| Before | After | ||
|---|---|---|---|
| 0 | Privacy Terms Privacy Policy Last Updated: August 21, 2026 1. | 0 | Privacy Terms Privacy Policy Last Updated: October 13, 2026 1. |
| 2 | Introduction Ramp is on a mission to help finance teams build healthier businesses. | 2 | Introduction Ramp is on a mission to help companies save time and money so they can focus on their missions. |
| 3 | We rely on data and insights to save our customers time and money so they can focus on their core missions. | 3 | We rely on data and insights to do that. |
| 7 | We want you to understand how we collect, use, and disclose personal data, and your rights and choices regarding your personal data, including the right to object to certain types of processing we carry out (for more information see Section 6 - Your Rights and Choices below). | 7 | We want you to understand how we collect, use, and disclose personal data, and your rights and choices regarding your personal data, including the right to object to certain types of processing we carry out (for more information see Section 7 - Your Rights and Choices below). |
| 10 | You can also visit Section 14 - Contact Us; Data Controller below for more information. 2. | 10 | You can also visit Section 15 - Contact Us; Data Controller below for more information. 2. |
| 12 | Scope of this Privacy Policy This Privacy Policy applies to personal data we collect and process about you as a Controller (defined below) when you use or interact with: our platform and apps, which include corporate cards and spend management, travel, procurement, banking, accounts payable, accounts receivable, Token Spend Management, Stack, Glass, and other related services and technology (e.g., app.ramp.com and our mobile applications) (the "Services"); www.ramp.com (the "Website"); and our social media, emails, newsletters, advertisements, and other locations or platforms, online or offline, where you interact with our business (collectively, with the Services and Website, the "Business"). | 12 | Scope of this Privacy Policy This Privacy Policy applies to personal data we collect and process about you as a Controller (defined below) when you use or interact with: our finance platform and apps, which include corporate cards and spend management, travel, procurement, banking, accounts payable, accounts receivable, and related services and technology (e.g., app.ramp.com and our mobile applications); our software applications, including Token Spend Management, Router, and Stack (collectively, with our financial platform and apps, the "Services"); www.ramp.com, www.router.com ↗, and other Ramp-owned websites (the "Websites"); and our social media, emails, newsletters, advertisements, and other locations or platforms, online or offline, where you interact with our business (collectively, with the Services and Websites, the "Business"). |
| 13 | Personal data we collect through Router is subject to the Router Privacy Notice. | — | Removed |
| 14 | Personal data collected by Juno is handled in accordance with the Juno Privacy Policy ↗, and personal data collected by Billhop is handled in accordance with the applicable Billhop Privacy Policy ↗. | ||
| 19 | If we receive a request intended for the Company, we will forward communications we receive from you to the Company for resolution. | 19 | If we receive a request intended for the Company, we will forward communications we receive from you to the Company for resolution as described in Section 7. |
| 20 | Ramp is not responsible for the privacy practices of any Companies, which may differ from our own. | 20 | Ramp is not responsible for the privacy practices of any Companies that use the Services, which may differ from our own. |
| 22 | For example, a Company may connect, directly or through another application, accounting systems, e-mail services, human resources information systems, bank accounts held at depository institutions, rideshare applications, e-commerce platforms, and other products and services to its Services account ("Ramp Account"). | 22 | For example, a Company may connect accounting systems, e-mail services, human resources information systems ("HRIS"), rideshare applications, or other products and services to the Services. |
| 23 | These Third-Party Services help us provide Companies with an integrated spend management solution but are not part of our Services. | 23 | These Third-Party Services help us provide integrated solutions but are not part of our Services. |
| 25 | Personal Data Ramp Processes Permanent link: 3. | 25 | Personal Data We Process Permanent link: 3. |
| 26 | Personal Data Ramp Processes Ramp processes personal data to deliver Services to you and to operate our Business. | 26 | Personal Data We Process Ramp processes personal data to deliver Services to you and to operate our Business. |
| 28 | The table below provides an overview of the relevant person, product or interaction, data categories, and purposes. | 28 | The table below is intended as a helpful overview of the relevant person, product or interaction, data categories, and purposes. |
| 30 | Additional detail is included in the remainder of this Section. | 30 | Full details are included in the remainder of this section and in Sections 4-6 below. |
| 31 | Person or interaction Products or context Personal data we may process Main purposes Business applicants, owners, control persons, guarantors, and other Company representatives involved in an application Applications for corporate cards, credit, deposit or treasury products, payment services, and other regulated financial products Name; business contact information; date of birth; residential address; citizenship; tax or government identifiers; photograph; biometrics (faceprint); government-issued identification and information captured from it; ownership or control information; employer, title, and role; financial, credit, and business information; application and underwriting information; device and fraud-risk signals; audio and/or video call recordings (unless you opt out or do not consent) Verify identity and authority; satisfy know-your-customer, anti-money-laundering, sanctions, and other legal requirements; assess Company eligibility and risk; detect and prevent fraud, security incidents, and policy and legal violations; comply with legal obligations; open and administer the selected financial product Company administrators and Authorized Users, including spend management, bill pay, reimbursements, accounts payable, accounts receivable, procurement, or related payment features Ramp account product and feature use and administration, including AI-enabled products Name; business contact information; address; employer, title, and role; permissions and login credentials; email, SMS, or search communications; product settings; files and other content submitted or connected to the Services; prompts, queries, instructions, and outputs associated with AI-enabled features; browser, device, and network information; approximate location data; connected data from third-party applications or accounts connected to your Ramp account; audio and/or video call recordings (unless you opt out or do not consent); biometric data (account recovery); transaction data; receipts, invoices, contracts, and purchase orders; tax documentation; bank account details; precise geolocation data (optional for mileage reimbursement); product usage data; business travel booking information (name, email, date of birth, gender; phone number; known traveler or redress number; and loyalty or rewards number); itinerary, booking, and approximate location