| Before | After | ||
|---|---|---|---|
| 2 | Applicability of this Privacy Policy & Ramp’s Business 3. | 2 | Scope of this Privacy Policy 3. |
| 3 | Personal Information Ramp Processes A. | 3 | Personal Data Ramp Processes A. |
| 4 | Personal Information Provided Directly to Ramp B. | 4 | Product-Specific Collection B. |
| 5 | Personal Information Generated and Collected Automatically by Ramp C. | 5 | Personal Data Provided Directly to Ramp C. |
| 6 | Personal Information Collected by Ramp from Other Sources 4. | 6 | Personal Data Generated and Collected Automatically by Ramp D. |
| 7 | How We Use Personal Information 5. | 7 | Personal Data Collected by Ramp from Other Sources 4. |
| 8 | Disclosure of Personal Information by Ramp 6. | 8 | How We Use Personal Data 5. |
| 9 | Disclosure of Personal Data by Ramp 6. | ||
| 14 | Lawful Basis for Processing Personal Information 9. | 15 | Lawful Basis for Processing Personal Data 9. |
| 15 | Security 10. | 16 | Automated Decision-Making and Artificial Intelligence 10. |
| 16 | Use by Minors 11. | 17 | Security 11. |
| 17 | Retention 12. | 18 | Use by Minors 12. |
| 18 | Changes to this Privacy Policy 13. | 19 | Retention 13. |
| 19 | Contact Us; Data Controller 14. | 20 | Changes to this Privacy Policy 14. |
| 21 | Contact Us; Data Controller 15. | ||
| 22 | Notice of Financial Incentives 15. | 24 | Notice of Financial Incentives 16. |
| 23 | Additional Information for Canadian Residents Data Transfers from Quebec Data Disclosure to Telecommunications Carriers 16. | 25 | Additional Information for Canadian Residents Data Transfers from Quebec Data Disclosure to Telecommunications Carriers 17. |
| 24 | Additional Information for UK Residents Last Updated: July 24, 2026 1. | 26 | Additional Information for UK Residents Last Updated: August 21, 2026 1. |
| 26 | Introduction Ramp is on a mission to help finance teams build healthier businesses. | 28 | Introduction Ramp is on a mission to help finance teams build healthier businesses. |
| 28 | Our Privacy Policy explains how we manage data that identifies or that could reasonably identify or be linked to an individual, household, or device ( "Personal Information" ). | 30 | This Privacy Policy explains how we manage personal data. |
| 30 | However, we collect and process Personal Information in a commercial context to provide our products and services to our business customers and to operate our business. | 32 | We collect and process personal data in a commercial context to provide our products and services to our business customers and to operate our business. |
| 31 | We want you to understand how we collect, use, and disclose Personal Information, and your rights and choices regarding your Personal Information, including the right to object to certain types of processing we carry out (for more information see Section 6 - Your Rights and Choices below). | 33 | We want you to understand how we collect, use, and disclose personal data, and your rights and choices regarding your personal data, including the right to object to certain types of processing we carry out (for more information see Section 6 - Your Rights and Choices below). |
| 34 | You can also visit Section 13 - Contact Us; Data Controller below for more information. 2. | 36 | You can also visit Section 14 - Contact Us; Data Controller below for more information. 2. |
| 35 | Applicability of this Privacy Policy & Ramp’s Business Permanent link: 2. | 37 | Scope of this Privacy Policy Permanent link: 2. |
| 36 | Applicability of this Privacy Policy & Ramp’s Business This Privacy Policy applies to certain information we collect and process as a Controller (defined below) about you when you use or interact with: our corporate card and expense management, travel, procurement, treasury, accounts payable, and other services, including the associated technology we provide for access to and use of those services (e.g., app.ramp.com and our mobile applications) (the "Services" ); www.ramp.com (the "Website" ); and our social media, emails, newsletters, advertisements, and other locations or platforms, online or offline, where you interact with our business (collectively, with the Services and Website, the "Business" ). | 38 | Scope of this Privacy Policy This Privacy Policy applies to personal data we collect and process about you as a Controller (defined below) when you use or interact with: our platform and apps, which include corporate cards and spend management, travel, procurement, banking, accounts payable, accounts receivable, Token Spend Management, Stack, Glass, and other related services and technology (e.g., app.ramp.com and our mobile applications) (the "Services" ); www.ramp.com (the "Website" ); and our social media, emails, newsletters, advertisements, and other locations or platforms, online or offline, where you interact with our business (collectively, with the Services and Website, the "Business" ). |
| 37 | Information we collect when you attend a Ramp event or conference is subject to the Ramp Events Privacy Notice . | 39 | Personal data we collect through Router is subject to the Router Privacy Notice . |
| 38 | Data protection laws distinguish between entities that control the purposes and means of processing Personal Information ( "Controllers" ) and entities that process Personal Information on behalf of other entities ( "Processors" ). | 40 | Personal data we collect when you attend a Ramp event or conference is subject to the Ramp Events Privacy Notice . |
| 39 | The Ramp Platform Agreement and our other terms and addenda (the "Agreement" ), along with the terms and conditions of our Financial Institution Partners, governs our provision of Services to a business customer (a "Company" ). | 41 | Data protection laws distinguish between entities that control the purposes and means of processing personal data ( "Controllers" ) and entities that process personal data on behalf of others ( "Processors" ). |
| 40 | When Ramp processes Personal Information on behalf of a Company to provide contracted Services, we do so in accordance with the terms of the Agreement and the Customer's instructions, not this Privacy Policy. | 42 | The Ramp Platform Agreement , SaaS Agreement and our other terms and addenda (each, as applicable, an "Agreement" ), and the terms and conditions of our Financial Institution Partners, govern our provision of Services to business customers (each a "Company" ). |
| 41 | If you wish to exercise your rights regarding Personal Information we are processing on behalf of a Company, you should contact the applicable Company for assistance, and if we receive a request intended for the Company, we will forward communications we receive from you to the Company for resolution. | 43 | When we process personal data on behalf of a Company as a Processor, we do so in accordance with the terms of the Agreement and the Company's instructions, not this Privacy Policy. |
| 42 | Ramp is not responsible for the privacy practices of any Companies, which may differ from those in our Privacy Policy. | 44 | If you wish to exercise your rights regarding personal data we process as a Processor, you should contact the relevant Company for assistance. |
| 43 | This Privacy Policy does not apply to any third-party applications or services that are used in connection with Ramp Services, or any other products, services, or accounts provided by other entities under their own terms and conditions or privacy policy (collectively, "Third-Party Services" ). | 45 | If we receive a request intended for the Company, we will forward communications we receive from you to the Company for resolution. |
| 46 | Ramp is not responsible for the privacy practices of any Companies, which may differ from our own. | ||
| 47 | This Privacy Policy does not apply to third-party applications or services used in connection with Ramp Services, or any other products, services, or accounts provided by other entities under their own terms and conditions or privacy policy (collectively, "Third-Party Services" ). | ||
| 47 | Personal Information Ramp Processes Permanent link: 3. | 51 | Personal Data Ramp Processes Permanent link: 3. |
| 48 | Personal Information Ramp Processes Ramp processes Personal Information to deliver Services to you and to operate our Business (as described in the Agreement). | 52 | Personal Data Ramp Processes Ramp processes personal data to deliver Services to you and to operate our Business. |
| 49 | A. | 53 | The personal data we process depends on who you are, how you interact with us, which products your Company chooses, and which features and settings you use. |
| 50 | Personal Information Provided Directly to Ramp Permanent link: A. | 54 | The table below provides an overview of the relevant person, product or interaction, data categories, and purposes. |
| 51 | Personal Information Provided Directly to Ramp The Services are intended for use by Companies and their employees and other authorized users ( "Authorized Users" ). | 55 | Not every category applies to every person or product. |
| 52 | If you or someone at your Company begins the process of applying for a Ramp Account, we may receive Personal Information about you, your Company, and individuals associated with your Company. 1. | 56 | Additional detail is included in the remainder of this Section. |
