Introduction

This Data Protection and Privacy Policy (the “Policy”) describes how Cardlay A/S (“us”, ”we” or ”our”) Cardlay A/S and Cardlay Payments Solutions A/S (“Cardlay”, “us”, “we” or “our”) operates, among others, www.cardlay.com, expense.cardlay.io, and www.vattax.com, and the Cardlay mobile apps offering a variety of services such as Cardlay Expense and Cardlay Card www.vattax.com, and the Cardlay mobile apps offering a variety of services such as Cardlay Expense and Cardlay Card Management (together the “Services”). This privacy policy (the “Privacy Policy”) applies to all Services offered by us and it applies to all information collected via customers’ use of our Services and our websites. Cardlay has concluded this Privacy Policy to provide relevant information on how Cardlay collects, uses, discloses, protects or otherwise processes information. Cardlay will not use or share your information with anyone except at described in this Privacy Policy.

The Policy is prepared and made available to comply with the General Data Protection Regulation (2016/679 of 27 April 2016) (the ”GDPR”) and the rules included herein on information to be provided to you.

Collecting personal data with cookies

By visiting and using our website(s), cookies are collected and used based on your consent. Information in these cookies include ("Cookiedata"):

• Browser type

• IP address

• Location at login

• Search terms on other website(s)

• Search terms on our website(s)

Cookies are small data files placed on your device that enable us to remember your preferences and collect information about your website usage. Tracking technologies, such as web beacons and pixel tags, help us understand how you interact with our site and which pages you visit.

We use Cookiebot, provided by Usercentrics A/S, to manage and document your cookie preferences.

How we use these technologies:

• Essential cookies: Necessary for the website's functionality, such as authentication and security. They do not require consent.

• Performance and analytics cookies: These collect information about how visitors use our website, which pages are visited most frequently, and if error messages are received from web pages. These cookies help us improve our website.

• Functional cookies: Enable the website to provide enhanced functionality and personalization, like remembering your preferences.

• Advertising and targeting cookies: Used to deliver advertisements more relevant to you and your interests. They are also used to limit the number of times you see an advertisement and help measure the effectiveness of the advertising campaign.

Your choices and consent
Upon your first visit, our website will present you with a cookie consent banner, where you can

• Accept all cookies: Consent to the use of all cookies and tracking technologies.

• Reject non-essential cookies: Only essential cookies will be used to provide you with necessary website functions. - Customize your preferences: Choose which categories of cookies you wish to allow

Cookiedata is used for the following:

• Administration of customer relationships in general such as orders, purchase history, invoicing, etc.

• Customer support

• Improvement of the website(s) and user experience

• Prevention of fraud, scams and illegal use of our website or services

• Prevention of unauthorized log-ins

• Targeted marketing

• Task or project management (organization and planning of work and deliveries)

• To deliver our products, services or goods

  
  

  We also use Cookies for the purpose of remembering

  • Your display preferences, such as contrast colour settings or font size

  • If you have already replied to a survey pop-up that asks you if the content was helpful or not (so you won’t be asked again)

  • If you have agreed (or not) to our use of cookies on this site

  
  

  Also, some videos embedded in our pages use a cookie to anonymously gather statistics on how you got there and what videos you watched. Enabling these cookies is not strictly necessary for the website to work but it will provide you with a better browsing experience. You can delete or block these cookies, but if you do that some features of this site may not work as intended.

  
  

  The cookie-related information is not used to identify you personally and the pattern data is fully under our control. These cookies are not used for any purpose other than those described here.

  
  

  Our use of cookies for the purpose of collecting personal data is carried out in accordance with section 3 of the Executive Order (No. 1148 of 9 December 2011).

  
  

  If you wish to limit or decline the cookies placed on your computer when visiting our website you can do so at any time by changing your browser settings. However, you should be aware that if you decline or reject cookies it will impact the functionality of the website which means that there are features on the website that you will not be able to see. Any browser allows for you to delete cookies collectively or individually. How this is done depends on the browser you use. Remember to delete the cookies in all browsers, if you use several different browsers.

  
  

  We disclose and/or share Cookie Data with: Cardlay uses Google Analytics, the popular web analytics service provided by Google, Inc. Google Analytics uses cookies to help us to analyse how users use the site. It counts the number of visitors and tells us things about their behaviour overall – such as the typical length of stay on the site or the average number of pages a user views.

  
  

  Cookies are stored on the user's device for the following duration: A Session cookie is deleted when you close your browser. Persistent cookies are stored on your digital unit and are stored for a period of one or two years

Types of personal data processed

General personal data

We process personal data about you when this is necessary and in accordance with the applicable legislation. The following data is processed:

• Account status (customer points, payments etc.)

• Address

• Age

• Customer number

• Email

• Invoicing and bookkeeping data and documentation

• IP addresses

• Name

• Password

• Telephone number

• Username

• Payment information

• Purchasing history

  
  

  We also collect payment card information, spend history (transaction data and receipt data).

  
  

  Sources of the personal data

  When relevant, personal data is collected directly from you or from external sources.

  Personal data about card holders is collected; (i) directly from the card holders; (ii) from the employers of the card holders and (iii) from the bank issuing the the payment cards

  If we need to collect more personal data than specified above, we will inform you by updating this Policy.