information; travel preferences and support communications; product feedback Create and secure accounts; authenticate users; configure permissions and workflows; provide the selected software and AI-enabled functionality; generate requested outputs; provide support; operate, maintain, and improve the selected Services; communicate about the account; detect and prevent fraud, security incidents, and policy and legal violations; comply with legal obligations; authorize and process transactions; administer cards and spend controls; pay bills and reimbursements; reconcile and code transactions; manage vendors and purchasing; detect errors, fraud, and policy violations; provide reporting and support; complete travel bookings, reservations and communication; search, book, change, and support business travel; apply Company travel policies; provide itinerary and expense-management features; communicate with travel providers Vendors, payees, merchants, contractors, and other transaction counterparties Bill pay, accounts payable, accounts receivable, procurement, card, and payment features Name and business contact information; payment and bank-account details; contracts, invoices, and purchase orders; tax classification and tax identification information; transaction status and communications; product feedback Verify vendors; send and receive payments; communicate about payments; operate, maintain, and improve the selected Services; communicate about the account; detect and prevent fraud, security incidents, and policy and legal violations; comply with legal obligations Company administrators and Authorized Users (SaaS) AI product and feature use and administration (Stack, Token Spend Management, Glass) Name and business contact information; permissions, role, and account credentials; connected account information; browser, device, and network information; AI prompts, outputs, and related metadata; artifacts and content uploaded to the Service; approximate geolocation; product feedback Create and secure accounts; authenticate users; configure permissions and workflows; provide the selected software and AI-enabled functionality; generate requested outputs; provide support; operate, maintain, and improve the selected Services; communicate about the account; detect and prevent fraud, security incidents, and policy and legal violations; comply with legal obligations Website visitors, prospects, referral contacts, and social-media users Website, advertising, sales, referrals, newsletters, and social media Contact and professional information; communications; referral source; cookie, device, browser, IP-address, approximate location, advertising identifier, website-use, and campaign-engagement data; public profile information Respond to requests; provide demonstrations and sales communications; understand and improve the Website; measure campaigns; advertise Ramp products; prevent abuse and secure the Website; honor privacy choices Support contacts, event participants, and other people who communicate with Ramp Customer support, research, surveys, sales calls, events, and other business communications Contact and professional information; communications and product feedback; files or other content provided; audio or video recordings where disclosed and permitted; event registration information, including dietary or accessibility information you choose to provide Respond to requests; provide support; train and improve our teams and Services; administer events; keep business and compliance records; honor recording choices A. | 31 | The collection, use, and disclosure described below concern purposes for which Ramp acts as a Controller. |
| 32 | Product-Specific Collection Permanent link: A. | 32 | Personal data processed solely on a Company's behalf is governed by the Agreement and data processing addendum between Ramp and that Company. |
| 33 | Product-Specific Collection 1. | 33 | The same category of personal data may support different roles for different purposes; its inclusion here does not authorize an independent use of information processed solely on a Company's behalf. |
| 34 | Financial Products and Services Permanent link: 1. | — | Removed |
| 35 | Financial Products and Services We collect identity-verification, ownership, control-person, financial, credit, and risk information when it is needed for an application for or use of a regulated financial product or service, or when required by our Financial Institution Partners or applicable law. | — | Removed |
| 36 | The exact information depends on the product, the Company's structure, the individual's role, and the applicable legal requirements. 2. | — | Removed |
| 37 | SaaS Products Permanent link: 2. | — | Removed |
| 38 | SaaS Products If a Company signs up only for a Ramp SaaS product that does not include a regulated financial product, Ramp does not collect know-your-customer or underwriting information solely to provide that SaaS product, but we may collect certain information for identity verification and anti-fraud measures. | — | Removed |
| 39 | We may collect ordinary account, user, security, product-use, support, and Company-provided or connected content needed to provide the software. | — | Removed |
| 40 | For AI-enabled features, this may include prompts, outputs, related metadata, source materials, configuration information, which may contain personal data. | — | Removed |
| 41 | We process personal data included in this information to provide, secure, support, maintain, and improve the applicable product; detect and prevent fraud, abuse, or security incidents; manage our business; and comply with our legal obligations. | — | Removed |
| 42 | Before using Company Content to train a general-purpose or generative artificial-intelligence model for use across customers, Ramp will provide required notices and obtain required permissions as applicable. | — | Removed |
| 44 | The sections below provide additional detail about the categories and sources of personal data we process. | 35 | Person or interaction Products or context Personal data we process Main purposes (see Section 5 for more detail) Business applicants, owners, control persons, guarantors, and other Company representatives involved in an application Applications for corporate cards, credit, deposit or treasury products, payment services, and other regulated financial products Name; business contact information; date of birth; residential address; citizenship; tax or government identifiers; government-issued identification and information captured from it; biometric data (subject to consent); photograph; ownership or control information; employer, title, and role; financial and business information; other personal data collected during the application and underwriting processes; device, network, and browser information; audio and/or video call recordings (subject to consent); communications and materials provided to Ramp for support or feedback Verify identity and authority; comply with know-your-customer, anti-money-laundering, sanctions, and other legal requirements; assess Company eligibility and risk; detect and prevent fraud, security incidents, and policy and legal violations; comply with contractual obligations; open and administer the selected financial product Company administrators and Authorized Users, including spend management, bill pay, reimbursements, accounts payable, accounts receivable, procurement, and related payment features Ramp finance platform and feature use and administration, including AI-enabled products Name, business contact information, address, employer, title, role, account