We are Expend Limited, a private company that helps companies manage their expenses process. We are registered in England (no. 08531792). The registered address is 49 Greek Street, London, W1D 4EG. Expend Limited will be what is known as the ‘Controller’ of the personal data you provide to us.
At Expend, we take privacy very seriously. This policy sets out the different areas where user privacy is concerned and outlines the obligations and requirements of the users, the website, our apps and other products and services and its owners. Furthermore, the way our company processes, stores and protects user data and information will be detailed in this policy.
We gather and use certain information about individuals in order to provide products and services and to enable certain product and service functionality. We also collect information to better understand how visitors use our products and to present timely, relevant information to them.
We take the security and confidentiality of our customers’ data very seriously and we will not sell your data to third parties.
Your use of our services is subject to this privacy policy and our terms of use, including limitations on damages, arbitration of disputes, and application of UK law.
If you have any questions about this policy, please email help@expend.io or write to:
Expend Limited
49 Greek Street
London
W1D 4EG
We collect data from you when, for example:
Visit our website
Contact us to inquire about our products and services
Chat to us on our website or in one of our apps
Apply for an Expend account for your organisation
Join an organisation that uses Expend
Use an Expend card to pay for something
Create an expense report
The need and type of data we collect data depends on your role in your organisation:
An employee of an organisation that is a customer of Expend
A director, officer or person with significant control
We need to collect data because your organisation is using Expend’s services.
We need your data and the data of any of your organisation’s directors, officers or persons with significant to validate that:
Your company is a legitimate business
These persons are real
These persons have not been involved in any illegal activities
We need to store your data in order to comply with various laws in the UK and the EU.
If you are a director, officer or person with significant control, we use the following information to check that you, and other officers, directors or persons with significant control are a real people and that your company is a legitimate business:
Your name, address and date of birth
Your email address
Telephone numbers
We also require proof of address and copies of documents such as a passport or drivers license to prove your identity.
This information is passed to another organisation, Experian Ltd, to perform searches against their databases. See ‘Third party service providers with your information’ below for more information. If we require additional KYC checks, we may also provide this information to TransUnion, a credit reference agency, to perform anti-money laundering checks.
If you are an employee of an organisation that uses Expend, we use the following information to provide an expense management and payment service to your organisation.
Your name and email address
Your date of birth
We pass this data to Prepaid Financial Services to identify you as the cardholder of any Expend cards that your company orders for you. We use this information to verify that you are the same person when you activate your Expend card or retrieve your PIN code.
Every time you pay for something using your Expend card, we record the following data:
The date and time
Who you paid
The amount paid
This information is accessible to your organisation and can be viewed by certain members of your organisation. We are required to store this information for a minimum of 7 years in order to comply with financial regulations.
Expense reports contain business data. If you create an expense report, we associate the data you provide with your organisation and your organisation becomes the owner of the information. All of the information you record in an expense report is visible to members of your organisation and will be shared with any accounting platforms (such as Xero) that your organisation has linked to Expend.
If you take add an image or document to an expense, this file is uploaded to our system and associated with your organisation. The document or image can be viewed by members of your organisation and it might be added to Xero if your company is using it. These files can also be accessed when someone from your organisation downloads expenses from Expend.
We will not sell or rent your information to third parties.
We do not share your information with third parties for marketing purposes.
We do share information with third party service providers who work on our behalf to deliver our service to you. These parties are:
Xero
Experian
TransUnion
Intercom
Hubspot
Prepaid Financial Services
Amazon AWS
Convertflow
Adyen
Astrada
We use AdRoll for some of our advertising, targeting and personalization.
You can find more information here: https://www.adrollgroup.com/privacy
Adyen N.V. is the issuing bank of your Expend Visa card. They are regulated and authorised by the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) to operate as a bank in the UK. We share the following information with Adyen:
Information about your organisation
We share the following information that is available publicly:
Name of business
Company address
Company registration number
Names of directors, officers and persons of significant control
Information about you
If you have an Expend Visa card, we share the following information with Adyen:
Your name
Your date of birth
Your mobile telephone number
Your email address
We use Amazon AWS to store and process all our data. Data is stored in the EU, in Amazon’s EU West region, physically located in Ireland. Our data is encrypted at rest and that means no-one but Expend can access it because we are the only party with access to the encryption keys.
