Privacy Laws), for which we will request your consent in advance; and
Any other usage delineated in Tipalti’s Privacy Policy.

Sensitive Personal Information: Tipalti uses, and has used and/or disclosed Sensitive Personal Information (as defined under California Privacy Laws) about consumers in the preceding twelve months that fall into the following business purposes:

To facilitate, operate, and provide our Services, such as facilitating payments;
To verify the identity of our Users, and to assist in preventing fraud and other financial crimes; and
To determine your eligibility to use our Services.

3. DATA LOCATION

We and our authorized service providers (as detailed in Section 5 below) manage, store and process personal data in the United States, Israel, the United Kingdom, Germany, and other locations as reasonably necessary for the proper performance and delivery of our Services, or as may be required by law. The primary storage location for Tipalti Customer data is the United States.

While privacy laws may vary between jurisdictions, Tipalti, its affiliates and service providers are each committed to protect Personal Data in accordance with this Privacy Policy, customary industry standards, and applicable laws in the jurisdictions to which Personal Data may be processed. In particular, Personal Data processed on behalf of our customers may only be processed in such locations as permitted in our DPA and other commercial agreements with them.

International Transfers of Information

Personal Data is transferred to the United States, Israel, the United Kingdom, and Germany by Tipalti in the general course of business, and in accordance with applicable laws. For Personal Data that is subject to the GDPR, Tipalti utilizes approved contractual transfer mechanisms, such as the EU adequacy decision for transfers to Israel, and the Standard Contractual Clauses approved by the European Commission for transfers to the United States.

4. DATA RETENTION

We retain Personal Data for as long as it is reasonably necessary to achieve our stated purpose (e.g. to provide you with our Services, to comply with contractual obligations, or as required for proper log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use), all in accordance with applicable laws and regulations. Where applicable, we also retain Personal Data with our Customer’s reasonable instructions and as further stipulated in our DPA and other commercial agreements with such Customer. You may delete your Personal Data or request us to delete your Personal Data, at any time. Please contact the Customer or Supplier (if you are a Customer User or Supplier Staff), or otherwise contact us as outlined in Section 11 below.

Please note that except as required by applicable law or our specific agreements with you, we will not be obligated to retain your Personal Data for any particular period, and we are free to securely delete it or restrict access to it for any reason and at any time, with or without notice to you. If you have any questions about our data retention policy, please contact us by e-mail at privacy@tipalti.com.

For Customer Data, Payee Data and Supplier Data, as it relates to payment services, Tipalti maintains such Personal Data for 7 years after our contractual relationship is terminated, in accordance with regulatory requirements and industry best practices.

For Prospect Data, Tipalti maintains Prospect Personal Data for as long as Prospects have a potential business relationship, or an active sales relationship with Tipalti. Tipalti will delete Prospect Data in situations where Prospects have not been actively communicating with Tipalti for a reasonable period of time, or where Prospects specifically ask to be removed from communications.

5. DATA SHARING

Tipalti shares Personal Data as provided below.

Legal Compliance: In exceptional circumstances, we may disclose or allow government and law enforcement officials access to your Personal Data in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations, with or without notice to you. All such disclosure requests will be reviewed by Tipalti to determine to what extent, if any, Tipalti is required to comply with such request. Tipalti will consult with its legal advisors on the request to determine if we are permitted to notify you about such requests. Such disclosure or access may occur if we believe in good faith that: (1) we are legally compelled to do so; (2) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, counter terrorist financing verification requirements fraud, or other wrongdoing; or (3) such disclosure is required to protect our legitimate business interests, including the security or integrity of our products and Services. Unless Tipalti is prohibited from doing so by applicable laws or the applicable legal request, Tipalti may notify you before disclosing Personal Data, so you may take the necessary steps to object or seek protection from disclosure.

Service Providers: We engage selected partners, and third-party contractors to perform services complementary to our own, and to support the operation of our business. Such Service Providers or contractors include hosting and server co-location services, communications and content delivery networks (CDNs), internet service providers, operating systems and platforms, data analytics services, marketing and advertising services, data and cyber security services, fraud detection and prevention services, capital providers, and correspondents, banks, financial institutions, credit bureaus, collection agencies, customer engagement services, billing and payment processing services, web analytics, e-mail and SMS distribution and monitoring services, session or activity recording services, remote access services, performance measurement, data optimization services, social and advertising networks, content providers, support and customer relation management systems, service providers that help us verify your identity and help us comply with our legal and regulatory obligations to screen and monitor transactions; recruiters and companies that provide background checking services; and our business, legal, tax, financial and compliance advisors (collectively, “Service Providers“). These Service Providers may have access to your Personal Data, depending on each of their specific roles and purposes in facilitating, supporting, and enhancing our Services, and may only use it for such purposes.