Purposes of processing the personal data

We will only process your personal data if we have a legitimate purpose and in that case in accordance with the rules of the GDPR. The personal data we collect about you is processed for the following purposes:

• To communicate and exchange data with public authorities when required by law

• To deliver products or services

• To facilitate a sales process

• To improve our products, services, or website

• To prevent fraudulent behavior or misuse of our products, services and website, including the processing of personal data for the purpose of legal actions

• To prevent fraudulent behavior or misuse of the IT system(s) and/or the products or services that are provided via the IT system(s)

• To provide service messages and information

• To provide support and service messages, including responding to questions and complaints and sending updates about our products and services.

• To respond to inquiries or complaints

• To send newsletters and direct marketing (such as e-mails, MMS', direct messages on social media etc.)

• To send newsletters by e-mail

• To store personal data to comply with applicable legislation requirements such as the Bookkeeping Act

Legal basis for processing personal data

General personal data

We only process your personal data when we have a legal basis to do so in accordance with the GDPR. Depending on the specific circumstances, the processing of personal data is done on the following legal basis:

• The data subjects have given consent to the processing of their personal data for one or more specific purposes

• The processing is necessary for the performance of a contract to which the data subjects is party

• The processing is necessary for the purposes of the legitimate interests where such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data

• The processing is necessary in order to take steps at the request of the data subjects prior to entering into contracts with them

• The processing is necessary to comply with a legal obligation

  
  

If we send you direct marketing, including by email, we will ask for your prior consent in accordance with the applicable rules such as marketing acts.

Disclosure and transfer of personal data

We transfer personal data to the following recipients:

• Banks (for example in connection with payments etc.)

• Collaborators

• Processors

• Suppliers

• Tax authorities (for example in connection with accounting etc.)

  
  

  The Milage functionality in Cardlay Expense activates Google Maps API(s) when finding and tracking destinations and calculating distances. Thus, when activating the Milage functionality of Cardlay Expense, the users accepts the terms of use for Google Maps API(s) available at http://www.google.com/intl/en/policies/terms.

  In the event that the transaction feed for Cardlay Expense is based on Mastercard Smart Data, the following applies: By uploading your company cards, you acknowledge that your company has obtained from individual cardholders consent as recognized under applicable law authorizing Mastercard to access and share transaction details with ExpenseCo and your company to facilitate that individual cardholder’s participation in ExpenseCo services; and that individual cardholders may revoke such consent (i.e., opt out of sharing their payment card transaction details) at any time.

  Data processed by the AI assistant “Spencer” is stored and processed by Google Gemini, and is shared with AWS, the same cloud provider used for Cardlay Expense hosting. No additional third parties are involved.

  From time to time we use external entities as suppliers to assist us in delivering our services. The external suppliers will not receive or process personal data unless applicable law allows for such transfer and processing.

  
  

Where the external parties are acting in the role of processors, the processing is always based on a data processing agreement in accordance with the requirements under GDPR.

Where the external parties are acting in the role of controllers, the processing of personal data is based on such external parties’ data privacy policy and the relevant legal bases which the external parties are obligated to inform about unless the applicable legislation allows otherwise.

Transfers outside the EU and the EEA

We do not transfer personal data to countries or international organisations outside the EU/EEA unless it is necessary on your specific request.

Erasure and retention of personal data

We ensure that the personal data is deleted when it is no longer necessary for the processing purposes described above. However, we retain your personal data to the extent that we are legally obligated, as is the case with for example accounting and bookkeeping materials and records.

If you have any questions about our retention of your personal data, you may contact us by using the email mentioned in the last section of this Policy.

Data subject rights

As a data subject under GDPR, you have a number of rights.

1. You have the right to request access to the personal data we process about you, the purposes we process the personal data, and whether we disclose or transfer your personal data to others.

2. You have the right to have incorrect information rectified.

3. You have the right to have certain personal data deleted.

4. You may have the right to restriction of our processing of your personal data.

5. You may have the right to object to our processing of your personal data based on reasons and circumstances that pertain to your particular situation.

6. You have the right not to be subject to a decision based solely on automated means, without human interference unless the decision (1) is necessary for entering into, or performance of a contract between you and the Organization, (2) is authorised by law, or (3) is based on your explicit consent.

7. If the processing of your personal data is based on your consent, you are entitled to withdraw such consent at any time. Withdrawal of your consent will not affect the lawfulness of the processing carried out prior to your withdrawal.

8. You are entitled to receive personal data which you have provided to us in a structured, commonly used, and machine-readable format (data portability).

9. You can always lodge a complaint with the data protection authority.

   
   

Your rights may be subject to conditions or restrictions. Accordingly, there is no certainty that you will be entitled to for example data portability in the specific situation; it will depend on the circumstances of the processing.

More information about data subject rights can be found in the guidelines of the national data protection authorities.

Please use the contact details below if you want to use your rights.

We try to meet your wishes about our processing of personal data, but you can always file a complaint to the data protection authorities.

Changes to this Policy

We reserve the right to update and amend this Policy. If we do, we correct the date and the version at the top of this Policy. If we make significant changes, we will provide notification by way of a visible notice, for example on our website or by direct message.

Contact

You may contact us at the below specified email if you:

a) disagree with our processing or consider our processing of yourpersonal data infringes on the law, b) have questions or comments to this Policy, or
c) want to invoke one or more of your rights as a data subject described in this Policy.

If you have questions or comments to this Policy or if you would like to invoke one or more data subject rights, please contact us at In case you have any questions or comments to this Privacy Policy please contact us by email to compliance@cardlay.com