| 53 | Personal Information You Provide to Us Permanent link: 1. | 57 | Person or interaction Products or context Personal data we may process Main purposes Business applicants, owners, control persons, guarantors, and other Company representatives involved in an application Applications for corporate cards, credit, deposit or treasury products, payment services, and other regulated financial products Name; business contact information; date of birth; residential address; citizenship; tax or government identifiers; photograph; biometrics (faceprint); government-issued identification and information captured from it; ownership or control information; employer, title, and role; financial, credit, and business information; application and underwriting information; device and fraud-risk signals; audio and/or video call recordings (unless you opt out or do not consent) Verify identity and authority; satisfy know-your-customer, anti-money-laundering, sanctions, and other legal requirements; assess Company eligibility and risk; detect and prevent fraud, security incidents, and policy and legal violations; comply with legal obligations; open and administer the selected financial product Company administrators and Authorized Users, including spend management, bill pay, reimbursements, accounts payable, accounts receivable, procurement, or related payment features Ramp account product and feature use and administration, including AI-enabled products Name; business contact information; address; employer, title, and role; permissions and login credentials; email, SMS, or search communications; product settings; files and other content submitted or connected to the Services; prompts, queries, instructions, and outputs associated with AI-enabled features; browser, device, and network information; approximate location data; connected data from third-party applications or accounts connected to your Ramp account; audio and/or video call recordings (unless you opt out or do not consent); biometric data (account recovery); transaction data; receipts, invoices, contracts, and purchase orders; tax documentation; bank account details; precise geolocation data (optional for mileage reimbursement); product usage data; business travel booking information (name, email, date of birth, gender; phone number; known traveler or redress number; and loyalty or rewards number); itinerary, booking, and approximate location information; travel preferences and support communications; product feedback Create and secure accounts; authenticate users; configure permissions and workflows; provide the selected software and AI-enabled functionality; generate requested outputs; provide support; operate, maintain, and improve the selected Services; communicate about the account; detect and prevent fraud, security incidents, and policy and legal violations; comply with legal obligations; authorize and process transactions; administer cards and spend controls; pay bills and reimbursements; reconcile and code transactions; manage vendors and purchasing; detect errors, fraud, and policy violations; provide reporting and support; complete travel bookings, reservations and communication; search, book, change, and support business travel; apply Company travel policies; provide itinerary and expense-management features; communicate with travel providers Vendors, payees, merchants, contractors, and other transaction counterparties Bill pay, accounts payable, accounts receivable, procurement, card, and payment features Name and business contact information; payment and bank-account details; contracts, invoices, and purchase orders; tax classification and tax identification information; transaction status and communications; product feedback Verify vendors; send and receive payments; communicate about payments; operate, maintain, and improve the selected Services; communicate about the account; detect and prevent fraud, security incidents, and policy and legal violations; comply with legal obligations Company administrators and Authorized Users (SaaS) AI product and feature use and administration (Stack, Token Spend Management, Glass) Name and business contact information; permissions, role, and account credentials; connected account information; browser, device, and network information; AI prompts, outputs, and related metadata; artifacts and content uploaded to the Service; approximate geolocation; product feedback Create and secure accounts; authenticate users; configure permissions and workflows; provide the selected software and AI-enabled functionality; generate requested outputs; provide support; operate, maintain, and improve the selected Services; communicate about the account; detect and prevent fraud, security incidents, and policy and legal violations; comply with legal obligations Website visitors, prospects, referral contacts, and social-media users Website, advertising, sales, referrals, newsletters, and social media Contact and professional information; communications; referral source; cookie, device, browser, IP-address, approximate location, advertising identifier, website-use, and campaign-engagement data; public profile information Respond to requests; provide demonstrations and sales communications; understand and improve the Website; measure campaigns; advertise Ramp products; prevent abuse and secure the Website; honor privacy choices Support contacts, event participants, and other people who communicate with Ramp Customer support, research, surveys, sales calls, events, and other business communications Contact and professional information; communications and product feedback; files or other content provided; audio or video recordings where disclosed and permitted; event registration information, including dietary or accessibility information you choose to provide Respond to requests; provide support; train and improve our teams and Services; administer events; keep business and compliance records; honor recording choices A. |
| 54 | Personal Information You Provide to Us We collect and process Personal Information when you submit it to our Business, including: Contact Information, including your name, email address, phone number, employer, job title, and address; Identity Verification & Risk Information, including Personal Information of the Company’s owners, control persons, and other relevant Company personnel, such as their name, email address, phone number, employer, job title, date of birth, residential address, country of citizenship, photograph, social security number, driver's license, passport or other government-issued identification, and any other information captured on the government identification or through our identity verification process, and other Personal Information requested by or provided to us as part of the application and underwriting processes. | 58 | Product-Specific Collection Permanent link: A. |
| 59 | Product-Specific Collection 1. | ||
| 60 | Financial Products and Services Permanent link: 1. | ||
| 61 | Financial Products and Services We collect identity-verification, ownership, control-person, financial, credit, and risk information when it is needed for an application for or use of a regulated financial product or service, or when required by our Financial Institution Partners or applicable law. | ||
| 62 | The exact information depends on the product, the Company's structure, the individual's role, and the applicable legal requirements. 2. | ||
| 63 | SaaS Products Permanent link: 2. | ||
| 64 | SaaS Products If a Company signs up only for a Ramp SaaS product that does not include a regulated financial product, Ramp does not collect know-your-customer or underwriting information solely to provide that SaaS product, but we may collect certain information for identity verification and anti-fraud measures. | ||
| 65 | We may collect ordinary account, user, security, product-use, support, and Company-provided or connected content needed to provide the software. | ||
| 66 | For AI-enabled features, this may include prompts, outputs, related metadata, source materials, configuration information, which may contain personal data. | ||
| 67 | We process personal data included in this information to provide, secure, support, maintain, and improve the applicable product; detect and prevent fraud, abuse, or security incidents; manage our business; and comply with our legal obligations. | ||
| 68 | Before using Company Content to train a general-purpose or generative artificial-intelligence model for use across customers, Ramp will provide required notices and obtain required permissions as applicable. | ||
| 69 | Product-specific terms, notices, or settings may describe additional information about model training, human review, retention, and available choices. | ||
| 70 | The sections below provide additional detail about the categories and sources of personal data we process. | ||
| 71 | B. | ||
| 72 | Personal Data Provided Directly to Ramp Permanent link: B. | ||
| 73 | Personal Data Provided Directly to Ramp The Services are intended for use by Companies and their employees and other authorized users ( "Authorized Users" ). | ||
| 74 | If you or someone at your Company creates an account, we may receive ordinary account and user information about you, your Company, and individuals associated with your Company. | ||
| 75 | If the Company also applies for or enables a regulated financial product, we may receive the additional identity-verification, ownership, underwriting, and risk information needed for that product. 1. | ||
| 76 | Personal Data You Provide to Us Permanent link: 1. | ||
| 77 | Personal Data You Provide to Us We collect and process personal data when you submit it to our Business, including: Contact Information, including your name, email address, phone number, employer, job title, and address; Identity Verification & Risk Information, where relevant to an application for or use of a regulated financial product, including personal data of the Company’s owners, control persons, and other relevant Company personnel, such as their name, email address, phone number, employer, job title, date of birth, residential address, country of citizenship, photograph, social security number, driver's license, passport or other government-issued identification, and any other information captured on the government identification or through our identity verification process, and other personal data requested by or provided to us as part of the application and underwriting processes. | ||
| 56 | Content, including any documentation, files, or information you provide, which may include Personal Information about you. | 79 | Content, including any documentation, files, or information you provide, which may include personal data about you. |
| 57 | Third-Party Information, including Personal Information you provide about any co-workers, contractors, vendors, or potential referrals, such as their name, email address, phone number, employer, job title, or address. | 80 | Third-Party Information, including personal data you provide about any co-workers, contractors, vendors, or potential referrals, such as their name, email address, phone number, employer, job title, or address. |
| 59 | Personal Information We Collect about Authorized Users Permanent link: 2. | 82 | Personal Data We Collect about Authorized Users Permanent link: 2. |
| 60 | Personal Information We Collect about Authorized Users In connection with providing Services, we collect and process additional Personal Information of Authorized Users submitted by, on behalf of, and relating to a Company’s Authorized Users, such as: Authorized User Personal Information, including your name, email, phone number, address, employer, job title, login credentials, and other information used by your Company to invite and manage Authorized Users. | 83 | Personal Data We Collect about Authorized Users In connection with providing Services, we collect and process additional personal data of Authorized Users submitted by, on behalf of, and relating to a Company’s Authorized Users, such as: Authorized User personal data, including your name, email, phone number, address, employer, job title, login credentials, and other information used by your Company to invite and manage Authorized Users. |