Third-Party Websites and Services: Our Services may include links to third-party websites, and integrations with third-party services. Such websites and third-party services, and any information you process, submit, transmit or otherwise use with such websites and third-party services, are governed by such third-party’s terms and privacy practices and policies, and not by this Privacy Policy. We encourage you to carefully read the terms and privacy policies of such websites and third-party services. To the extent that our Service Providers contact you in order to offer or promote our Service, they may additionally interest you in their own services. Should you decide to engage in such activities with Tipalti’s Service Providers, please note that such engagement is beyond the scope of Tipalti’s Terms of Use and Privacy Policy and will therefore be covered by our Service Provider’s terms and privacy policy.

Sharing Data with Other Users: Payee Data and Third Party Data is typically shared with and is available to Customer Users within the relevant Customer account. Customer Data is shared with the administrator or other users of their Customer account. In such cases, sharing such data means that the administrator or other users of the account may access it on behalf of the Customer, and will be able to monitor, process and analyze the Personal Data contained therein. This includes instances where you may contact us for help in resolving an issue specific to you or to a team of which you are a member (and which is managed by the same Customer). Please note that Tipalti is not responsible for and does not control any further disclosure, use or monitoring by or on behalf of the Customer, where the Customer acts as the Data Controller of such data (as further described in Section 10 below). Supplier Data is typically shared with other users of the Services, primarily through access to the Supplier’s site in relation to the Services.

Events: Tipalti may receive from, and share with a third-party event host, Personal Data collected at events either managed by Tipalti or by a third party. For any event hosted by a third party, the collection and use of all Personal Data will be governed by the applicable third party’s privacy policy, and the terms provided to individuals at the applicable event.

Protecting Rights and Safety: We may share your Personal Data with others if we believe in good faith that this will help protect the rights, property or personal safety of Tipalti, any of our Customers, their users, Payees, our Prospects, or any members of the general public.

Tipalti Subsidiaries and Affiliated Companies; Change of Control: We may share your Personal Data internally within our affiliates for the purposes described in this Privacy Policy. In addition, should Tipalti or any of its affiliates undergo any change in control or ownership, including by means of merger, acquisition or purchase of substantially all or part of its assets, or will be considered or found eligible for a governmental grant, personal data may be shared with the parties involved in such an event. If we believe that such an event might materially affect your Personal Data then-stored with us, we will notify you of this event and the choices you may have via e-mail or prominent notice on our Services.

Additional Sharing: Tipalti may share your Personal Data in additional manners, pursuant to your explicit consent, or if we are legally obligated to do so, or if we have successfully rendered such data non-personal, non-identifiable and anonymous.

For California Consumers: Tipalti does not sell Personal Information for monetary or other value. In the preceding twelve months, we have not sold any Personal Information of consumers, as those terms are defined under the California Privacy Laws. Tipalti has shared Personal Information as noted above within the preceding 12 months.

6. COOKIES AND TRACKING TECHNOLOGIES

Tipalti and our Service Providers use cookies and other technologies on our Sites and within our Services, for performance, tracking, analytics, personalization purposes and in order to provide you with a better experience. We may share non-identifiable/aggregated extracts of such information with our partners for our legitimate business purposes. The cookies that Tipalti uses on our website and within the Tipalti Services are listed here.

Cookies are small text files that are stored through the browser on your computer or mobile device (for example, Google Chrome or Safari) when you visit a website. Some cookies are removed when you close your browser session – these are the “Session Cookies”, others last for longer periods and are called “Persistent Cookies”. We use both types of cookies to facilitate the use of the Services’ features and tools (for example, we use Persistent Cookies to remember your login details and make it easier for you to login the next time you access the Platform).

The following describes different categories of cookies and how we might use them on our Sites and within our Services.

