Sub-Processors

Amazon Web Services EMEA SARL (AWS)

Details of the processing of personal data that may be undertaken by this sub-processor subject to, and in accordance with, this Agreement: AWS act as ExpenseIn’s primary data centre. This includes the hosting of all core services and data stores.

Data transfers to this subprocessor are governed by a Data Processing Agreement in accordance with Article 28 of the UK GDPR.

Processing of personal data by this sub-processor takes place at the following locations: UK

Klippa App B.V t/a Doxis AI.dp

Details of the processing of personal data that may be undertaken by this sub-processor subject to, and in accordance with, this Agreement: Klippa fulfil the core of our receipt scanning processing, taking an image of an expense receipt e.g., a receipt for coffee from Costa and providing the information automatically, to enable us, to turn it into a draft expense claim for the Active User. The information transferred to Klippa is anonymous except to the extent that there may be personal data contained on the expense receipt.

Data transfers to this subprocessor are governed by an adequacy decision issued by the European Commission, and a Data Processing Agreement is in place in accordance with Article 28 of the UK/EU GDPR.

Processing of personal data by this sub-processor takes place at the following locations: EU

The Rocket Science Group LLC d/b/a Mailchimp

Details of the processing of personal data that may be undertaken by this sub-processor subject to, and in accordance with, this Agreement: Mailchimp is used to email administrators and from time-to-time Authorised User’s details of system updates, changes to our Services and issues impacting our Services. To do so, name and email address are transferred.

Data transfers to this subprocessor are governed by a signed Data Processing Agreement, with the subprocessor certified under the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge) as the transfer mechanism under UK GDPR.

Processing of personal data by this sub-processor takes place at the following locations: USA

ActiveCampaign, LLC t/a Postmark

Details of the processing of personal data that may be undertaken by this sub-processor subject to, and in accordance with, this Agreement: ActiveCampaign act as an email service provider of our inbound email-to-receipt service. This enables an Authorised User, should they choose, to email any electronic receipts directly into our service, saving time, rather than printing them out and then re-capturing them. If the service is used then name, email address and any expense receipt content are transferred.

Data transfers to this subprocessor are governed by a signed Data Processing Agreement, with the subprocessor certified under the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge) as the transfer mechanism under UK GDPR.

Processing of personal data by this sub-processor takes place at the following locations: USA

Intercom Inc

Details of the processing of personal data that may be undertaken by this sub-processor subject to, and in accordance with, this Agreement: Intercom provide our online support chat line. The only personal data that is transferred is name and email address and any content that the Authorised User chooses to enter on the chat line.

Data transfers to this subprocessor are governed by a signed Data Processing Agreement, with the subprocessor certified under the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge) as the transfer mechanism under UK GDPR.

Processing of personal data by this sub-processor takes place at the following locations: USA

Stripe Payments UK Limited (Stripe Technology Europe Limited for EU customers)

Details of the processing of personal data that may be undertaken by this sub-processor subject to, and in accordance with, this Agreement:

Stripe is an electronic money institution authorised by the Financial Conduct Authority provides the ExpenseIn expense cards to Authorised Users. Where applicable, name, email address, mobile telephone number, address and date of birth are transferred. For further details, please see https://stripe.com/gb/legal/dpa.

Data transfers to this subprocessor are governed by an adequacy decision issued by the European Commission, and a Data Processing Agreement is in place in accordance with Article 28 of the UK/EU GDPR.

Processing of personal data by this sub-processor takes place at the following locations: EU