identifiers and Ramp login information; browser, device, and network information; approximate location; usage data, metadata, and billing data; communications and materials provided to Ramp for support or feedback; government-issued identification, information captured from it, and biometric data (subject to consent for account recovery); photograph; financial, transaction, receipt, invoice, vendor, tax, bank-account, and travel information (to the extent used for a purpose specified in Section 5) Manage Ramp's relationship with and provide services to your Company, including authentication and access; provide support for Ramp's account and billing relationship; communicate with you about the Services; detect, investigate, and prevent fraud, misuse, security incidents, and violations of Ramp's terms or applicable law; comply with legal obligations; and operate, evaluate, and improve the Services, Websites, and Business Vendors, payees, merchants, contractors, and other transaction counterparties Bill pay, accounts payable, accounts receivable, procurement, card, and payment features Name and business contact information; browser, network, and device information; tax classification and tax identification information, payment and bank-account details; contracts, invoices, and purchase orders (to the extent used for a purpose specified in Section 5); usage and metadata; communications and materials provided to Ramp for support or feedback Verify counterparties and assess transaction risk; communicate about payments and the Services; detect, investigate, and prevent fraud, misuse, security incidents, and violations of Ramp's terms or applicable law; comply with legal and contractual obligations; manage Ramp's own relationship with the counterparty; and operate, evaluate, and improve the Services, Websites, and Business Company administrators and Authorized Users (SaaS-only) AI Service and feature use and administration (Stack, Token Spend Management, Router) Name and business contact information; role, Services account identifiers and login information; billing and payment information; browser, network, and device information; approximate location; identifiable information included in Service usage data or metadata; support requests and feedback; prompts, outputs and artifacts that include personal data solely to the extent flagged for security or abuse violations or violations of law Manage Ramp's relationship with and provide services to your Company, including authentication and access; assess service eligibility and availability; detect and investigate fraud, abuse, security incidents, and violations of Ramp's terms; comply with legal obligations; respond to support requests and feedback; and evaluate and improve Services, subject to applicable data-use choices and settings; compliance with legal obligations; and support communications, including content, and feedback Website visitors, prospects, referral contacts, and social-media users Website, advertising, sales, referrals, newsletters, and social media Contact and professional information; browser, network, and device information; approximate location; communications and feedback submitted to Ramp; advertising identifier(s), Website use and social media and marketing campaign engagement data; publicly-available profile information; audio and video recordings of meetings (subject to requirements under applicable law) Respond to requests; provide demonstrations and sales communications; understand and improve the Websites; measure campaigns; advertise Ramp products and Services; implement marketing preferences; detect and prevent abuse and secure the Websites; conduct business operations Other people who interact with Ramp Research, surveys, reports, sales calls, product development feedback, and other business-related communications Contact and professional information; communications and feedback; files or other content provided that include personal data; audio or video recordings where disclosed and permitted Respond to requests; provide support; train our teams; develop and improve the Services; maintain business and compliance records; detect and investigate fraud, abuse, security incidents, and violations of Ramp's terms; and comply with legal obligations A. |
| 36 | Financial Products and Services Permanent link: A. | ||
| 37 | Financial Products and Services We collect information that constitutes or that may include personal data, such as identity-verification, ownership, control-person, financial, credit, and risk information when it is needed for an application for or use of a regulated financial product or service, or when required by our Financial Institution Partners or applicable law. | ||
| 38 | The exact information depends on the product, the Company's structure, the individual's role, and the applicable legal requirements. | ||
| 46 | Personal Data Provided Directly to Ramp Permanent link: B. | 40 | SaaS Products Permanent link: B. |
| 47 | Personal Data Provided Directly to Ramp The Services are intended for use by Companies and their employees and other authorized users ("Authorized Users"). | 41 | SaaS Products If a Company signs up only for a Ramp SaaS product (including Token Spend Management, Router, or Stack) that does not include a regulated financial product, Ramp does not collect know-your-customer or underwriting information solely to provide that SaaS product, but we may collect personal data for identity verification and anti-fraud measures. 4. |
| 48 | If you or someone at your Company creates an account, we may receive ordinary account and user information about you, your Company, and individuals associated with your Company. | 42 | Sources of Personal Data We Collect Permanent link: 4. |
| 49 | If the Company also applies for or enables a regulated financial product, we may receive the additional identity-verification, ownership, underwriting, and risk information needed for that product. 1. | 43 | Sources of Personal Data We Collect A. |
| 50 | Personal Data You Provide to Us Permanent link: 1. | 44 | Personal Data You Provide to Us Permanent link: A. |
| 51 | Personal Data You Provide to Us We collect and process personal data when you submit it to our Business, including: Contact Information, including your name, email address, phone number, employer, job title, and address; Identity Verification & Risk Information, where relevant to an application for or use of a regulated financial product, including personal data of the Company's owners, control persons, and other relevant Company personnel, such as their name, email address, phone number, employer, job title, date of birth, residential address, country of citizenship, photograph, social security number, driver's license, passport or other government-issued identification, and any other information captured on the government identification or through our identity verification process, and other personal data requested by or provided to us as part of the application and underwriting processes. | 45 | Personal Data You Provide to Us We collect and process the following categories of personal data when you submit it to us: Contact Information, including your name, email address, phone number, employer, job title, and address. |
| 46 | Login Credentials. | ||
| 47 | Identity Verification Information, including government and tax identification documents (e.g., to open a Ramp account or recover access to an account), as well as other personal data requested by or provided to us as part of the application and underwriting processes to open a financial account. | ||