Required Cookies: These cookies are necessary for the functionality of our Sites, and include session cookies needed to transmit authentication and security cookies. These cookies cannot be opted out of, as they are required for website functionality.

Functional Cookies: These cookies assist us with enhancing the function and performance of our Sites, including capturing analytics of website traffic, assisting with market research, and providing non-targeted advertising.

Google Analytics: We use Google Analytics to collect information to maintain and improve the use of our Sites and Services. Google Analytics collects information such as how often users visit the Services, which pages they visit when they do so, and which other sites they used prior to coming to our Services. Google’s ability to use and share information collected by Google Analytics about your visits to and use of the Services is restricted by the Google Analytics Terms of Service and the Google Privacy Policy. You can learn more about how Google collects and processes data specifically in connection with Google Analytics here. Further information about your option to opt-out of these analytics services is available here.

Mixpanel: We collect personal data such as your email address and your user activity through Mixpanel. Mixpanel’s ability to use and share information is governed by the Mixpanel Terms of Use, and the Mixpanel Privacy Policy. You can opt-out of Mixpanel’s services by email at: compliance@mixpanel.com.

Advertising Cookies: These cookies track a user’s activity across websites in order to understand a user’s interests, and to direct marketing to the user. More information on how we use advertising cookies in relation to interest-based advertising is outlined below.

Interest-Based Advertising: Interest-based ads are sometimes referred to as personalized or targeted ads. We and our marketing partners may show interest-based ads to display features, products, and services that might be of interest to you. In providing interest-based ads, we follow the Self-Regulatory Principles for Online Behavioral Advertising developed by the Digital Advertising Alliance (a coalition of marketing, online advertising, and consumer advocacy organizations). Some of these companies deliver advertising and content based on your activity across websites, devices, and over time. These companies may process your information for their own purposes of operating their advertising networks in accordance with their own privacy policies.

Opting Out. You can manage your cookies preferences, including whether or not to accept them and how to remove them, through your browser settings. Please bear in mind that disabling cookies may complicate or even prevent you from using the Services. Please note that opting-out of cookies may require that you first accept cookies from a provider, because your opt-out preference may be stored in the form of a cookie. Likewise, when you get a new computer, install a new browser, erase or otherwise alter your browser’s cookie file (including upgrading certain browsers), you may also clear the opt-out cookies installed once you opt-out, so an additional opt-out will be necessary to prevent additional tracking. For more information regarding cookies, you may find the following websites useful: www.allaboutcookies.org, www.youronlinechoices.co.uk.

If you do not want to receive interest-based advertising, you may opt out by visiting www.aboutads.info/choices (US), https://youradchoices.ca/ (CAN), or https://www.youronlinechoices.com/ (Europe). If you opt out of interest-based advertising, you may still see ads that are less tailored for you as you browse the internet. In addition, our advertising partners may have methods to opt out on their individual websites, links to which are listed below as of February 11, 2021:

7. COMMUNICATIONS

We engage in service and promotional communications, through e-mail, phone, and notifications within the Services.

Service Communications: We may contact you with important information regarding our Services. For example, we may send you notifications (through any of the means available to us) of changes or updates to our Services, billing issues, payment issues, login attempts or password reset instructions. Our Customers and their users on the same Customer account may also send you notifications, messages and other updates regarding their or your use of the Services.

Notifications and Promotional Communications: We and our authorized partners (e.g., event or webinar co-sponsors) may also notify you about new features, additional offerings, events, webinars, special opportunities or any other information we think you will find valuable. We may provide such notices through any of the contact means available to us (e.g. phone, mobile or email), through the Services, or through our marketing campaigns on any other third party sites or platforms.

You can typically control your communications and notifications settings from your Tipalti profile settings, or otherwise by following the instructions typically included in the communications sent to you. If you do not wish to receive promotional communications, you may also notify Tipalti at any time here, or by sending an e-mail to: opt-out@tipalti.com.

8. DATA SECURITY

We and our hosting services implement appropriate technical, organizational, and administrative systems, applications and procedures to secure your personal data, to minimize the risks of theft, damage, loss of information, or unauthorized access or use of information. Among other things, we:

Offer HTTPS secure access to most areas on our Services;
Use industry standard SSL/TLS encrypted connections to protect the transmission of information that we believe in good faith to be of a sensitive nature;
Use encryption tools to protect such sensitive information stored with us;
Regularly monitor our systems for possible vulnerabilities and attacks; and
Seek new ways and tools for further enhancing the security of our Services and the integrity of the personal data that we hold.

