Introduction
Spendly, Inc. (collectively referred to herein as “Spendly”, “we”, “our” or “us”), recognizes the importance of protecting personal data we may collect from visitors and any other individual or entity (“Users”, “you”, or “your”) who visit our web sites. This Privacy Policy applies to data collection by Spendly and shall apply to your use of the website, www.Getspendly.com and other Spendly-related sites, applications, software, communications, capabilities and services (“Services”) accessible on or by any top-level Spendly domain owned by us (each, a “Site” and collectively the “Sites”), but excluding services that state that they are offered under a different privacy policy.
Our Privacy Policy explains: (1) what information we collect; (2) why we collect it; (3) how we use that information; (4) how we may share it; (5) the choices we offer, including how to access and update information; (6) and the measures we take to keep your information safe. Specifically, our Privacy Policy covers the following topics:
Please familiarize yourself with our privacy practices and let us know if you have any questions. By using the Sites, you signify your acceptance of this Privacy Policy. If you do not agree to this Privacy Policy, please do not use the Sites.
Irrespective of which country you live in, you authorize us to transfer, store, and use your information in the United States, and any other country where we operate. In some of these countries, the privacy and data protection laws and rules regarding when government authorities may access data may vary from those in the country where you live. Learn more about our data transfer operations in the “International Transfer” section below. If you do not agree to the transfer, storage and use of your information in the United States, and any other country where we operate, please do not use the Sites or Services.
If you have any questions or comments about this Privacy Policy, please submit a request to shannon@getspendly.com.
When this privacy policy applies
Our Privacy Policy applies to all of the Services offered by Spendly and its affiliates, including some Spendly Partners, and Services offered on other sites, but excludes services that have separate privacy policies that do not incorporate this Privacy Policy.
Our Privacy Policy does not apply to services offered by other companies or individuals, including products or sites that may be displayed to you, or other sites linked from our Services. Our Privacy Policy does not cover the information practices of other companies and organizations who advertise our Services, and who may use cookies, pixel tags and other technologies to serve and offer relevant ads.
Terms of use
By accessing or using the Sites in any manner, you also agree to be bound by Spendly’s Terms of Use (the “Agreement”). Please read the Agreement carefully. If you do not accept all of the terms and conditions contained in or incorporated by reference into the Agreement, please do not use the Sites.
Information we collect
We collect information, including personal data, to provide better services to all our Users. We use the term “Personal Data” to refer to any information that identifies or can be used to identify you. Common examples of Personal Data include: full name, email address, digital identity, such as a login name or handle, information about your device, and certain metadata.
“Sensitive Personal Data” refers to a smaller subset of Personal Data which is considered more sensitive to the individual, such as race and ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric information, physical or mental health information, medical insurance data, or sexual orientation.
When you use our Services, we collect Personal Data in the following ways:
1. Information You Give to Us
As you evaluate whether Spendly is the right solution for your company, you may choose to provide us with Personal Data about yourself, including your name, company name, phone number, and email address by completing forms on our website, such as when you request to contact or make a savings request. You may also choose to provide us with employment and education information when you apply for a job at Spendly via our Site.
In some instances, you may elect to provide us with location and address information. You may also provide us with Personal Data about yourself when you report a problem or have a question about our services.
The Sites offer interactive and social features that permit you to submit content and communicate with us. You may provide Personal Data to us when you post information in these interactive and social features. Please note that your postings in these areas of the Sites may be publicly accessible or accessible to other Users.
2. Information We Obtain from Your Use of Our Services
We collect certain information automatically, such as your operating system version, browser type, and internet service provider. We also collect information about your interaction with the Services, such as creating or logging into your account, or opening or interacting with the Services on Your mobile device. When you use our Site, we automatically collect and store this information in service logs. This includes: details of how you used our Site; Internet protocol address; cookies that uniquely identify your browser, the referring web page and pages visited. We may also collect and process information about your actual location. The information we collect automatically is statistical data and may or may not include Personal Data, but we may maintain it or associate it with Personal Data we collect in other ways or receive from third parties.
3. Cookies and Similar Technologies
We and our partners use various technologies to collect and store information when you visit one of our services, and this may include using cookies or similar technologies to identify your browser or device. We also use these technologies to collect and store information when you interact with services from our partners, such as advertising services. Our third party advertising and analytics partners include Google and similar partners.
The technologies we use for this automatic data collection may include:
Web Beacons. Pages of our services or our e-mails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags and single-pixel gifs) that permit us, for example, to count Users who have visited those pages or opened an e-mail and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).