| 61 | Transaction Data, including information associated with your bill payments, reimbursements, and card transactions made through your Company's Ramp Account, whether online or in person, which may include Personal Information. | 84 | Transaction Data, including information associated with your bill payments, reimbursements, and card transactions made through your Company's Ramp Account, whether online or in person, which may include personal data. |
| 85 | Token Spend Management Data, including payment-token identifiers and lifecycle information, the related card or account identifiers, device or merchant information, transaction authorization data, authentication events, and fraud and security signals. | ||
| 65 | In addition, some Third-Party Services (e.g., accounting systems and business bank accounts) will provide us with information about activities outside of the Services, which may include Personal Information, like your business expenses and your Company's external transactions. | 89 | In addition, some Third-Party Services (e.g., accounting systems and business bank accounts) will provide us with information about activities outside of the Services, which may include personal data, like your business expenses and your Company's external transactions. |
| 66 | Other Third-Party Services, like your Company's HRIS, may disclose Personal Information of Authorized Users, and if your Company connects its email service, we may receive your email communications and attachments for processing. | 90 | Other Third-Party Services, like your Company's HRIS, may disclose personal data of Authorized Users, and if your Company connects its email service, we may receive your email communications and attachments for processing. |
| 71 | Receipt and Invoice Data, including information you submit to us to pay Company invoices and process your receipts, which may include Personal Information, such as photos, PDFs, and the contents of e-mails, and SMS messages, if you opt-in to text messages, along with associated metadata. | 95 | Receipt and Invoice Data, including information you submit to us to pay Company invoices and process your receipts, which may include personal data, such as photos, PDFs, and the contents of e-mails, and SMS messages, if you opt-in to text messages, along with associated metadata. |
| 72 | Vendor Data, including the identity of vendors, which may include Personal Information, such as their contact information, including their name, email, phone number and address, payment details, contracts and purchase orders, and information to complete tax documentation (e.g., the vendor's tax classification and tax identification number). | 96 | Vendor Data, including the identity of vendors, which may include personal data, such as their contact information, including their name, email, phone number and address, payment details, contracts and purchase orders, and information to complete tax documentation (e.g., the vendor's tax classification and tax identification number). |
| 73 | B. | 97 | C. |
| 74 | Personal Information Generated and Collected Automatically by Ramp Permanent link: B. | 98 | Personal Data Generated and Collected Automatically by Ramp Permanent link: C. |
| 75 | Personal Information Generated and Collected Automatically by Ramp 1. | 99 | Personal Data Generated and Collected Automatically by Ramp 1. |
| 77 | When You Use or Interact with Our Business We collect and process Personal Information of Authorized Users and other individuals, as applicable, when you use or interact with our Website, Services, and other products and services provided or used by our Business: Use Data, including information and metadata about the pages or content you visit, the features you interact with, the workflows you construct, how much time you spend on a particular Website or using the Services, login and crash data, Third-Party Services you elect to connect to or use with the Services ( "Connected Data" ), your preferences or selections, the time of day you browse, and your referring and exiting pages. | 101 | When You Use or Interact with Our Business We collect and process personal data of Authorized Users and other individuals, as applicable, when you use or interact with our Website, Services, and other products and services provided or used by our Business: Use Data, including information and metadata about the pages or content you visit, the features you interact with, the workflows you construct, how much time you spend on a particular Website or using the Services, login and crash data, Third-Party Services you elect to connect to or use with the Services ( "Connected Data" ), your preferences or selections, the time of day you browse, and your referring and exiting pages. |
| 102 | SaaS and AI Product Data, including information about workspaces, projects or spaces, skills, tools, workflows, sharing settings, product interactions, prompts, messages, queries, instructions, files, connected records, generated outputs, feedback, and feature-performance or diagnostic information. | ||
| 87 | Some events may have different or additional terms or privacy policies, which we will make available to you at or before the time we collect Personal Information for those events. | 112 | Some events may have different or additional terms or privacy policies, which we will make available to you at or before the time we collect personal data for those events. |
| 89 | C. | 114 | D. |
| 90 | Personal Information Collected by Ramp from Other Sources Permanent link: C. | 115 | Personal Data Collected by Ramp from Other Sources Permanent link: D. |
| 91 | Personal Information Collected by Ramp from Other Sources We also collect and process Personal Information of Authorized Users and other individuals, as applicable, from other sources, including: Financial Institution Partners, including banks (e.g., the bank issuing your Company's card or originating loans to finance Company expenses), card networks, payment processors, money transmitters, and other entities that provide or support delivery of financial services. | 116 | Personal Data Collected by Ramp from Other Sources We also collect and process personal data of Authorized Users and other individuals, as applicable, from other sources, including: Financial Institution Partners, including banks (e.g., the bank issuing your Company's card or originating loans to finance Company expenses), card networks, payment processors, money transmitters, and other entities that provide or support delivery of financial services. |
| 93 | This may include information such as your name, address(es), phone number(s), photograph, government ID, device information, or other Personal Information required to verify your identity, detect and prevent fraud, and comply with our legal obligations. | 118 | This may include information such as your name, address(es), phone number(s), photograph, government ID, device information, or other personal data required to verify your identity, detect and prevent fraud, and comply with our legal obligations. |
| 96 | That information may include Personal Information. | 121 | That information may include personal data. |
| 97 | Service Providers, which help us operate our Business and which may collect and process Personal Information depending on the services they provide and your interactions and choices with respect to our Services and Websites. | 122 | Service Providers, which help us operate our Business and which may collect and process personal data depending on the services they provide and your interactions and choices with respect to our Services and Websites. |
| 98 | Social Networks, Advertising Providers, and Private Databases, which help us to identify and enrich our understanding of prospective customers and to serve and measure advertising, provide us with Personal Information that may include your name, email, phone number, mailing address, gender, age, and other demographic data. | 123 | Social Networks, Advertising Providers, and Private Databases, which help us to identify and enrich our understanding of prospective customers and to serve and measure advertising, provide us with personal data that may include your name, email, phone number, mailing address, gender, age, and other demographic data. |
| 99 | We also receive Personal Information when you interact with our pages, groups, accounts, and posts on social media platforms, which generally includes aggregate data about our followers (e.g., age, gender and location), engagement data (e.g., “likes,” comments, shares, reposts, and clicks), and awareness data (e.g., number of impressions and reach), as well as individual users’ public profiles. | 124 | We also receive personal data when you interact with our pages, groups, accounts, and posts on social media platforms, which generally includes aggregate data about our followers (e.g., age, gender and location), engagement data (e.g., “likes,” comments, shares, reposts, and clicks), and awareness data (e.g., number of impressions and reach), as well as individual users’ public profiles. |
| 100 | Joint Marketing, Business Partnerships, Referrals, and Rewards Partners that we engage for joint marketing activities and our referrals and rewards programs, which may share information, including Personal Information, about overlapping customers, such as their contact information and services they acquire. | 125 | Joint Marketing, Business Partnerships, Referrals, and Rewards Partners that we engage for joint marketing activities and our referrals and rewards programs, which may share information, including personal data, about overlapping customers, such as their contact information and services they acquire. |
| 101 | Publicly-Available Sources, including information in the public domain that helps us identify potential customers and partners or conduct due diligence and risk management for potential and existing customers, such as Personal Information about a company’s personnel on its website or in news articles and press releases. | 126 | Publicly-Available Sources, including information in the public domain that helps us identify potential customers and partners or conduct due diligence and risk management for potential and existing customers, such as personal data about a company’s personnel on its website or in news articles and press releases. |
| 102 | The categories of Personal Information we collect and receive from these sources may include all of the categories identified above in this section under "Personal Information Provided Directly to Ramp" and "Personal Information Generated and Collected Automatically by Ramp" . | 127 | The categories of personal data we collect and receive from these sources may include all of the categories identified above in this section under "Personal Data Provided Directly to Ramp" and "Personal Data Generated and Collected Automatically by Ramp" . |