We believe that these measures provide sound industry standard security, confirmed also by Tipalti’s SOC 2 Type II compliance certification. That said, regardless of our continuous efforts to protect your privacy, we cannot guarantee that our Services will be immune from any wrongdoings, malfunctions, bugs, unlawful interceptions or access, or other kinds of abuse and misuse which may compromise your privacy. As the security of information depends in part on the security of the computer, device, or network you use to communicate with us and the security you use to protect your user IDs and passwords, please make sure to take appropriate measures to protect this information.

9. DATA SUBJECT RIGHTS

Individuals have the following rights concerning their personal data under global privacy laws, including but not limited to, California Privacy Laws and GDPR.

The right to access personal data held about you.
The right to request that we rectify any personal data we hold that is inaccurate or misleading.
The right to request the erasure/deletion of your personal data (e.g., from our records). Please note that there may be circumstances in which we are required to retain your personal data, for example for the establishment, exercise or defense of legal claims, or in accordance with legal requirements.
The right to object, to or to request restriction, of certain processing activities.
For California consumers, the right to opt out of, and limit the sale of and sharing of your personal data, and to limit the use and disclosure of Sensitive Personal Information.
The right to data portability. This means that you may have the right to receive your personal data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller.
The right to object to profiling.
The right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
For individuals subject to GDPR, the right to request certain details of the basis on which your personal data is transferred outside the European Economic Area, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality.
The right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.

If you wish to exercise your privacy rights under any applicable law, including California Privacy Laws and GDPR, in relation to Personal Data held with Tipalti, please login to your account via the Services or the relevant website (where you originally uploaded this personal data) and view, edit or deactivate the data saved in that account. If you do not have such an account, or if you wish to exercise your right to restrict or object to such processing, to port such personal data (if applicable), or to exercise any similar rights afforded to data subjects under the laws that apply to you – please contact us by e-mail at: privacy@tipalti.com. If you provided personal information to a Tipalti Customer and believe it is being processed by Tipalti on behalf of that Customer, please make any requests or queries regarding personal data to that Customer directly.

Please note that we may require additional information, including certain personal data, in order to authenticate and process your request. Such additional information may be then retained by us for legal purposes (e.g. as proof of the identity of the person submitting the request), in accordance with Section 4 above. We may redact any personal data related to others from the data which we will make available to you.

Please also note that such rights are not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal data that we hold about you. In the event that we cannot accommodate your request, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

We will respond within thirty (30) days upon receipt of your personal data request; or (b) if additional time is required to meet your request, we will notify you by mail or electronically of the reason and extension period, provided, however, such extension shall not exceed forty-five (45) days.

We do not charge a fee to process or respond to your personal data request, provided that it is not excessive, repetitive, or manifestly unfounded.

For California consumers: For specific inquiries concerning California Privacy Laws, you must submit a Verifiable Consumer Request to Tipalti via email to Privacy@Tipalti.com and include all of the following information:

Your relationship with Tipalti (payer, payee, or advertising recipient);
The email address through which Tipalti communicates with you;
The name you have registered with Tipalti or to whom Tipalti addresses you;
A contact phone number so Tipalti may call you in order to verify your identity; and
Which rights you are exercising:
- Your Right to Access your Data,
- Your Right to limit use of your Sensitive Information, and/or
- Your Right to Delete your Data.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a Verifiable Consumer Request does not require you to create an account with us. We will only use Personal Information provided in a Verifiable Consumer Request to verify the requestor’s identity or authority to make the request.

Please note that any disclosures we provide will only cover the 12-month period preceding the Verifiable Consumer Request.

10. DATA CONTROLLER/PROCESSOR

Certain data protection laws and regulations, such as the GDPR, typically distinguish between two main roles for parties processing Personal Data subject to those laws and regulations: the “Data Controller”, who determines the purposes and means of processing; and the “Data Processor”, who processes the Personal Data on behalf of the Data Controller. Below we explain how these roles apply to our Services, to the extent that such laws and regulations apply.