We currently use Astrada and the Payment Card Networks (Visa, Mastercard) to monitor card transactions for your participation in the Expend program. Your agreement to the various Expend Terms of Use (Terms) authorise Astrada and the Payment Card Networks to monitor the transactions made with your registered eligible payment cards via the Expend Platform. The data collected from Astrada includes your registered card identifier, merchant, transaction date/time and amount. Notwithstanding anything to the contrary in the Terms or Privacy Policy, Expend and its Third Party Service Provider (Astrada) will use transaction information solely as follows:
To create a record of the transaction data and thereafter maintain and use data in connection with operating the Platform;
To provide information in order to respond to a request from government authority or a payment organisation involved in a transaction with you or a merchant. You authorise the sharing, exchange and use of transaction data described above and herein by and among Expend and Expend’s Third Party Service Providers and applicable Payment Card Networks.
By registering a payment card in connection with transaction monitoring, you authorise Expend to share your payment card information with the Payment Card Networks so it knows you enrolled and participating in Expends’s Personal Finance Management Platform. You authorise the Payment Card Networks to monitor transactions on your registered card(s) in order to enable your usage of real time transaction data for all transactions made on an enrolled card linked through the Expend Platform. You may opt-out of transaction monitoring on the payment card(s) you have registered by navigating to your settings menu to remove your linked card(s).
Not all Visa and MasterCard cards are eligible for registration and transaction monitoring. Visa and MasterCard Corporate cards, Visa and MasterCard Purchasing cards, non-reloadable prepaid cards, and Visa- and MasterCard-branded cards whose transactions are not processed through the Visa payment system and/or MasterCard payment system are not eligible to participate.
Bit.ly is a leading link shortening and tracking tool that allows us to see the effectiveness of our social media posts when we provide links to our website or blog. We use bit.ly alongside Hubspot to help manage our social media relationships. Bit.lystores the following information about you:
IP address, browser type, your general location and cookie information. This information may be used to help us understand how users transit a website, to fight spam/malware, to facilitate collection of data concerning your interaction with the Services (e.g., what Bitly Links you have clicked on) and for other similar purposes.
You can find more information here: https://bitly.com/pages/privacy
We use Convertflow for some of our marketing activities, such as embedded popups, forms and CTAs. Visitor tracking isn't personally identifiable until associated with a form submission or a subscriber, upon which Expend will collect consent from the visitor for processing of their personal data.
Convertflow does not store IP addresses when tracking anonymous visitors. ConvertFlow only uses the IP address for geolocation, without storing the IP address in the tracking record.
If you are applying for an Expend account on behalf of your organisation, we share the following data with Experian in order to comply with legal requirements:
Name
Address and date of birth of directors, officers and persons of significant control
Copies of identification documents to check that they are legitimate
We use Facebook and Instagram to communicate with our followers organically and for advertising. We use Facebook’s pixel technology help determine when a Facebook or has converted into a customer or sales lead. Facebook does not share its user information with Expend
You can find more information here: https://www.facebook.com/business/gdpr
Personal data and cookies will be used for personalisation of ads. We use a number of Google’s tools to track and serve adverts to audiences that we believe would be interested in our products and services. These include: Google analytics, Google Adwords and display network. We also other Google owned products like YouTube to embed videos on our website, these may contain Google’s tracking technology and may also serve 3rd party adverts that YouTube control.
We use Google Document AI to extract data from receipts or invoices attached to expenses. Please review the Google Document AI Security & Compliance guide to find out more about how information is used and stored, security, and other related topics.
As Google is a vast company with a number of different products and services both for businesses such as ours and for personal users, we recommend that you visit https://policies.google.com/technologies/partner-sites for more information on how they track and manage your information.
We use Hubspot as our CRM and marketing automation system to manage our relationship with customers and sales leads, Also to acquire new customers and sales leads that have shown an intent to purchase our products both now or on a future date. We also add offline information from the likes of business cards. Hubspot helps us to understand where people have come from and what marketing and advertising campaigns have been effective. In doing so, hubspot stores the following information about you:
Name
Email address
IP address and general location data
Telephone number (if you entered it on a form before signing up for Expend)
Any other information that you may have provided to visit events, agreed to share with the event organiser and then shared with us our stand.
Cookie information
Hubspot does not store: your Date of Birth, passwords, any data that forms part of your application (mentioned above) or any financial data.
We use hubspot to send various types of emails to our contacts, these are normally welcome to Expend emails, emails to confirm demo bookings or anyone who fills out our contact us page and occasional newsletters to customers and other contacts that have opted into hearing from us. If you do not want to receive marketing information from Expend or be contacted by us, please unsubscribe from the bottom of our emails or contact us via our contact page and we will endeavor to complete any requests with in 48 hours.
