Sub-Processors

Amazon Web Services EMEA SARL (AWS)

Details of the processing of personal data that may be undertaken by this sub-processor subject to, and in accordance with, this Agreement: AWS act as ExpenseIn’s primary data centre. This includes the hosting of all core services and data stores.

Data transfers to this subprocessor are governed by a Data Processing Agreement in accordance with Article 28 of the UK GDPR.

Processing of personal data by this sub-processor takes place at the following locations: UK

Klippa App B.V t/a Doxis AI.dp

Details of the processing of personal data that may be undertaken by this sub-processor subject to, and in accordance with, this Agreement: Klippa fulfil the core of our receipt scanning processing, taking an image of an expense receipt e.g., a receipt for coffee from Costa and providing the information automatically, to enable us, to turn it into a draft expense claim for the Active User. The information transferred to Klippa is anonymous except to the extent that there may be personal data contained on the expense receipt.

Data transfers to this subprocessor are governed by an adequacy decision issued by the European Commission, and a Data Processing Agreement is in place in accordance with Article 28 of the UK/EU GDPR.

Processing of personal data by this sub-processor takes place at the following locations: EU

The Rocket Science Group LLC d/b/a Mailchimp

Details of the processing of personal data that may be undertaken by this sub-processor subject to, and in accordance with, this Agreement: Mailchimp is used to email administrators and from time-to-time Authorised User’s details of system updates, changes to our Services and issues impacting our Services. To do so, name and email address are transferred.

Data transfers to this subprocessor are governed by a signed Data Processing Agreement, with the subprocessor certified under the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge) as the transfer mechanism under UK GDPR.

Processing of personal data by this sub-processor takes place at the following locations: USA

ActiveCampaign, LLC t/a Postmark

Details of the processing of personal data that may be undertaken by this sub-processor subject to, and in accordance with, this Agreement: ActiveCampaign act as an email service provider of our inbound email-to-receipt service. This enables an Authorised User, should they choose, to email any electronic receipts directly into our service, saving time, rather than printing them out and then re-capturing them. If the service is used then name, email address and any expense receipt content are transferred.

Data transfers to this subprocessor are governed by a signed Data Processing Agreement, with the subprocessor certified under the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge) as the transfer mechanism under UK GDPR.

Processing of personal data by this sub-processor takes place at the following locations: USA

Intercom Inc

Details of the processing of personal data that may be undertaken by this sub-processor subject to, and in accordance with, this Agreement: Intercom provide our online support chat line. The only personal data that is transferred is name and email address and any content that the Authorised User chooses to enter on the chat line.

Data transfers to this subprocessor are governed by a signed Data Processing Agreement, with the subprocessor certified under the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge) as the transfer mechanism under UK GDPR.

Processing of personal data by this sub-processor takes place at the following locations: USA

Stripe Payments UK Limited (Stripe Technology Europe Limited for EU customers)

Details of the processing of personal data that may be undertaken by this sub-processor subject to, and in accordance with, this Agreement:

Stripe is an electronic money institution authorised by the Financial Conduct Authority provides the ExpenseIn expense cards to Authorised Users. Where applicable, name, email address, mobile telephone number, address and date of birth are transferred. For further details, please see https://stripe.com/gb/legal/dpa.

Data transfers to this subprocessor are governed by an adequacy decision issued by the European Commission, and a Data Processing Agreement is in place in accordance with Article 28 of the UK/EU GDPR.

Processing of personal data by this sub-processor takes place at the following locations: EU

How we select and manage sub-processors

Before engaging any sub-processor, we carry out a security and privacy assessment covering their certifications (such as ISO 27001 or SOC 2), data protection practices and where data will be processed. Every sub-processor is bound by a data processing agreement that requires confidentiality, appropriate security measures and breach notification. We review sub-processors at least annually as part of our ISO 27001 supplier management process, and we notify customers of material changes.

International data transfers

The ExpenseIn platform and customer expense data are hosted in the UK. A small number of supporting services, such as customer support and communication tools, may process limited personal data (for example contact details) outside the UK or EEA. Where this happens, we rely on recognised safeguards under UK GDPR. These include the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework, supported by transfer risk assessments. Data is encrypted in transit and at rest, and we limit what is shared to what each service needs.