Tipalti is the Data Controller of its Prospect Data. With respect to such Personal Data, we assume the responsibilities of Data Controller (solely to the extent applicable under law), as set forth in this Privacy Policy. In such instances, our Service Providers processing such Personal Data will assume the role of Data Processors. For our advertising and analytics purposes, we may engage third parties who are also Data Controllers with respect to Prospect Data.

Tipalti is both a Data Controller and Data Processor of Payee Data. Payee Data is processed by Tipalti as a (1) Data Processor on our Customer’s behalf, in accordance with their reasonable instructions in connection with Customer’s specific use of the Services, and as further stipulated in our agreements with such Customer; and (2) Data Controller for Payee Data gathered by Tipalti for our own legitimate purposes.

Tipalti is both a Data Controller and Data Processor of Customer Data and platform usage data. Such Personal Data is processed by Tipalti for its own purposes (as described in Section 2 above), as an independent Data Controller; whilst also processing certain portions of it on the Customer’s behalf, as its Data Processor.

Both Tipalti and the Customer are responsible for meeting any legal requirements applicable to Data Controllers (such as establishing a legal basis for processing and responding to Data Subject Rights requests concerning the data they control). Where Tipalti processes Customer Data and Payee Data solely on behalf of our Customer, we would do so strictly in accordance with such Customer’s reasonable instructions and as further stipulated in our agreements with the Customer.

For the avoidance of doubt, each Customer is responsible for the security, integrity and authorized use of Payee Users’ information in their control, and for providing adequate notice to their users and Payees whose personal data may be processed – including sufficient reference to the processing of their personal data via the Services, and any other information necessary to comply with all applicable privacy and data protection laws; and to obtain all approvals and consents from such individuals as required under such laws.

11. ADDITIONAL INFORMATION AND CONTACT DETAILS

Updates and Amendments: We may update and amend this Privacy Policy from time to time by posting an amended version on our Sites. The amended version will be effective as of the date it is published. We will provide prior notice if we believe any substantial changes are involved via any of the communication means available to us or via Services. After such notice period, all amendments will be deemed accepted by you.

External Links: While our Services may contain links to other websites or services, we are not responsible for their privacy practices. We encourage you to pay attention when you leave our Services for the website or application of such third-parties, and to read the privacy policies of each and every website and service you visit. This Privacy Policy applies only to our Services.

Our Services are not designed to attract children under the age of 16: We do not knowingly collect personal data from children and do not wish to do so. If we learn that a person under the age of 16 is using the Services, we will attempt to prohibit and block such use and will make our best efforts to promptly delete any personal data stored by us about such child. If you believe that we might have any such data, please contact us by e-mail at privacy@tipalti.com.

EU Representative: Tipalti has appointed VeraSafe as a representative in the European Union for data protection matters pursuant to Article 27 of the GDPR. VeraSafe may be contacted only on matters related to the processing of Personal Data. To make such an inquiry, please contact VeraSafe here. Alternatively, VeraSafe can be contacted at: VeraSafe Czech Republic s.r.o, Klimentská 46, Prague 1, 11002, Czech Republic. If you are a GDPR-protected individual, you also have the right to lodge a complaint with an EU supervisory authority.

California Consumers: The following disclosures are required by the California Privacy Laws and are effective as of August 17, 2023:

No Discrimination. We will not discriminate against any consumer for exercising their rights under the California Privacy Laws.
Designating an Authorized Agent. Only you or a person or entity that is either (i) registered as an agent with the California Secretary of State that you authorize to act on your behalf; or (ii) that you have provided power of attorney to pursuant to Probate Code Sections 4000 to 4465 (“Authorized Agent”) may submit a Verifiable Consumer Request related to your Personal Information. If you choose to use an Authorized Agent, Tipalti may require that you provide the Authorized Agent with written permission to do so, and verify the identity of the Authorized Agent directly with you.

Questions, concerns or complaints: if you have any comments or questions regarding our Privacy Policy, or if you have any concerns regarding your personal data held with us, or if you wish to make a complaint about how your personal data is being processed by Tipalti, you can contact our Data Protection Officer at privacy@tipalti.com. Alternatively, you can contact us at: Tipalti, 1051 E. Hillsdale Boulevard, Suite 600, Foster City, CA 94404.

How to opt-out of receiving promotional messages from Tipalti:

Opt-out landing page, or
Send an email to opt-out@tipalti.com and request to no longer receive promotional emails and/or phone calls.

Effective Date: August 17, 2023