| 48 | Biometric Data, when you consent to provide a faceprint for identity verification purposes. | ||
| 49 | Photographs you upload to your profile. | ||
| 53 | Content, including any documentation, files, or information you provide, which may include personal data about you. | 51 | Content Provided to Ramp for Controller Purposes, including documents, files, or other materials you submit in connection with an application, support request, complaint, investigation, or feedback, which may include personal data about you or others. |
| 54 | Third-Party Information, including personal data you provide about any co-workers, contractors, vendors, or potential referrals, such as their name, email address, phone number, employer, job title, or address. | 52 | Third-Party Information, including personal data you provide about any co-workers, contractors, vendors, or potential referrals. |
| 55 | Audio and/or Video Recordings, which we may collect during sales or support calls or meetings, unless you opt out or do not provide consent, as applicable. 2. | 53 | Audio and/or Video Recordings, which we may collect during sales or support calls or meetings, unless you opt out or do not provide consent, as applicable. |
| 56 | Personal Data We Collect about Authorized Users Permanent link: 2. | 54 | Account and Billing Data: Ramp account identifiers, contact and billing details, payment-method information, charges, invoices, credits, refunds, and identifiable usage records used for Ramp's billing, account administration, or independent fraud and security purposes. |
| 57 | Personal Data We Collect about Authorized Users In connection with providing Services, we collect and process additional personal data of Authorized Users submitted by, on behalf of, and relating to a Company's Authorized Users, such as: Authorized User personal data, including your name, email, phone number, address, employer, job title, login credentials, and other information used by your Company to invite and manage Authorized Users. | 55 | B. |
| 58 | Transaction Data, including information associated with your bill payments, reimbursements, and card transactions made through your Company's Ramp Account, whether online or in person, which may include personal data. | 56 | Personal Data Collected through the Services Permanent link: B. |
| 59 | Token Spend Management Data, including payment-token identifiers and lifecycle information, the related card or account identifiers, device or merchant information, transaction authorization data, authentication events, and fraud and security signals. | 57 | Personal Data Collected through the Services We collect and process the following categories of personal data when you use the Services to the extent we are carrying out a Controller purpose described in Section 5 - How We Use Personal Data, such as underwriting, fraud and security incident detection and response, or compliance with our legal obligations: Authorized User Transaction Data, including information associated with your card transactions, payments, reimbursements, and accounts receivable in relation to your Ramp Account to the extent this information includes personal data. |
| 60 | Connected Data, including information and documentation relating to you made available to us by Third-Party Services connected to the Services. | 58 | Receipt and Invoice Data, including information submitted through the Services to pay Company invoices and process your receipts, and personal data extracted from those documents, such as a name, email, phone number, photograph, bank account or other payment details, or the contents of messages. |
| 61 | Connected Data may be made available to Ramp during the application process and after a Ramp Account is opened for your Company. | 59 | Connected Data, including information and documentation relating to you made available to us through Third-Party Services connected to the Services; for example, if your Company connects Ramp to your HRIS. |
| 62 | For example, if you link your bank account to receive or provide expense reimbursements, we will receive Bank Account Information about the linked account, like the bank routing and account numbers and account balance. | 60 | Vendor and Customer Information, including the contact information, such as name, email, phone number and address; payment details; contracts and purchase orders; and information necessary to complete tax documentation (e.g., the vendor's tax classification and tax identification number). |
| 63 | In addition, some Third-Party Services (e.g., accounting systems and business bank accounts) will provide us with information about activities outside of the Services, which may include personal data, like your business expenses and your Company's external transactions. | 61 | Metadata and Usage Data to the extent either includes personal data. |
| 64 | Other Third-Party Services, like your Company's HRIS, may disclose personal data of Authorized Users, and if your Company connects its email service, we may receive your email communications and attachments for processing. | 62 | Browser, device, and network information, such as information about the type of device or browser you use, your device's operating software and settings, your internet service provider, and device identifiers, such as a MAC address or other unique device identifier, which we may collect through cookies and other technologies, such as beacons, tags and scripts, pixels, and software development kits to help us collect and process information automatically as described in our Cookie Policy. |
| 65 | We may continue to access and receive Connected Data from a Third-Party Service until it is disconnected from the Services by you or your Company. | 63 | Approximate Location derived from your IP address. |
| 66 | Travel Data, including your business travel booking information (name, email, date of birth, gender, phone number, known traveler or redress number, and loyalty or rewards number) and itinerary. | — | Removed |
| 67 | This may include approximate location information, such as when your travel itinerary indicates you have booked a flight to or hotel in a particular location. | — | Removed |
| 68 | This does not include the mileage reimbursement feature, which uses precise geolocation data. | — | Removed |
| 69 | Receipt and Invoice Data, including information you submit to us to pay Company invoices and process your receipts, which may include personal data, such as photos, PDFs, and the contents of e-mails, and SMS messages, if you opt-in to text messages, along with associated metadata. | — | Removed |
| 70 | Vendor Data, including the identity of vendors, which may include personal data, such as their contact information, including their name, email, phone number and address, payment details, contracts and purchase orders, and information to complete tax documentation (e.g., the vendor's tax classification and tax identification number). | — | Removed |
| 72 | Personal Data Generated and Collected Automatically by Ramp Permanent link: C. | 65 | Personal Data Collected When You Visit our Websites Permanent link: C. |
| 73 | Personal Data Generated and Collected Automatically by Ramp 1. | 66 | Personal Data Collected When You Visit our Websites We collect and process the following categories of personal data when you use our Websites: Metadata and Usage Data, including the pages or content you visit, the features you interact with, workflows you construct, how much time you spend on a particular Website, your preferences or selections, and your referring and exiting pages. |