Clickstream Data. Clickstream data is information collected by our computers when you request Web pages from the Sites. Clickstream data may include information such as the page served, the time spent viewing the page, source of the request, type of browser making the request, the preceding page viewed and similar information. Clickstream data permits us to analyze how visitors arrive at the Sites, what type of content is popular, what type of visitors in the aggregate are interested in particular kinds of content on the Sites.
How We Use Information We Collect
We use your Personal Data in ways that are compatible with the purposes for which it was collected or authorized by you, including for the following purposes:
We use the information we collect from our Sites to provide, maintain, and improve them, to develop new services, and to protect our company and our Users.
We use information collected from cookies and other technologies, to improve your User experience and the overall quality of our services. For example, by saving your language preferences, we’ll be able to have our services appear in the language you prefer. We may use your Personal Data to see which web pages you visit at our Site, which web site you visited before coming to our Site, and where you go after you leave our Site. We can then develop statistics that help us understand how our visitors use our Site and how to improve it. We may also use the information we obtain about you in other ways for which we provide specific notice at the time of collection.
We will ask for your consent before using information for a purpose other than those set out in this Privacy Policy.
Sale of Personal Information
In the preceding twelve (12) months, we have not sold any Personal Information.
Our Legal Basis for Collecting Personal Data
Provided that, in each circumstance, we will weigh the necessity of our processing for the purpose against your privacy and confidentiality interests, including taking into account your reasonable expectations, the impact of processing, and any safeguards which are or could be put in place. In all circumstances, we will limit such processing for our legitimate business interest to what is necessary for its purposes.
Information We Share
We do not share personal data with companies, organizations and individuals outside of Spendly unless one of the following circumstances applies:
We attempt to notify you about legal demands for your Personal Information when appropriate in our judgment, unless prohibited by law or court order or when the request is an emergency. We may dispute such demands when we believe, in our discretion, that the requests are over broad, vague or lack proper authority, but we do not promise to challenge every demand.
Your Failure to Provide Personal Data
Your provision of Personal Data is required in order to use certain parts of our services and our programs. If you fail to provide such Personal Data, you may not be able to access and use our Services and/or our programs, or parts of our Services and/or our programs.
Our retention of Your Personal Data
We may retain your Personal Data for a period of time consistent with the original purpose for collection. For example, we keep your Personal Data for no longer than reasonably necessary for your use of our programs and Services and for a reasonable period of time afterward. We also may retain your Personal Data during the period of time needed for us to pursue our legitimate business interests, conduct audits, comply with our legal obligations, resolve disputes and enforce our agreements.
We retain your Personal Data even after your business relationship with us ends if reasonably necessary to comply with our legal obligations (including law enforcement requests), meet regulatory requirements, resolve disputes, maintain security, prevent fraud and abuse, enforce our Terms of Use, or fulfill your request to “unsubscribe” from further messages from us. We will retain de-personalized information after your account has been closed.
Your Rights and Choices
You may have certain rights relating to your Personal Information, subject to local data protection law. Whenever you use our Services, we aim to provide you with choices about how we use your Personal Data. We also aim to provide you with access to your Personal Data. If that information is wrong, we strive to give you ways to update it quickly or to delete it – unless we have to keep that information for legitimate business or legal purposes. Subject to applicable law, you may obtain a copy of personal information we maintain about you or you may update or correct inaccuracies in that information by contacting us. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to the information. In addition, if you believe that personal information we maintain about you is inaccurate, subject to applicable law, you may have the right to request that we correct or amend the information by contacting us as indicated in the How to Contact Us section below.
Privacy Rights Specific to Californians
Under the California Consumer Privacy Act, California residents have specific rights regarding their personal information. This section describes Californians’ rights and explains how California residents can exercise those rights.
Below we further outline specific rights which California residents may have under the California Consumer Privacy Act.
● Right to Access Your Data. You have the right to request that we disclose certain information to you about our collection, use and disclosure of your Personal Information over the past twelve (12) months. Any disclosures we provide will only cover the 12-month period preceding the receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.
● Right to Data Portability. You have the right to a “portable” copy of your Personal Information that you have submitted to us. Generally, this means you have a right to request that we move, copy or transmit your Personal Information stored on our servers or information technology environment to another service provider’s servers or information technology environment.
● Right to Delete Your Data. You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.