| 103 | We treat the Personal Information obtained from other sources in accordance with any laws or contractual obligations applicable to us. 4. | 128 | We treat the personal data obtained from other sources in accordance with any laws or contractual obligations applicable to us. 4. |
| 104 | How We Use Personal Information Permanent link: 4. | 129 | How We Use Personal Data Permanent link: 4. |
| 105 | How We Use Personal Information We use Personal Information for business and commercial purposes in accordance with the practices described in this Privacy Policy and to operate our Business as follows: To Provide and Maintain Our Business. | 130 | How We Use Personal Data We use each category of personal data only for purposes that are relevant to the applicable person, product, and interaction described in Section 3. |
| 131 | These business and commercial purposes include: To Provide and Maintain Our Business. | ||
| 134 | To Provide Token Spend Management. | ||
| 135 | To provision, manage, secure, support, and reconcile token-based spend-management functionality; enable authorized transactions; administer related controls; and detect and prevent fraud, misuse, and security incidents. | ||
| 136 | To Provide SaaS and AI-Enabled Products. | ||
| 137 | To respond to prompts, messages, queries, instructions, and other user requests; generate and deliver requested outputs; administer workspaces, sharing, skills, tools, and connected services; troubleshoot and improve product performance; and detect, prevent, and investigate misuse, policy violations, fraud, and security incidents. | ||
| 130 | When these Offers are made available, we will provide you with a description of the Offer and related material terms, including how you can opt in (if applicable) and the categories of Personal Information collected in connection with the offer but not described here, which may include your name, email, and other Personal Information. | 160 | When these Offers are made available, we will provide you with a description of the Offer and related material terms, including how you can opt in (if applicable) and the categories of personal data collected in connection with the offer but not described here, which may include your name, email, and other personal data. |
| 139 | We may otherwise use Personal Information we collect after providing notice to you and obtaining your consent. | 169 | We may otherwise use personal data we collect after providing notice to you and obtaining your consent. |
| 140 | For information about your rights and choices regarding how we use your Personal Information, please see Section 6 - Your Rights and Choices below. 5. | 170 | For information about your rights and choices regarding how we use your personal data, please see Section 6 - Your Rights and Choices below. 5. |
| 141 | Disclosure of Personal Information by Ramp Permanent link: 5. | 171 | Disclosure of Personal Data by Ramp Permanent link: 5. |
| 142 | Disclosure of Personal Information by Ramp We disclose Personal Information we collect in accordance with this Privacy Policy. | 172 | Disclosure of Personal Data by Ramp We disclose personal data we collect in accordance with this Privacy Policy. |
| 143 | The categories of parties to whom we disclose Personal Information are listed below. | 173 | The categories of parties to whom we disclose personal data are listed below. |
| 146 | We disclose Personal Information to affiliates and related entities ↗ of Ramp Business Corporation. | 176 | We disclose personal data to affiliates and related entities ↗ of Ramp Business Corporation. |
| 148 | We disclose Personal Information to service providers that process information on our behalf. | 178 | We disclose personal data to service providers that process information on our behalf. |
| 150 | Depending on the service, we may provide Personal Information on a continuous basis (e.g., fraud services) or on an as-needed basis. | 180 | For SaaS and AI-enabled products, service providers may include model providers, hosting and infrastructure providers, safety and content-monitoring providers, and providers that support connectors, search, tools, and technical support. |
| 151 | We impose contractual restrictions on our service providers’ processing of Personal Information, although we may permit them to use information that does not identify you (such as information that has been aggregated, de-identified, or anonymized) subject to applicable law. | 181 | We disclose content and other personal data to these providers only as needed to provide, secure, support, and improve the applicable Service, at your or your Company’s direction where applicable, or as otherwise described in the applicable agreement or notice. |
| 182 | Depending on the service, we may provide personal data on a continuous basis (e.g., fraud services) or on an as-needed basis. | ||
| 183 | We impose contractual restrictions on our service providers’ processing of personal data, although we may permit them to use information that does not identify you (such as information that has been aggregated, de-identified, or anonymized) subject to applicable law. | ||
| 154 | We disclose Personal Information to your Company so that we can provide Services on the Company’s behalf. | 186 | We disclose personal data to your Company so that we can provide Services on the Company’s behalf. |
| 155 | For example, we may disclose Personal Information to your Company to process your payment transactions, provide Services, report on your use of your Company's Ramp Account, respond to your and their questions, comply with your and their requests, and otherwise comply with the law. | 187 | For example, we may disclose personal data to your Company to process your payment transactions, provide Services, report on your use of your Company's Ramp Account, respond to your and their questions, comply with your and their requests, and otherwise comply with the law. |
| 157 | We will disclose some Personal Information about your use of the Services to other Authorized Users within, or individuals acting on behalf of, your Company. | 189 | We will disclose some personal data about your use of the Services to other Authorized Users within, or individuals acting on behalf of, your Company. |
| 159 | Each Company is an independent entity, and the Company’s processing of Personal Information is subject to the Company’s own policies and terms. | 191 | Each Company is an independent entity, and the Company’s processing of personal data is subject to the Company’s own policies and terms. |
| 192 | SaaS Product Administrators and Authorized Users. | ||
| 193 | Where enabled by a Company, Company administrators and other Authorized Users may be able to access, manage, export, retain, or delete account information, workspaces, prompts, messages, files, connected data, generated outputs, and other content associated with Stack, Glass, or another SaaS or AI-enabled product. | ||
| 194 | The Company is responsible for configuring access and sharing permissions and providing any notices required for its administration of those products. | ||
| 161 | We disclose Personal Information to Third-Party Services and their providers if you or your Company choose to use Third-Party Services in connection with the Services, such as Slack, Uber, Google, or NetSuite. | 196 | We disclose personal data to Third-Party Services and their providers if you or your Company choose to use Third-Party Services in connection with the Services, such as Slack, Uber, Google, or NetSuite. |
| 163 | We disclose Personal Information to Financial Institution Partners, such as banks, card networks, and payment processors, to support their customer identification, risk, and compliance programs, and so they can determine eligibility for, and provide, products and services to your Company, either directly or through us. | 198 | We disclose personal data to Financial Institution Partners, such as banks, card networks, and payment processors, to support their customer identification, risk, and compliance programs, and so they can determine eligibility for, and provide, products and services to your Company, either directly or through us. |
| 167 | We disclose Personal Information about your Company and its Ramp Account to credit reporting agencies to verify information about your Company, to report on your Company's performance, and to report late payments, missed payments, or other defaults. | 202 | We disclose personal data about your Company and its Ramp Account to credit reporting agencies to verify information about your Company, to report on your Company's performance, and to report late payments, missed payments, or other defaults. |
| 168 | While this information is generally about the Company, it may include Personal Information. | 203 | While this information is generally about the Company, it may include personal data. |
| 170 | We disclose Personal Information to entities that transact with or support your Company. | 205 | We disclose personal data to entities that transact with or support your Company. |
| 171 | For example, we may disclose the status of your Company's payments to the recipient vendor, which may include Personal Information, such as contact information. | 206 | For example, we may disclose the status of your Company's payments to the recipient vendor, which may include personal data, such as contact information. |
| 173 | We disclose Personal Information about you and your Company's Ramp Account as necessary to determine your Company's eligibility for rewards and to facilitate the rewards program effectively. | 208 | We disclose personal data about you and your Company's Ramp Account as necessary to determine your Company's eligibility for rewards and to facilitate the rewards program effectively. |
| 175 | We disclose Personal Information to agencies, advertisers, ad networks, and other technology services to conduct analytics and to place advertisements on our behalf on third-party websites and services. | 210 | We disclose personal data to agencies, advertisers, ad networks, and other technology services to conduct analytics and to place advertisements on our behalf on third-party websites and services. |
| 178 | We disclose Personal Information about you and your Company's Ramp Account to our partners in connection with facilitating referral partnerships or engaging in joint marketing activities. | 213 | We disclose personal data about you and your Company's Ramp Account to our partners in connection with facilitating referral partnerships or engaging in joint marketing activities. |