| 74 | When You Use or Interact with Our Business Permanent link: 1. | 67 | Browser, device, and network information, such as information about the type of device or browser you use, your device's operating software and settings, your internet service provider, and device identifiers, such as the IP address and advertising identifier; we also use cookies and other technologies, such as beacons, tags and scripts, pixels, and software development kits to help us collect and process information automatically as described in our Cookie Policy. |
| 75 | When You Use or Interact with Our Business We collect and process personal data of Authorized Users and other individuals, as applicable, when you use or interact with our Website, Services, and other products and services provided or used by our Business: Use Data, including information and metadata about the pages or content you visit, the features you interact with, the workflows you construct, how much time you spend on a particular Website or using the Services, login and crash data, Third-Party Services you elect to connect to or use with the Services ("Connected Data"), your preferences or selections, the time of day you browse, and your referring and exiting pages. | 68 | Approximate Location derived from your IP address. |
| 76 | SaaS and AI Product Data, including information about workspaces, projects or spaces, skills, tools, workflows, sharing settings, product interactions, prompts, messages, queries, instructions, files, connected records, generated outputs, feedback, and feature-performance or diagnostic information. | — | Removed |
| 77 | Device Data, including information about the type of device or browser you use, your device's operating software and settings, your internet service provider, and device identifiers, such as the IP address and advertising identifier. | — | Removed |
| 78 | Location Data, including an approximate location derived from your IP address or business information and precise geolocation if you choose to enable certain features, such as trip mileage reimbursement. | — | Removed |
| 79 | We use cookies and other technologies to help us collect and process information automatically. | — | Removed |
| 80 | The technologies we use to assist with this data collection include log files, cookies, web beacons, tags and scripts, pixels, and software development kits (or "SDKs"). | — | Removed |
| 81 | For additional information about cookies and similar technologies we use, including how you can opt out of some of those technologies, please visit our Cookie Policy and review Section 6 - Your Rights and Choices of this Privacy Policy. | — | Removed |
| 82 | You can also limit our collection of certain information by changing your device and software settings. | — | Removed |
| 83 | However, doing so may affect or limit the features available to you. 2. | — | Removed |
| 84 | Ramp Events Permanent link: 2. | — | Removed |
| 85 | Ramp Events If you register for an event or conference hosted or sponsored by Ramp, we may require additional information (e.g., your company name, your job title or your dietary restrictions). | — | Removed |
| 86 | Some events may have different or additional terms or privacy policies, which we will make available to you at or before the time we collect personal data for those events. | — | Removed |
| 87 | For more information, review our Ramp Events Privacy Notice. | — | Removed |
| 89 | Personal Data Collected by Ramp from Other Sources Permanent link: D. | 70 | Personal Data Collected by Ramp from Third Parties Permanent link: D. |
| 90 | Personal Data Collected by Ramp from Other Sources We also collect and process personal data of Authorized Users and other individuals, as applicable, from other sources, including: Financial Institution Partners, including banks (e.g., the bank issuing your Company's card or originating loans to finance Company expenses), card networks, payment processors, money transmitters, and other entities that provide or support delivery of financial services. | 71 | Personal Data Collected by Ramp from Third Parties We also collect and process personal data of Ramp account owners, administrators, Authorized Users, prospects, and other individuals from third parties, including: Financial Institution Partners, such as banks (e.g., the bank issuing your Company's card), card networks, payment processors, money transmitters, and other entities that provide or support delivery of financial services. |
| 91 | Identity Verification, Fraud and Compliance Monitoring, and Financial and Business Information Providers, which help us supplement our understanding of your Company and its personnel, maintain security, prevent fraud, and comply with legal obligations. | 72 | Identity Verification, Fraud and Compliance Monitoring, and Financial and Business Information Providers, which help us supplement our understanding of your Company and its personnel, detect and prevent fraud and security incidents and comply with legal obligations. |
| 92 | This may include information such as your name, address(es), phone number(s), photograph, government ID, device information, or other personal data required to verify your identity, detect and prevent fraud, and comply with our legal obligations. | 73 | Vendors and Console Users transacting with or supporting Companies (e.g., merchants and accounting firms), such as when a vendor provides payment information, which may include personal data. |
| 93 | Vendors and Console Users transacting with or supporting Companies (e.g., merchants and accounting firms). | — | Removed |
| 94 | For example, a merchant might provide us with their name, tax identification number, and payment account information so that Companies can make bill payments and report on their tax obligations. | — | Removed |
| 95 | That information may include personal data. | — | Removed |
| 97 | Social Networks, Advertising Providers, and Private Databases, which help us to identify and enrich our understanding of prospective customers and to serve and measure advertising, provide us with personal data that may include your name, email, phone number, mailing address, gender, age, and other demographic data. | 75 | Social Networks, Advertising Providers, and Private Databases, which help us to identify and enrich our understanding of prospective customers and to serve and measure advertising, provide us with personal data. |
| 98 | We also receive personal data when you interact with our pages, groups, accounts, and posts on social media platforms, which generally includes aggregate data about our followers (e.g., age, gender and location), engagement data (e.g., "likes," comments, shares, reposts, and clicks), and awareness data (e.g., number of impressions and reach), as well as individual users' public profiles. | 76 | Partners and Referring Entities that we engage for joint marketing activities and our referrals and rewards programs, which may share personal data about overlapping customers, such as their contact information and services they acquire; and individuals or organizations that refer you to Ramp. |
| 99 | Joint Marketing, Business Partnerships, Referrals, and Rewards Partners that we engage for joint marketing activities and our referrals and rewards programs, which may share information, including personal data, about overlapping customers, such as their contact information and services they acquire. | 77 | Publicly-Available Sources, including personal data in the public domain that helps us identify potential customers and partners or conduct due diligence and risk management for potential and existing customers, such as personal data about a company's personnel on its website. |