Hubspot integrates with a number of other services that we use, including: Google analytics, Google Adwords, Gmail, LinkedIn, Google Calendar, Promo by Slidely, Zapier, Bit.ly and Facebook. These integrations help us to automate some of our marketing efforts and track the effectiveness of our advertising.
We also use Hubspot to manage our social media posting across, Facebook, Twitter, LinkedIn and Instagram. Hubspot records interactions with these posts for reporting purposes.
You can find more information here: https://www.hubspot.com/data-privacy/gdpr/product-readiness
We use Intercom in order to provide a real-time chat service to you in our apps. Intercom stores the following information about you:
Name
Conversation history
The IP address that your device was using when you started a conversation with us
LinkedIn is the world’s largest business networking platform and it allows our employees to make new connections for sales, partnerships and recruitment. It also allows us to advertise our products to their users and we use their supplied tracking pixel to monitor the effectiveness of our activity.
In order to enhance the accuracy and efficiency of expense categorisation, we use Mistral AI's LLM to provide automated categorisation services for user-submitted expenses. Mistral AI processes data by analysing payment transaction supplier, description and category information to assign appropriate categories. We ensure that any data shared with Mistral AI is handled securely and in compliance with our privacy standards. The information processed by Mistral AI is only used for the purpose of categorising expenses and is not shared with third parties beyond this scope.
Prepaid Financial Services (PFS) is the issuing bank of your Expend Mastercard. They are regulated and authorised by the Financial Conduct Authority, as an Electronic Money Institution, registration number 900036. We share the following information with PFS:
Information about your organisation
We share the following information that is available publicly:
Name of business
Company registration number
Names of directors, officers and persons of significant control
Information about you
If you have an Expend card, we share the following information with PFS:
Your name
Your date of birth
Your mobile telephone number
If you are applying for an Expend account on behalf of your organisation, we may also share the following data with TransUnion, a credit reference agency who will conduct anti-money laundering checks on our behalf in order to comply with legal requirements:
Name
Email Address
You may then be sent an email requesting additional documentation. For information about how TransUnion uses your data, see https://www.transunion.co.uk/legal-information/bureau-privacy-notice.
We use Twitter to communicate with our followers and share our latest news. We occasionally embed tweets that are of interest in our blogs and website, interacting with this content will share information with Twitter. We also use Twitter to advertise our products to Twitter defined segments based interests and location.
You can find more information here: https://gdpr.twitter.com/en.html
To provide certain features on the Expend platform, such as employee reimbursement payments, we integrate with Yapily Connect Ltd (“Yapily”), a third-party provider of open banking and payment initiation services.
If you choose to use this feature, we may share limited personal and financial data (such as your name, bank account details, and payment instructions) with Yapily in order to facilitate the requested transaction. This data is shared solely for the purposes of enabling and authorising payment processing, and is handled in accordance with applicable data protection laws.
We do not control Yapily’s data practices and encourage you to review their Privacy Policy for further information on how they handle your data.
We will only share such information to the extent necessary to provide the service and in accordance with this Privacy Policy.
If you or your organisation set up a link to Xero, Expend will share information with Xero:
Financial transactions associated with your Expend Account, including:
Copies of attachments (documents and images)
Comments and notes made on Expenses
Zapier provides technology to connect different tools together and allow them to communicate. This helps us to automate tasks and events that wouldn’t normally be possible. Zapier is working through their list of vendors to ensure they are adhering to GDPR as well as signing all appropriate DPAs.
You can find more information here: https://zapier.com/help/gdpr/
We are required under UK law to keep your basic personal data (name, address, contact details) and financial records for a minimum of 7 years.
Cookies are small files saved to the user’s computer hard drive that track, save and store information about the user’s interactions and usage of the website. This allows the website, through its server to provide the users with a tailored experience within this website.
You can manage cookies by pressing the "Manage Cookies" button in the footer of the website.
If at any point you believe the information we process on you is incorrect, you can request to see this information and have it corrected. You can request deletion of any data that we are not required to keep for compliance purposes. If you wish to raise a complaint on how we have handled your personal data, you can contact us to have the matter investigated at complaints@expend.io.
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law, you can complain to the Information Commissioner’s Office: https://ico.org.uk/
We may amend or change this policy at any time. The use of the information we collect at any given point is subject to the privacy policy in effect at the time of collection. We recommend you periodically check the privacy policy to make sure you understand the current policy.