● Right to Non-Discrimination for the Exercise of Your Privacy Rights. You have the right not to receive discriminatory treatment by us for exercising your privacy rights conferred by the California Consumer Privacy Act.
Exercising Your Rights
If you are a California resident who chooses to exercise your rights, you can:
1. Submit a request via email to shannon@Getspendly.com, or
You may also designate an agent to exercise your privacy rights on your behalf. In order to designate an authorized agent to make a request on your behalf, you must provide a valid power of attorney, the requester’s valid government-issued identification, and the authorized agent’s valid government issued identification.
Our Response to Your Request
Upon receiving your request, we will confirm receipt of your request by sending you an email. To help protect your privacy and maintain security, we may take steps to verify your identity before granting you access to the information. In some instances, such as a request to delete personal information, we may first separately confirm that you would like for us to in fact delete your personal information before acting on your request.
We will respond to your request within forty-five (45) days. If we require more time, we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.
In some cases our ability to uphold these rights for you may depend upon our obligations to process Personal Information for security, safety, fraud prevention reasons, compliance with regulatory or legal requirements, listed below, or because processing is necessary to deliver the services you have requested. Where this is the case, we will inform you of specific details in response to your request.
We may deny your deletion request if retaining the information is necessary for us or our service providers to:
1. Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
3. Debug products to identify and repair errors that impair existing intended functionality;
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.);
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent;
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us; 8. Comply with a legal obligation; or
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
Rights Specific to European Union Residents
Some data protection laws, including the European Union’s General Data Protection Regulation (“GDPR”),corresponding legislation in the United Kingdom, and some U.S. state laws, provide you with certain rights in connection with Personal Data you have shared with us. If you are resident in the European Economic Area, you may have the following rights:
1. The right to be informed. You are entitled to be informed of the use of your Personal Data. This Privacy Policy provides such information to you.
2. The right of access. You have the right to request a copy of your Personal Data which we hold about you.
3. The right of correction: You have the right to request correction or changes of your Personal Data if it is found to be inaccurate or out of date.
4. The right to be forgotten: You have the right to request us, at any time, to delete your Personal Data from our servers and to erase your Personal Data when it is no longer necessary for us to retain such data. Note, however, that deletion of your Personal Data will likely impact your ability to use our services.
5. The right to object (opt-out): You have the right to opt-out of certain uses of your Personal Data at any time.
6. The right to data portability: You have the right to a “portable” copy of your Personal Data that you have submitted to us. Generally, this means your right to request that we move, copy or transmit your Personal Data stored on our servers / IT environment to another service provider’s servers / IT environment.
7. The right to refuse to be subjected to automated decision making, including profiling: You have the right not to be subject to a decision and insist on human intervention if the decision is based on automated processing and produces a legal effect or a similarly significant effect on you.
8. The right to lodge a complaint with a supervisory authority.
You may also have the right to make a GDPR complaint to the relevant Supervisory Authority. A list of Supervisory Authorities is available here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm
If you need further assistance regarding your rights, please contact us using the contact information provided below and we will consider your request in accordance with applicable law. To make these requests, you may contact us using the contact information below, and we will consider your request in accordance with applicable laws. For your protection, we may need to verify your identity before responding to your request, such as verifying that the email address from which you send the request matches your email address that we have on file. If we no longer need to process Personal Data about you in order to provide our Services or our Sites, we will not maintain, acquire or process additional information in order to identify you for the purpose of responding to your request. In some cases our ability to uphold these rights for you may depend upon our obligations to process personal information for security, safety, fraud prevention reasons, compliance with regulatory or legal requirements, or because processing is necessary to deliver the services you have requested. Where this is the case, we will inform you of specific details in response to your request.
In some cases our ability to uphold these rights for you may depend upon our obligations to process personal information for security, safety, fraud prevention reasons, compliance with regulatory or legal requirements, or because processing is necessary to deliver the services you have requested. Where this is the case, we will inform you of specific details in response to your request.
Rights Specific to Canadians
The Personal Information Protection and Electronic Documents Act (PIPEDA), provides you with certain rights in connection with Personal Information you have shared with us. If you are a resident of Canada, you may have the following rights:
Individual Access. You have the right to access the personal information that we hold about you. Under certain circumstances, we maybe prohibited from fulfilling your request. The response we provide will explain the reasons we cannot comply with a request, if applicable.
Right to Correction. You have the right to challenge the accuracy and completeness of the information we have about you, and have that information amended as appropriate.