| 100 | Publicly-Available Sources, including information in the public domain that helps us identify potential customers and partners or conduct due diligence and risk management for potential and existing customers, such as personal data about a company's personnel on its website or in news articles and press releases. | 78 | The categories of personal data we collect and receive from these sources may include all of the categories identified in Section 3 - Personal Data We Process. |
| 101 | The categories of personal data we collect and receive from these sources may include all of the categories identified above in this section under "Personal Data Provided Directly to Ramp" and "Personal Data Generated and Collected Automatically by Ramp". | 79 | We treat the personal data obtained from other sources in accordance with any laws or contractual obligations applicable to us. 5. |
| 102 | We treat the personal data obtained from other sources in accordance with any laws or contractual obligations applicable to us. 4. | 80 | How We Use Personal Data Permanent link: 5. |
| 103 | How We Use Personal Data Permanent link: 4. | 81 | How We Use Personal Data We use the personal data described in Section 3 - Personal Data We Process for the following purposes where Ramp determines the purposes and means as a Controller. |
| 104 | How We Use Personal Data We use each category of personal data only for purposes that are relevant to the applicable person, product, and interaction described in Section 3. | 82 | Processing performed by Ramp on a Company's behalf is governed by the applicable Agreement and data processing addendum with that Company. |
| 105 | These business and commercial purposes include: To Provide and Maintain Our Business. | 83 | These business and commercial purposes include: To Operate and Maintain Our Business, including to complete identity verification; perform underwriting and risk analyses; enable you to use cards and other payment and spend management tools; verify financial information; establish spend limits; detect and prevent or address technical issues and disruptions; analyze and monitor usage and activities; manage our relationship with your Company, including billing and invoicing; and meet our own financial, legal, and security responsibilities. |
| 106 | To provide, operate, and manage our Services, Website, and other parts of our Business, including to perform customer validation and to enable you to use cards and our other payment tools, to verify financial information, establish spend limits, conduct identity verification, prevent or address technical issues and disruptions, and analyze and monitor usage and activities. | 84 | To Communicate with You, including sending you notices, updates, security alerts, and information regarding changes to our policies and terms; responding to support requests and feedback, and providing other transactional and relationship communications, and if applicable, marketing communications. |
| 107 | This includes processing information at your direction, including as expressed through your or your Company's use of certain features in the Services, such as a request to connect a Third-Party Service, like Slack or Lyft. | 85 | To Detect, Prevent, and Respond to Fraud and Security Incidents, which includes maintaining the safety and security of our Business and managing risk by detecting, investigating, and responding to suspicious activity, potential security incidents or fraudulent or unauthorized transactions, breaches of policies and terms, and threats of harm, including in an automated fashion. |
| 108 | To Provide Token Spend Management. | 86 | To Comply with Legal Obligations and Enforce Our Rights, including when responding to government authorities, courts, and regulators as required by law, maintaining records to demonstrate compliance with applicable law, protecting our legal rights, and pursuing remedies available to us. |
| 109 | To provision, manage, secure, support, and reconcile token-based spend-management functionality; enable authorized transactions; administer related controls; and detect and prevent fraud, misuse, and security incidents. | 87 | To Provide Ramp Rewards if your Company chooses to participate in our rewards programs, and to determine your eligibility for rewards and to facilitate the rewards program effectively. |
| 110 | To Provide SaaS and AI-Enabled Products. | 88 | To Develop and Improve Our Business so that the Services and other aspects of our Business are as useful as possible for our customers and their Authorized Users, including by identifying and troubleshooting issues with the Services, improving and expanding our products and operations, and offering new features and functionality. |
| 111 | To respond to prompts, messages, queries, instructions, and other user requests; generate and deliver requested outputs; administer workspaces, sharing, skills, tools, and connected services; troubleshoot and improve product performance; and detect, prevent, and investigate misuse, policy violations, fraud, and security incidents. | 89 | For Auditing and Research, including internal reporting, auditing, and research, such as focus groups, design partnerships, and surveys. |
| 112 | To Communicate with You. | 90 | For Marketing and Advertising, developing, sending, and measuring advertising, direct marketing, and communications about our products, offers, promotions, rewards, events, and Services. |
| 113 | To send you notices, updates, security alerts, and information regarding changes to our policies and terms, to respond to support requests and feedback, and to provide other transactional and relationship communications, and if applicable, marketing communications. | 91 | We may also use personal data, other than personal data collected through the Services, to engage in personalized or targeted advertising. |
| 114 | To Detect, Prevent, and Respond to Fraud and Security Incidents. | 92 | Where permitted by law, we use tracking technologies, such as cookies, pixels, tags, and SDKs, some of which track your activities across time and services for purposes of associating the different devices you use, and delivering relevant ads and other content to you. |
| 115 | To maintain the safety and security of our Business and to manage risk, including investigating suspicious activity, detecting and preventing potential security incidents or fraudulent or unauthorized transactions, breaches of policies and terms, and threats of harm, including in an automated fashion. | 93 | These activities concern personal data we process as a Controller, including where applicable, information about Website visitors, prospects, and other individuals, subject to applicable law and privacy choices. |
| 116 | To Comply with Legal Obligations and Enforce Our Rights. | 94 | We do not carry out targeted advertising, sales, or sharing using personal data we process on a Company's behalf as a Processor or Subprocessor. |
| 117 | To fulfill legal, regulatory, and contractual obligations, including when cooperating with government authorities, courts, and regulators in accordance with applicable law, maintaining records to demonstrate compliance with applicable law (such as financial regulations), protecting our legal rights, and pursuing remedies available to us. | 95 | For Offers, Promotions, Sweepstakes, and Contests ("Offers") we make available. |
| 118 | To Provide Ramp Rewards. | — | Removed |