| 179 | For example, if you or your Company were referred to us through a referral partner, we may disclose Personal Information to our referral partner to confirm the status of your application and to calculate the referral fee. | 214 | For example, if you or your Company were referred to us through a referral partner, we may disclose personal data to our referral partner to confirm the status of your application and to calculate the referral fee. |
| 181 | We may disclose Personal Information to an acquiring entity, legal counsel, consultants, or others in connection with, or during negotiations of, any proposed or actual merger, purchase, sale, or any other type of acquisition or business combination of all or any portion of our assets or transfer of all or a portion of our business to another business. | 216 | We may disclose personal data to an acquiring entity, legal counsel, consultants, or others in connection with, or during negotiations of, any proposed or actual merger, purchase, sale, or any other type of acquisition or business combination of all or any portion of our assets or transfer of all or a portion of our business to another business. |
| 183 | We disclose Personal Information to third-party services that help us verify your and your Company’s identity and perform other compliance functions. | 218 | We disclose personal data to third-party services that help us verify your and your Company’s identity and perform other compliance functions. |
| 184 | In addition, to prevent fraud and safeguard our customers and Business, we disclose information to risk and security partners, including Personal Information about interactions with our Services and transactions. | 219 | In addition, to prevent fraud and safeguard our customers and Business, we disclose information to risk and security partners, including personal data about interactions with our Services and transactions. |
| 186 | We may disclose Personal Information to public authorities, such as financial services or other regulators to comply with applicable law, payment network rules, and legal process, to investigate suspicious or potentially fraudulent activity, and where required in response to lawful requests by regulators, courts, law enforcement, and other public authorities, including to meet national security, anti-money laundering, or law enforcement requirements. | 221 | We may disclose personal data to public authorities, such as financial services or other regulators to comply with applicable law, payment network rules, and legal process, to investigate suspicious or potentially fraudulent activity, and where required in response to lawful requests by regulators, courts, law enforcement, and other public authorities, including to meet national security, anti-money laundering, or law enforcement requirements. |
| 187 | We may also disclose Personal Information to protect the rights, property, life, health, security, and safety, as applicable, of us, the Services, our Business, or others. | 222 | We may also disclose personal data to protect the rights, property, life, health, security, and safety, as applicable, of us, the Services, our Business, or others. |
| 188 | For information about your rights and choices regarding how we share Personal Information about you, please see Section 6 - Your Rights and Choices below. 6. | 223 | For information about your rights and choices regarding how we share personal data about you, please see Section 6 - Your Rights and Choices below. 6. |
| 194 | You should direct questions about Personal Information we are processing on behalf of a Company to that Company and its administrators. | 229 | You should direct questions about personal data we are processing on behalf of a Company to that Company and its administrators. |
| 195 | If you are an Authorized User, you may also be able to access, update, or delete certain Personal Information within your Company's Ramp account through the Services. | 230 | If you are an Authorized User, you may also be able to access, update, or delete certain personal data within your Company's Ramp account through the Services. |
| 196 | However, the Company and its administrators are generally responsible for determining how that Personal Information is processed. | 231 | However, the Company and its administrators are generally responsible for determining how that personal data is processed. |
| 197 | Subject to limitations under applicable law, residents of certain jurisdictions have rights and choices with respect to your Personal Information, including the right to: Know what Personal Information we process about you and to access and receive an electronic copy of your Personal Information. | 232 | Subject to limitations under applicable law, residents of certain jurisdictions have rights and choices with respect to your personal data, including the right to: Know what personal data we process about you and to access and receive an electronic copy of your personal data. |
| 198 | Correct inaccurate Personal Information about you. | 233 | Correct inaccurate personal data about you. |
| 199 | Request that we delete Personal Information about you. | 234 | Request that we delete personal data about you. |
| 200 | Under certain circumstances, in jurisdictions such as the U.K. and the E.U., the right to request that we restrict processing of your Personal Information and/or to object to how we process Personal Information about you. | 235 | Under certain circumstances, in jurisdictions such as the U.K. and the E.U., the right to request that we restrict processing of your personal data and/or to object to how we process personal data about you. |
| 201 | Where we process your Personal Information based on consent, the right to withdraw that consent at any time with respect to future processing. | 236 | Where we process your personal data based on consent, the right to withdraw that consent at any time with respect to future processing. |
| 202 | These rights may be limited, for example, if fulfilling your request would reveal Personal Information about another person, where they would infringe the rights of a third party (including our rights), or if you ask us to delete information which we are required by law to keep or have a compelling legitimate interest to keep. | 237 | These rights may be limited, for example, if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights), or if you ask us to delete information which we are required by law to keep or have a compelling legitimate interest to keep. |
| 208 | If Personal Information about you has been processed by us as a service provider or Processor on behalf of a Company, please contact the Company directly to exercise your rights. | 243 | If personal data about you has been processed by us as a service provider or Processor on behalf of a Company, please contact the Company directly to exercise your rights. |
| 209 | However, if you wish to make your request directly to us, please provide the name of your Company on whose behalf we processed your Personal Information. | 244 | However, if you wish to make your request directly to us, please provide the name of your Company on whose behalf we processed your personal data. |
| 247 | For additional information, please visit our Cookie Policy . 2. | 282 | For additional information, please visit our Cookie Policy . |
| 283 | We may use session-replay technologies to understand how users interact with the Service, including clicks, scrolling, page navigation, and technical information about a session, to troubleshoot, secure, and improve the Service. | ||
| 284 | Where used, we implement measures designed to mask or exclude certain types of information, such as passwords, payment card information, and other sensitive content. | ||
| 285 | Where required by law, we obtain your consent before enabling session replay. 2. | ||
| 255 | For more information on "Do Not Track," visit http://www.allaboutdnt.com ↗ . | 293 | For more information, visit All About Do Not Track ↗ . |
| 262 | Analytics and Targeted Advertising Google provides tools to allow you to opt out of the use of certain information collected by Google Analytics at https://tools.google.com/dlpage/gaoptout ↗ and by Google Analytics for Display Advertising or the Google Display Network at https://www.google.com/settings/ads/onweb ↗ . 7. | 300 | Analytics and Targeted Advertising Google provides tools to allow you to opt out of the use of certain information collected by Google Analytics through the Google Analytics Opt-out Browser Add-on ↗ and by Google Analytics for Display Advertising or the Google Display Network through Google Ads Settings ↗ . 7. |
| 263 | Opt Out of Targeted Advertising and "Sales" or "Sharing" of Personal Information Permanent link: 7. | 301 | Opt Out of Targeted Advertising and "Sales" or "Sharing" of Personal Data Permanent link: 7. |
| 264 | Opt Out of Targeted Advertising and "Sales" or "Sharing" of Personal Information Data protection laws in certain jurisdictions provide the right to opt out of targeted advertising, "sales," or "sharing" of Personal Information. | 302 | Opt Out of Targeted Advertising and "Sales" or "Sharing" of Personal Data Data protection laws in certain jurisdictions provide the right to opt out of targeted advertising, "sales," or "sharing" of personal data. |
| 265 | To opt out of targeted advertising, "sales," or "sharing" (as defined by applicable law) of your Personal Information, visit our "Your Privacy Choices" page or click the "Your Privacy Choices" in the footer of our Website. | 303 | To opt out of targeted advertising, "sales," or "sharing" (as defined by applicable law) of your personal data, visit our Your Privacy Choices page or click the "Your Privacy Choices" in the footer of our Website. |
| 269 | To learn more about the targeted ads provided by these companies and how to opt out of receiving certain targeted ads from them, please visit: (1) for targeted ads from DAA participants, https://www.aboutads.info/choices ↗ ; and (2) for targeted ads from NAI participants, https://www.networkadvertising.org/choices ↗ . | 307 | To learn more about the targeted ads provided by these companies and how to opt out of receiving certain targeted ads from them, please visit: (1) for targeted ads from DAA participants, DAA Choices ↗ ; and (2) for targeted ads from NAI participants, NAI Opt Out ↗ . |
| 280 | Depending on your relationship with us, where you reside, and your use of certain parts of the Services, your Personal Information that we collect may be transferred to, processed, used, handled, and stored in the United States and other jurisdictions. | 318 | Depending on your relationship with us, where you reside, and your use of certain parts of the Services, your personal data that we collect may be transferred to, processed, used, handled, and stored in the United States and other jurisdictions. |