Exercising Your Rights
If you are a Canada resident who chooses to exercise your rights, you can submit a request to the Sr. Compliance Analyst via email to privacy@Spendly.com.
Our Response to Your Request
Upon receiving your request, we will confirm receipt of your request by sending you an email. To help protect your privacy and maintain security, we may take steps to verify your identity before granting you access to the information.
We will respond to your request within thirty (30) days. If we require more time, we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.
In some cases, our ability to uphold these rights for you may depend upon our obligations to process Personal Information for security, safety, fraud prevention reasons, compliance with regulatory or legal requirements, listed below, or because processing is necessary to deliver the services you have requested. Where this is the case, we will inform you of specific details in response to your request.
Our Opt-in/Opt-out Policy
By providing an email address on the Spendly Sites or Services, you agree that we may contact you in the event of a change in this Privacy Policy, to provide you with any Service related notices, or to provide you with information about our events, invitations, or related educational information. For purposes of this Privacy Policy, “opt-in” is generally defined as any affirmative action by a User to submit or receive information, as the case may be.
We currently provide the following opt-out opportunities:
1. At any time, you can follow a link provided in offers, newsletters or other email messages (except for e-commerce confirmation or service notice emails) received from us or a Spendly Partner to unsubscribe from the service.
2. At any time, you can contact us through shannon@getspendly.com or the address or telephone number provided below to unsubscribe from the service and opt-out of our right per your consent under the terms of this Privacy Policy to share your Personal Data.
Notwithstanding anything else in this Privacy Policy, please note that we always reserve the right to contact you in the event of a change in this Privacy Policy, or to provide you with any service related notices.
Your Ad Choices
As described above, we or third party partners may place or recognize a unique cookie on your browser when you visit our Sites for the purpose of serving you targeted advertising(also referred to as “online behavioral advertising” or “interest-based advertising”). You may find more information about entities involved in online advertising and additional choices you may make, including opt-out of having your information used for internet-based advertising, through the Network Advertising Initiative (“NAI”) at the NAI Service, and the Digital AdvertisingAlliance (the “DAA”) at the DAA consumer choice service. Spendly is a participant in the online industry’s self-regulatory program administered by the DAA and has agreed to adhere to the DAA’s principles applicable to interest-based ads.
The tools provided at the DAA opt-out page and the NAI opt-out page are provided by third parties, not Spendly. Spendly does not control or operate these tools or the choices that advertisers and others provide through these tools.
Third Party Links
The Sites may contain links to webpages operated by parties other than Spendly. We do not control such websites and are not responsible for their contents or the privacy policies or other practices of such websites. Our inclusion of links to such websites does not imply any endorsement of the material on such websites or any association with their operators. Further, it is up to the User to take precautions to ensure that whatever links the User selects or software the User downloads (whether from this Site or other websites) is free of such items as viruses, worms, trojan horses, defects and other items of a destructive nature. These websites and services may have their own privacy policies, which the User will be subject to upon linking to the third party's website. Spendly strongly recommends that each User review the third party's terms and policies.
International Transfer
We are committed to complying with applicable laws, regulations and mandatory government standards regarding the protection of Personal Data.
Personal Data and any additional information submitted may be used globally in connection with employment, business processes within Spendly, or communicating with our Spendly Partners. Therefore, Personal Data may be transferred to such entities worldwide, where it will be processed in accordance with this Privacy Policy and laws that are applicable in each country. Countries where we process data may have laws which are different, and potentially not as protective, as the laws of your own country.
If we transfer your Personal Data out of your jurisdiction, we will implement suitable safeguards and rely on legally-provided mechanisms to lawfully transfer data across borders to ensure that your Personal Data is protected.
EU-U.S. PRIVACY SHIELD INVALIDATION
On July 16, 2020, the Court of Justice of the European Union (CJEU) issued a judgment declaring as “invalid” the European Commission’s Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided by the EU-U.S. Privacy Shield. As a result of that decision, the EU-U.S. Privacy Shield Framework is no longer a valid mechanism to comply with EU data protection requirements when transferring personal data from the European Union to the United States. I: In face of this decision, Spendly has decided to withdraw from the EU-U.S. Privacy Shield Framework. Nevertheless, it will continue to apply the Privacy Shield Principles to personal data that it had received in reliance upon Privacy Shield and affirm to the Department of Commerce on an annual basis its commitment to apply the Principles to such data.