| 119 | If your Company chooses to participate in our rewards program, to determine your eligibility for rewards and to facilitate the rewards program effectively. | — | Removed |
| 120 | To Develop and Improve Our Business. | — | Removed |
| 121 | To make the Services and other aspects of our Business as useful as possible for Authorized Users on behalf of their Companies, including by identifying and troubleshooting issues with the Services, improving and expanding our products and operations, and offering new features and functionality. | — | Removed |
| 122 | For example, we may develop or improve Services by analyzing how you use features, the documentation you submit, or information associated with your transactions. | — | Removed |
| 123 | For Auditing and Research. | — | Removed |
| 124 | To conduct internal reporting, auditing, and research, including focus groups and surveys. | — | Removed |
| 125 | For Marketing and Advertising. | — | Removed |
| 126 | To develop, send, and measure advertising, direct marketing, and communications about our products, offers, promotions, rewards, events, and Services. | — | Removed |
| 127 | We may also use information to engage in personalized or targeted advertising. | — | Removed |
| 128 | As part of this process, where permitted by law, we use tracking technologies, such as cookies, pixels, tags, and SDKs, some of which track your activities across time and services for purposes of associating the different devices you use, and delivering relevant ads and other content to you. | — | Removed |
| 129 | For further information on the types of tracking technologies we use and your rights and choices regarding analytics and targeted advertising, please see Section 6 - Your Rights and Choices and our Cookie Policy. | — | Removed |
| 130 | Even if you opt out of personalized advertising, you may continue to see advertising, including potentially from us. | — | Removed |
| 131 | If you connect your bank account to your Company's Ramp account, we will not use your bank account information to market our Business on advertising platforms. | — | Removed |
| 132 | For Offers, Promotions, and Contests. | — | Removed |
| 133 | At times, we offer certain opportunities or rewards through contests, sweepstakes, and other special offers and promotions (collectively, "Offers"). | — | Removed |
| 135 | Certain Offers may be construed as "financial incentives" under California law; California residents should review our Notice of Financial Incentives. | 97 | Certain Offers may be construed as "financial incentives" under California law, and California residents should review our Notice of Financial Incentives. |
| 136 | Generating De-identified, Aggregated, and/or Anonymized Information. | 98 | Generating De-identified, Aggregated, and/or Anonymized Information, including when we remove or mask personal data that could be used to identify you, or by aggregating or combining information so that it does not identify you; we may use information that does not identify you for any purpose permitted by law and our Agreement with your Company. |
| 137 | To develop de-identified, aggregated, and/or anonymized information, including by removing or masking information that could be used to identify you, and by aggregating or combining information so that it does not identify an individual. | 99 | With Your Consent where we request your consent to process your personal data. |
| 138 | We may use information that does not identify you for any purpose permitted by law and as required to meet our contractual obligations. | 100 | For information about your rights and choices regarding how we use your personal data, please see Section 7 - Your Rights and Choices below. 6. |
| 139 | At Your Direction. | 101 | Disclosure of Personal Data by Ramp Permanent link: 6. |
| 140 | To fulfill any other purpose at your direction, including as expressed through your or your Company's use of Services functionality. | 102 | Disclosure of Personal Data by Ramp This section describes disclosures of personal data Ramp processes as a Controller. |
| 141 | For example, if you direct us to connect your Ramp Account to a Third-Party Service, such as Slack or Lyft, we will process that request accordingly. | 103 | Disclosures made solely on a Company's behalf are governed by the applicable agreement and data processing addendum between Ramp and the relevant Company. |
| 142 | With Notice to You and Your Consent. | — | Removed |
| 143 | We may otherwise use personal data we collect after providing notice to you and obtaining your consent. | — | Removed |
| 144 | For information about your rights and choices regarding how we use your personal data, please see Section 6 - Your Rights and Choices below. 5. | — | Removed |
| 145 | Disclosure of Personal Data by Ramp Permanent link: 5. | — | Removed |
| 146 | Disclosure of Personal Data by Ramp We disclose personal data we collect in accordance with this Privacy Policy. | — | Removed |
| 148 | We may disclose information that does not identify you (including information that has been aggregated or de-identified) for any purpose except as prohibited by law or contractual obligation applicable to us. | 105 | Affiliates ↗ of Ramp Business Corporation. |
| 149 | Affiliates. | 106 | Professional Advisers, such as legal, audit, insurance, and other professional advisers as reasonably necessary for their advice and services. |
| 150 | We disclose personal data to affiliates and related entities ↗ of Ramp Business Corporation. | 107 | Service Providers that process personal data on our behalf for services, such as cloud infrastructure, web hosting, analytics, developing and improving our Services and Websites, processing payments, providing rewards, serving advertisements, providing communications and technical support, detecting and responding to security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and debugging to identify and repair errors in the Services. |
| 151 | Service Providers. | 108 | Where a Company independently engages an AI provider or connected service and directs Ramp to transmit personal data to it, that recipient's processing is governed by its agreement with the Company. |
| 152 | We disclose personal data to service providers that process information on our behalf. | — | Removed |
| 153 | Service providers assist us with services, such as cloud infrastructure, Website hosting, analytics, developing and improving the Services and Websites, processing payments, providing rewards, serving advertisements, providing communications and technical support, detecting and responding to security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and debugging to identify and repair errors in the Services. | — | Removed |
| 154 | For SaaS and AI-enabled products, service providers may include model providers, hosting and infrastructure providers, safety and content-monitoring providers, and providers that support connectors, search, tools, and technical support. | — | Removed |
| 155 | We disclose content and other personal data to these providers only as needed to provide, secure, support, and improve the applicable Service, at your or your Company's direction where applicable, or as otherwise described in the applicable agreement or notice. | — | Removed |
| 156 | Depending on the service, we may provide personal data on a continuous basis (e.g., fraud services) or on an as-needed basis. | — | Removed |
| 157 | We impose contractual restrictions on our service providers' processing of personal data, although we may permit them to use information that does not identify you (such as information that has been aggregated, de-identified, or anonymized) subject to applicable law. | — | Removed |