| 282 | We take measures to comply with applicable data protection laws when we transfer Personal Information internationally. | 320 | We take measures to comply with applicable data protection laws when we transfer personal data internationally. |
| 283 | In certain situations, regulators, courts, and law enforcement agencies might be entitled to access your Personal Information (for more information see Section 5 - Disclosure of Personal Information by Ramp ). | 321 | In certain situations, regulators, courts, and law enforcement agencies might be entitled to access your personal data (for more information see Section 5 - Disclosure of Personal Data by Ramp ). |
| 284 | For Personal Information transferred from the European Economic Area ( "E.E.A." ), Switzerland, or the U.K., we will provide appropriate safeguards for transfers of your Personal Information outside of those jurisdictions, including: (1) transferring the Personal Information to countries recognized by the European Commission ↗ , the Swiss Federal Data Protection and Information Commissioner ↗ , and/or U.K. Information Commissioner’s Office ↗ as offering an adequate level of protection for Personal Information; (2) transferring the Personal Information pursuant to contractual obligations, including Standard Contractual Clauses ↗ ( "SCCs" ) and addenda specific to Switzerland and/or the U.K., as applicable; and (3) confirming service providers to which we transfer Personal Information have active self-certification under the E.U.-U.S. Data Privacy Framework, the U.K. Extension to the E.U.-U.S. DPF, or the Swiss-U.S. DPF, as applicable. | 322 | For personal data transferred from the European Economic Area ( "E.E.A." ), Switzerland, or the U.K., we will provide appropriate safeguards for transfers of your personal data outside of those jurisdictions, including: (1) transferring the personal data to countries recognized by the European Commission ↗ , the Swiss Federal Data Protection and Information Commissioner ↗ , and/or U.K. Information Commissioner’s Office ↗ as offering an adequate level of protection for personal data; (2) transferring the personal data pursuant to contractual obligations, including Standard Contractual Clauses ↗ ( "SCCs" ) and addenda specific to Switzerland and/or the U.K., as applicable; and (3) confirming service providers to which we transfer personal data have active self-certification under the E.U.-U.S. Data Privacy Framework, the U.K. Extension to the E.U.-U.S. DPF, or the Swiss-U.S. DPF, as applicable. |
| 285 | While transfers to countries that don’t have an adequacy decision typically take place on the basis of SCCs, in certain circumstances, transfers can also take place on the basis of exemptions provided under data protection law, such as sharing Personal Information as required with law enforcement or in emergency situations where we learn that a person’s life is at risk. | 323 | While transfers to countries that don’t have an adequacy decision typically take place on the basis of SCCs, in certain circumstances, transfers can also take place on the basis of exemptions provided under data protection law, such as sharing personal data as required with law enforcement or in emergency situations where we learn that a person’s life is at risk. |
| 287 | For example, we use technical protections, such as encryption and pseudonymization, and policies and processes to review and, as appropriate, challenge disproportionate or unlawful government authority requests for Personal Information. | 325 | For example, we use technical protections, such as encryption and pseudonymization, and policies and processes to review and, as appropriate, challenge disproportionate or unlawful government authority requests for personal data. |
| 289 | If you are a resident of the province of Quebec, please note that we transfer and store Personal Information outside of Quebec province. 8. | 327 | If you are a resident of the province of Quebec, please note that we transfer and store personal data outside of Quebec province. 8. |
| 290 | Lawful Basis for Processing Personal Information Permanent link: 8. | 328 | Lawful Basis for Processing Personal Data Permanent link: 8. |
| 291 | Lawful Basis for Processing Personal Information Certain jurisdictions, such as the E.E.A., Switzerland, and the U.K. require a "lawful basis" to collect, process, and disclose Personal Information. | 329 | Lawful Basis for Processing Personal Data Certain jurisdictions, such as the E.E.A., Switzerland, and the U.K., require a "lawful basis" to collect, process, and disclose personal data. |
| 292 | Where we are the Controller of your Personal Information, we rely on the following lawful bases: At your direction and in performance of a contract we have with you. | 330 | Where we are the Controller of your personal data, we rely on the following lawful bases: At your direction and in performance of a contract we have with you. |
| 294 | Consent that you provide us at the time of collection of your Personal Information or subsequently. | 332 | Consent that you provide us at the time of collection of your personal data or subsequently. |
| 296 | Security Permanent link: 9. | 334 | Automated Decision-Making and Artificial Intelligence Permanent link: 9. |
| 297 | Security We use various technical, organizational, administrative, and physical measures designed to protect your Personal Information from loss, theft, misuse, and unauthorized access, disclosure, alteration, or destruction. | 335 | Automated Decision-Making and Artificial Intelligence Ramp uses automated systems, which include artificial intelligence and machine-learning technologies ( "AI Systems" ), to operate and protect our Business and provide the Services. |
| 298 | However, no information security program or transfer of information via the internet is entirely secure, so we cannot guarantee the security of your Personal Information. | 336 | Depending on the product and workflow, AI Systems may assist with tasks such as: verifying identity and business information; detecting and preventing fraud, suspicious activity, sanctions or compliance risks, unauthorized transactions, and security threats; supporting business application review, underwriting, eligibility, and risk-management processes for financial products; matching receipts, invoices, transactions, accounting information, and other records; applying Company policies, controls, workflows, and product settings; generating policies and workflows; and improving, troubleshooting, and securing our Services. |
| 337 | More information about the AI Systems we use and the tasks they support is available on our Trust Center ↗ . | ||
| 338 | Ramp does not use AI Systems to make a decision based solely on automated processing that produces legal or similarly significant effects for an individual subject to this Privacy Policy. 10. | ||
| 339 | Security Permanent link: 10. | ||
| 340 | Security We use various technical, organizational, administrative, and physical measures designed to protect your personal data from loss, theft, misuse, and unauthorized access, disclosure, alteration, or destruction. | ||
| 341 | However, no information security program or transfer of information via the internet is entirely secure, so we cannot guarantee the security of your personal data. | ||
| 300 | If you suspect unauthorized activity with respect to your Ramp account or you suspect a security incident has occurred, you should contact us immediately at security@ramp.com . 10. | 343 | If you suspect unauthorized activity with respect to your Ramp account or you suspect a security incident has occurred, you should contact us immediately at security@ramp.com . 11. |
| 301 | Use by Minors Permanent link: 10. | 344 | Use by Minors Permanent link: 11. |
| 303 | We do not knowingly collect Personal Information (as defined by the U.S. Children's Privacy Protection Act, or "COPPA" ) from children under 13. | 346 | We do not knowingly collect personal data (as defined by the U.S. Children's Online Privacy Protection Act, or "COPPA" ) from children under 13. |
| 304 | We also do not knowingly "share" or "sell," as those terms are defined under applicable law, the Personal Information of minors under the age of 18. | 347 | We also do not knowingly "share" or "sell," as those terms are defined under applicable law, the personal data of minors under the age of 18. |
| 305 | If you are a parent or guardian of a minor and believe your minor uses the Services, contact us at privacy@ramp.com . 11. | 348 | If you are a parent or guardian of a minor and believe your minor uses the Services, contact us at privacy@ramp.com . 12. |
| 306 | Retention Permanent link: 11. | 349 | Retention Permanent link: 12. |
| 307 | Retention Ramp collects and stores Personal Information for the purposes outlined in this Privacy Policy. | 350 | Retention Ramp maintains retention schedules that assign retention periods or deletion criteria based on the category of personal data, the product and purpose for which it was collected, the legal basis for processing, and applicable legal requirements. |
| 308 | Subject to applicable law, we retain Personal Information for as long as we continue to have a business or operational purpose to retain it and as necessary to comply with (or demonstrate compliance with) our legal or regulatory obligations, resolve disputes, prevent fraud, and enforce our rights. | 351 | We do not retain personal data indefinitely merely because it may be useful in the future. |
| 309 | Please note that our retention obligations may require us to retain your Personal Information after you are no longer an Authorized User or your Company’s Ramp Account has closed. | 352 | The following describes the principal retention triggers and criteria we use: Record category Retention period or criteria Account, user, and product records For the life of the relevant account, user relationship, or enabled product, followed by the period reasonably needed to close the account, complete pending activity, provide requested exports, maintain audit trails, resolve disputes, and meet legal obligations Applications, identity-verification, ownership, underwriting, and compliance records From collection or the application decision through the period required by financial-services, anti-money-laundering, sanctions, credit, recordkeeping, or other applicable law, generally measured from the application decision, account closure, transaction, or end of the relevant relationship Transaction, payment, card, reimbursement, invoice, receipt, travel, procurement, and accounting records For the life of the relevant account, user relationship, or enabled product, followed by the period reasonably needed to close the account, complete pending activity, provide requested exports, maintain audit trails, resolve disputes, and meet legal obligations Connected Data and Company content While the relevant connection or product is enabled and thereafter for the period needed to complete pending workflows, honor the Company's deletion or export instructions, protect account integrity, and satisfy legal, contractual, audit, and dispute requirements. |