Additionally, while the Court of Justice of the European Union (CJEU) invalidated the EU-U.S. Privacy Shield Framework, the CJEU validated the use of Standard Contractual Clauses (SCCs). Spendly is committed to the use of SCCs. SCCs are a commonly used mechanism for transatlantic data transfers. They are standard sets of contractual terms and conditions which the sender and the receiver of the personal data both sign up to. They include contractual obligations which help to protect personal data when it leaves the European Economic Area (EEA) and the protection of GDPR. This method does make it possible in practice to ensure compliance with the level of protection required by EU law.
How we protect personal data
Spendly maintains administrative, technical and physical safeguards designed to protect the User's Personal Data and information against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account technological reality, cost, the scope, context and purposes of processing weighted against the severity and likelihood that the processing could threaten individual rights and freedoms. For example, we restrict access to personal information to Spendly employees, contractors, business partners and agents who need to know that information in order to operate, develop or improve our services. These individuals are bound by confidentiality obligations and may be subject to discipline, including termination and criminal prosecution, if they fail to meet these obligations. We use commercially reasonable security measures such as encryption, firewalls, and Secure Socket Layer software (SSL) or hypertext transfer protocol secure (HTTPS) to protect Personal Data.
If Spendly collects account information for payment or credit, Spendly will use the information only to complete the task for which the account information was offered.
Children
The Site is not intended for use by children. We do not intentionally gather Personal Data about visitors who are under the age of 16. If a child has provided us with Personal Data, a parent or guardian of that child may contact us to have the information deleted from our records. If you believe that we might have any information from a child under age 16 in the applicable jurisdiction, please contact us at shannon@getspendly.com If we learn that we have inadvertently collected the personal information of a child under 16, or equivalent minimum age depending on jurisdiction, we will take steps to delete the information as soon as possible.
Direct Marketing and "Do Not Track" Signals
Spendly does not track its users over time and across third party websites to provide targeted advertising and therefore does not respond to Do Not Track (DNT) signals. However, some third party sites do keep track of your browsing activities when they serve you content, which enables them to tailor what they present to you. If you are visiting such sites, your browser may include controls to block and delete cookies, web beacons and similar technologies, to allow you to opt out of data collection through those technologies.
California residents are entitled to contact us to request information about whether we have disclosed Personal Data to third parties for the third parties’ direct marketing purposes. Under the California “Shine the Light” law, California residents may opt-out of our disclosure of Personal Data to third parties for their direct marketing purposes. You may choose to opt-out of the sharing of your Personal Data with third parties for marketing purposes at any time by submitting a request to shannon@getspendly.com California users may request further information about our compliance with this law by contacting us at shannon@getspendly.com or by writing to us at the address listed in the “How to Contact Us” section.
Spendly Partners
Spendly customers (“Spendly Partners”) engage us to deliver Services to their employees, customers and other users. Partner Information, Information about our Partner’s Contacts and Archival Information (each defined below) are governed by this Privacy Policy, the Spendly Terms of Use and any other services agreements between Spendly and the applicable Partner.
We treat Partner Information, Information about our Partner’s Contacts, Archival Information and Automatically Collected Information as the confidential and proprietary information of our Spendly Partners, subject to the terms of the Spendly Terms of Use and any other service agreement between Spendly and the Partner. We do not share Partner Information, Information about our Partner’s Contacts, Archival Information or Automatically Collected Information with third parties unless directed to do so by our Partner, as may be necessary to provide services to the Partner, to our advisors, affiliates, representatives, agents, service providers, in connection with a business transaction (such as a merger or sale), as allowed under the terms of our agreement with our Partner, or in response to a court order, subpoena, warrant or to comply with a legal requirement or to cooperate with an investigation. We may disclose Partner Information, Information about our Partner’s Contacts, Archival Information or Automatically Collected Information for the aforementioned reasons, or in order to protect our rights or the rights of our affiliates, Spendly Partners, channel partners or service providers.
We will retain Partner Information we process on behalf of our Spendly Partners for as long as needed to provide services to our Partner, or for the period of time requested by a particular Partner.
Changes to this Privacy Policy
Our Privacy Policy may change from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent. We will post any privacy policy changes on this page and, if the changes are significant, we will provide a more prominent notice (including, for certain services or programs, email notification or privacy policy changes). We will also keep prior versions of this Privacy Policy in an archive for your review.
How to Contact Us
If you have any specific questions about this Privacy Policy, you can contact us via email or phone or by writing to us at the address below:
Send e-mail to: shannon@getspendly.com