| 310 | These retention obligations may also prohibit us in some cases from deleting Personal Information after you have asked us to delete your Personal Information. | 353 | This includes, where applicable, prompts, messages, files, connected records, generated outputs, feedback, and workspace or sharing information SaaS products. |
| 311 | When the applicable retention period elapses, we will delete, de-identify, or anonymize your Personal Information in accordance with our policies and procedures. 12. | 354 | Security, fraud, authentication, and technical logs For periods based on the security purpose, sensitivity, and risk of the data, including the time needed to detect patterns, investigate incidents, prevent repeat abuse, maintain system integrity, and satisfy security or legal requirements Support, sales, research, event, and business communications For the duration of the interaction and thereafter based on the nature of the communication, the status of the relationship, quality and training needs, recording choices, and applicable legal, contractual, and dispute requirements Website, cookie, analytics, and advertising data For the periods described in our Cookie Policy or the applicable tool, consent, or preference setting; marketing contact information is retained until you opt out or it is no longer needed, with suppression records retained to honor your choice Privacy requests, consents, objections, and compliance records For the period needed to respond to the request or administer the choice and thereafter to demonstrate compliance, prevent repeated unauthorized requests, and meet applicable limitation and recordkeeping periods We periodically review whether personal data remains necessary for the stated purpose. |
| 312 | Changes to this Privacy Policy Permanent link: 12. | 355 | When a retention period expires or the applicable purpose no longer requires identifiable data, we delete, de-identify, or anonymize the data, or place it in a restricted archive when continued storage is required by law. |
| 356 | Data subject to a legal hold, regulatory inquiry, investigation, dispute, fraud-prevention need, or security incident may be retained until the matter and any related preservation period end. | ||
| 357 | Residual copies in backups are protected from ordinary use and deleted or overwritten through scheduled backup cycles unless continued preservation is required. | ||
| 358 | Where Ramp processes personal data solely on behalf of a Company, retention and deletion are also governed by the Agreement and the Company's instructions. 13. | ||
| 359 | Changes to this Privacy Policy Permanent link: 13. | ||
| 314 | Those changes sometimes require us to collect new Personal Information or to use Personal Information in different ways, so we periodically update this Privacy Policy to reflect those changes. | 361 | Those changes sometimes require us to collect new personal data or to use personal data in different ways, so we periodically update this Privacy Policy to reflect those changes. |
| 316 | If we make material changes in the way we collect, use, or disclose your Personal Information, we will provide you reasonable advanced notice of the changes before they take effect for you. | 363 | If we make material changes in the way we collect, use, or disclose your personal data, we will provide you reasonable advanced notice of the changes before they take effect for you. |
| 319 | If you continue using the Services after those changes are in effect, our processing of your Personal Information will be subject to the new Privacy Policy. | 366 | If you continue using the Services after those changes are in effect, our processing of your personal data will be subject to the new Privacy Policy. |
| 320 | We encourage you to regularly review this Privacy Policy to ensure that you remain aware of what Personal Information we collect, how we use and otherwise process it, under what circumstances we will disclose it to third parties, and your privacy rights and choices. 13. | 367 | We encourage you to regularly review this Privacy Policy to ensure that you remain aware of what personal data we collect, how we use and otherwise process it, under what circumstances we will disclose it to third parties, and your privacy rights and choices. 14. |
| 321 | Contact Us; Data Controller Permanent link: 13. | 368 | Contact Us; Data Controller Permanent link: 14. |
| 322 | Contact Us; Data Controller If you have questions about this Privacy Policy or our practices with respect to Personal Information, or if you have difficulty accessing the information in this Privacy Policy, please contact us: By email: privacy@ramp.com By mail: Ramp Business Corporation, Attn: Privacy Counsel, 28 West 23rd, Floor 2, New York, NY 10010 Ramp may process Personal Information in accordance with the instructions of or on behalf of a Company, including when providing Services to a Company under an Agreement. | 369 | Contact Us; Data Controller If you have questions about this Privacy Policy or our practices with respect to personal data, or if you have difficulty accessing the information in this Privacy Policy, please contact us: By email: privacy@ramp.com By mail: Ramp Business Corporation, Attn: Privacy Counsel, 28 West 23rd, Floor 2, New York, NY 10010 Ramp may process personal data in accordance with the instructions of or on behalf of a Company, including when providing Services to a Company under an Agreement. |
| 324 | Ramp may also act as a Controller when directly determining the purposes for and means of processing Personal Information in other business contexts as set out in this Privacy Policy, like complying with regulatory obligations applicable to our Business. | 371 | Ramp may also act as a Controller when directly determining the purposes for and means of processing personal data in other business contexts as set out in this Privacy Policy, like complying with regulatory obligations applicable to our Business. |
| 325 | Where we act as the Controller, the Controller is Ramp Business Corporation, unless we specify otherwise in writing. 14. | 372 | Where we act as the Controller, the Controller is Ramp Business Corporation, unless we specify otherwise in writing. 15. |
| 326 | Additional Information for California Residents Permanent link: 14. | 373 | Additional Information for California Residents Permanent link: 15. |
| 330 | At or before the time of collection of your Personal Information, you have the right to know the categories of Personal Information and Sensitive Personal Information to be collected (see Section 3 - Personal Information Ramp Processes ), the purposes for the collection and use of your Personal Information (see Section 4 - How We Use Personal Information ), whether your Personal Information is "sold" or "shared" (as defined under California law), and how long your Personal Information is retained see Section 11 - Retention . | 377 | At or before the time of collection of your personal data, you have the right to know the categories of personal data and sensitive personal data to be collected (see Section 3 - Personal Data Ramp Processes ), the purposes for the collection and use of your personal data (see Section 4 - How We Use Personal Data ), whether your personal data is "sold" or "shared" (as defined under California law), and how long your personal data is retained (see Section 12 - Retention ). |
| 332 | Categories of Personal Information We Collect Permanent link: 1. | 379 | Categories of Personal Data We Collect Permanent link: 1. |
| 333 | Categories of Personal Information We Collect California law requires businesses collecting or disclosing Personal Information to provide notices and means to exercise those rights. | 380 | Categories of Personal Data We Collect California law requires businesses collecting or disclosing personal data to provide notices and means to exercise those rights. |
| 334 | In the past 12 months, we have collected the following categories of Personal Information: Identifiers, including name, postal address, email address, online identifiers (such as IP address), social security number, driver’s license number, passport number, or other similar identifiers. | 381 | In the past 12 months, we have collected the following categories of personal data: Identifiers, including name, postal address, email address, online identifiers (such as IP address), social security number, driver’s license number, passport number, or other similar identifiers. |
| 335 | Customer Records, including phone number, billing address, bank account, and credit or debit card information, which may include Personal Information. | 382 | Customer Records, including phone number, billing address, bank account, and credit or debit card information, which may include personal data. |
| 339 | Commercial or Transaction Information, including records of products or services purchased, obtained, or considered, which may include Personal Information. | 386 | Commercial or Transaction Information, including records of products or services purchased, obtained, or considered, which may include personal data. |
| 345 | For further details on Personal Information we collect, including the sources from which we receive Personal Information, review Section 3 - Personal Information Ramp Processes . | 392 | For further details on personal data we collect, including the sources from which we receive personal data, review Section 3 - Personal Data Ramp Processes . |
| 346 | We collect and use these categories of Personal Information for the business purposes described in Section 4 - How We Use Personal Information above. | 393 | We collect and use these categories of personal data for the business purposes described in Section 4 - How We Use Personal Data above. |
| 347 | We disclose the Personal Information to the categories of persons set out in Section 5 - Disclosure of Personal Information by Ramp above. | 394 | We disclose the personal data to the categories of persons set out in Section 5 - Disclosure of Personal Data by Ramp above. |
| 350 | Rights to Know, Correct and Delete You have the right to know certain details about our Personal Information practices and the rights you have under California law. | 397 | Rights to Know, Correct and Delete You have the right to know certain details about our personal data practices and the rights you have under California law. |
| 351 | You have a right to know the categories of Personal Information we have collected about you; the categories of sources from which the Personal Information was collected; the categories of Personal Information we have disclosed for a business purpose or "sold" or "shared;" the categories of persons to whom the Personal Information was disclosed, "sold," or "shared;" the business or commercial purpose for collecting, "selling," or "sharing" the Personal Information; and the specific Personal Information we have collected about you. | 398 | You have a right to know the categories of personal data we have collected about you; the categories of sources from which the personal data was collected; the categories of personal data we have disclosed for a business purpose or "sold" or "shared;" the categories of persons to whom the personal data was disclosed, "sold," or "shared;" the business or commercial purpose for collecting, "selling," or "sharing" the personal data; and the specific personal data we have collected about you. |
| 353 | In addition, subject to certain exceptions, you have the right to request that we correct inaccurate Personal Information or that we delete the Personal Information we have collected from you. | 400 | In addition, subject to certain exceptions, you have the right to request that we correct inaccurate personal data or that we delete the personal data we have collected from you. |
| 359 | If Personal Information about you has been processed by us as a "service provider" (which is similar to a data processor) on behalf of a Company, please inquire with your Company directly to exercise your rights. | 406 | If personal data about you has been processed by us as a "service provider" (which is similar to a data processor) on behalf of a Company, please inquire with your Company directly to exercise your rights. |
| 360 | If you want to make your request directly to us, please provide the name of your Company on whose behalf we process your Personal Information. | 407 | If you want to make your request directly to us, please provide the name of your Company on whose behalf we process your personal data. |
| 364 | Do Not Sell or Share My Personal Information Permanent link: 3. | 411 | Do Not Sell or Share My Personal Data Permanent link: 3. |
| 365 | Do Not Sell or Share My Personal Information Our business model is to provide corporate card, spend management, and related services to Companies, not selling Personal Information. | 412 | Do Not Sell or Share My Personal Data Our business model is to provide corporate card, spend management, and related services to Companies, not selling personal data. |
| 366 | However, under California law, some marketing practices, like the disclosure of Website visitor data to obtain targeted ads and analytics to advertise our products and services on third-party sites, may be considered a "share" or "sale." Under California law, "share" is broadly defined to include the disclosure of Personal Information for cross-context behavioral advertising, and "sale" is broadly defined to include the disclosure of Personal Information for anything of value, even if no money is exchanged. | 413 | However, under California law, some marketing practices, like the disclosure of Website visitor data to obtain targeted ads and analytics to advertise our products and services on third-party sites, may be considered a "share" or "sale." Under California law, "share" is broadly defined to include the disclosure of personal data for cross-context behavioral advertising, and "sale" is broadly defined to include the disclosure of personal data for anything of value, even if no money is exchanged. |
| 367 | Under those definitions, we may "share" or "sell" the following categories of Personal Information for commercial purposes: identifiers, characteristics, commercial or transaction information, internet activity, approximate location data, and inferences drawn. | 414 | Under those definitions, we may "share" or "sell" the following categories of personal data for commercial purposes: identifiers, characteristics, commercial or transaction information, internet activity, approximate location data, and inferences drawn. |
| 368 | The categories of third parties to whom we "share" or "sell" Personal Information include, where applicable, third parties we work with to deliver targeted advertising, including across sites, and to conduct analytics. | 415 | The categories of third parties to whom we "share" or "sell" personal data include, where applicable, third parties we work with to deliver targeted advertising, including across sites, and to conduct analytics. |
| 369 | To the extent our marketing practices constitute a "share" or "sale" of your Personal Information, you have the right to opt out. | 416 | To the extent our marketing practices constitute a "share" or "sale" of your personal data, you have the right to opt out. |
| 372 | Authorized Agent Permanent link: 4. | 419 | Right to Limit Use of Sensitive Personal Data Permanent link: 4. |
| 420 | Right to Limit Use of Sensitive Personal Data California law gives consumers the right to limit a business's use of “Sensitive Personal Information” to purposes necessary to provide the services reasonably expected by an average consumer, as well as certain other permitted business purposes, such as security, fraud prevention, and legal compliance. | ||
| 421 | We collect certain categories of Sensitive Personal Information, including Social Security numbers, driver's license numbers, passport numbers, other government-issued identification numbers, and biometric information collected through our identity verification process. | ||
| 422 | We use this information solely to verify identity, prevent fraud, comply with legal and regulatory obligations (including Know Your Customer requirements), and for other purposes necessary to provide our Services. | ||
| 423 | We do not use Sensitive Personal Information to infer characteristics about individuals or for cross-context behavioral advertising. | ||
| 424 | Because our use of Sensitive Personal Information is limited to these permitted purposes, California law does not require us to offer a separate opt-out right for this processing. | ||
| 425 | If you have questions about our use of Sensitive Personal Information, please contact us at privacy@ramp.com . 5. | ||
| 426 | Authorized Agent Permanent link: 5. | ||
| 380 | Notice of Financial Incentives At times, we offer certain opportunities or rewards through contests, sweepstakes, and other special offers and promotions (collectively, "Offers" ) (see Section 4 - How We Use Personal Information ). | 434 | Notice of Financial Incentives At times, we offer certain opportunities or rewards through contests, sweepstakes, and other special offers and promotions (collectively, "Offers" ) (see Section 4 - How We Use Personal Data ). |
| 381 | Because these Offers often involve the collection of Personal Information, they may be interpreted as "financial incentive" programs under California law. | 435 | Because these Offers often involve the collection of personal data, they may be interpreted as "financial incentive" programs under California law. |
| 382 | We use Personal Information collected through Offers for the purposes described in this Privacy Policy. | 436 | We use personal data collected through Offers for the purposes described in this Privacy Policy. |
| 383 | We may disclose your Personal Information to third parties as described in Section 5 - Disclosure of Personal Information of this Privacy Policy, including data analytics providers, advertising technology vendors, and social media platforms. | 437 | We may disclose your personal data to third parties as described in Section 5 - Disclosure of Personal Data of this Privacy Policy, including data analytics providers, advertising technology vendors, and social media platforms. |
| 384 | The value of any financial incentive we offer is reasonably related to the value of any Personal Information you provide to us. | 438 | The value of any financial incentive we offer is reasonably related to the value of any personal data you provide to us. |
| 385 | As required by applicable law, we estimate the value of your Personal Information by considering, without limitation, the expenses we incur from collecting your Personal Information and/or providing the Offer to you, the revenue (if any) generated by your use of the Offer, and any improvements we can make to the Services based on information obtained from you as a result of the Offer. | 439 | As required by applicable law, we estimate the value of your personal data by considering, without limitation, the expenses we incur from collecting your personal data and/or providing the Offer to you, the revenue (if any) generated by your use of the Offer, and any improvements we can make to the Services based on information obtained from you as a result of the Offer. |
| 386 | If you want to withdraw from an ongoing or upcoming Offer, you can do so by emailing privacy@ramp.com . 15. | 440 | If you want to withdraw from an ongoing or upcoming Offer, you can do so by emailing privacy@ramp.com . 16. |
| 387 | Additional Information for Canadian Residents Permanent link: 15. | 441 | Additional Information for Canadian Residents Permanent link: 16. |
| 388 | Additional Information for Canadian Residents Data Transfers from Quebec Permanent link: Data Transfers from Quebec If you are a resident of the province of Quebec, please note that we transfer and store Personal Information outside of Quebec province. | 442 | Additional Information for Canadian Residents Data Transfers from Quebec Permanent link: Data Transfers from Quebec If you are a resident of the province of Quebec, please note that we transfer and store personal data outside of Quebec province. |
| 389 | Data Disclosure to Telecommunications Carriers Permanent link: Data Disclosure to Telecommunications Carriers Personal data will be shared with telecommunication providers or mobile network operators for the purposes of identity verification. 16. | 443 | Data Disclosure to Telecommunications Carriers Permanent link: Data Disclosure to Telecommunications Carriers Personal data will be shared with telecommunication providers or mobile network operators for the purposes of identity verification. 17. |
| 390 | Additional Information for UK Residents Permanent link: 16. | 444 | Additional Information for UK Residents Permanent link: 17. |
Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.