| 159 | Business Customers. | 110 | Business Customers with whom we have an Agreement for tasks such as billing, administration of the Services, fraud and security investigations, and legal obligations. |
| 160 | We disclose personal data to your Company so that we can provide Services on the Company's behalf. | 111 | Disclosures made solely to carry out the Company's instructions are governed by the relevant Agreement and DPA. |
| 161 | For example, we may disclose personal data to your Company to process your payment transactions, provide Services, report on your use of your Company's Ramp Account, respond to your and their questions, comply with your and their requests, and otherwise comply with the law. | 112 | Providers of Connected Services to the extent necessary to carry out one of the purposes specified in Section 5 - How We Use Personal Data. |
| 162 | In addition, your Company can assign different roles to Authorized Users, which will have different associated capabilities and permissions. | 113 | Financial Institution Partners, such as banks, card networks, and payment processors, to support their customer identification, risk, and compliance programs, and so they can determine eligibility for, and provide, products and services to your Company, either directly or through us. |
| 163 | We will disclose some personal data about your use of the Services to other Authorized Users within, or individuals acting on behalf of, your Company. | 114 | Credit Reporting Agencies and Other Financial Information Providers to the extent necessary in relation to a Company to verify information about the Company, report on the Company's performance, or report missed or late payments or other defaults. |
| 164 | Those individuals may include members of your Company's finance department, your manager, other Company personnel, or a Company service provider. | 115 | Vendors, Customers, and Console Users that transact with or support your Company through the Services. |
| 165 | Each Company is an independent entity, and the Company's processing of personal data is subject to the Company's own policies and terms. | 116 | Ramp Rewards Providers as necessary to determine your Company's eligibility for rewards and to facilitate the rewards program effectively. |
| 166 | SaaS Product Administrators and Authorized Users. | 117 | Analytics, Marketing, and Advertising Providers and Agencies to conduct analytics and to place advertisements on our behalf on third-party websites and services; these advertising disclosures exclude personal data Ramp processes on a Company's behalf as a Processor or Subprocessor. |
| 167 | Where enabled by a Company, Company administrators and other Authorized Users may be able to access, manage, export, retain, or delete account information, workspaces, prompts, messages, files, connected data, generated outputs, and other content associated with Stack, Glass, or another SaaS or AI-enabled product. | 118 | Referrals and Joint Marketing Partners in connection with facilitating referral partnerships or engaging in joint marketing activities. |
| 168 | The Company is responsible for configuring access and sharing permissions and providing any notices required for its administration of those products. | — | Removed |
| 169 | Providers of Connected Services. | — | Removed |
| 170 | We disclose personal data to Third-Party Services and their providers if you or your Company choose to use Third-Party Services in connection with the Services, such as Slack, Uber, Google, or NetSuite. | — | Removed |
| 171 | Financial Institution Partners. | — | Removed |
| 172 | We disclose personal data to Financial Institution Partners, such as banks, card networks, and payment processors, to support their customer identification, risk, and compliance programs, and so they can determine eligibility for, and provide, products and services to your Company, either directly or through us. | — | Removed |
| 173 | This information also enables our Financial Institution Partners to deliver card, payments, treasury, and international transfer capabilities through our Services. | — | Removed |
| 174 | For example, to comply with Know-Your-Customer requirements and requests for information, we may disclose to our Financial Institution Partners your name, email, phone number, employer, job title, date of birth, residential address, country of citizenship, photograph, social security number, and driver's license, passport or other government-issued identification, other information captured through our identity verification process, and Ramp card and transaction information. | — | Removed |
| 175 | Credit Reporting Agencies and Other Financial Information Providers. | — | Removed |
| 176 | We disclose personal data about your Company and its Ramp Account to credit reporting agencies to verify information about your Company, to report on your Company's performance, and to report late payments, missed payments, or other defaults. | — | Removed |
| 177 | While this information is generally about the Company, it may include personal data. | — | Removed |
| 178 | Vendors and Console Users. | — | Removed |
| 179 | We disclose personal data to entities that transact with or support your Company. | — | Removed |
| 180 | For example, we may disclose the status of your Company's payments to the recipient vendor, which may include personal data, such as contact information. | — | Removed |
| 181 | Ramp Rewards Providers. | — | Removed |
| 182 | We disclose personal data about you and your Company's Ramp Account as necessary to determine your Company's eligibility for rewards and to facilitate the rewards program effectively. | — | Removed |
| 183 | Analytics, Marketing, and Advertising Providers and Agencies. | — | Removed |
| 184 | We disclose personal data to agencies, advertisers, ad networks, and other technology services to conduct analytics and to place advertisements on our behalf on third-party websites and services. | — | Removed |
| 185 | If you connect your bank account to your Company's Ramp account, we will not disclose your bank account information to market our Business on advertising platforms. | — | Removed |
| 186 | Referrals and Joint Marketing Partners. | — | Removed |
| 187 | We disclose personal data about you and your Company's Ramp Account to our partners in connection with facilitating referral partnerships or engaging in joint marketing activities. | — | Removed |
| 189 | Mergers and Acquisitions. | 120 | Mergers and Acquisitions to the extent reasonably necessary, including to an acquiring entity, legal counsel, consultants, or others in connection with, or during negotiations of, any proposed or actual merger, purchase, sale, or any other type of acquisition or business combination of all or any portion of our assets or transfer of all or a portion of our business to another business. |
| 190 | We may disclose personal data to an acquiring entity, legal counsel, consultants, or others in connection with, or during negotiations of, any proposed or actual merger, purchase, sale, or any other type of acquisition or business combination of all or any portion of our assets or transfer of all or a portion of our business to another business. | 121 | Identity Verification and Risk Providers that help us verify your and your Company's identity and perform other compliance functions. |
| 191 | Identity Verification and Risk Providers. | 122 | Public Authorities, such as financial services or other regulators to comply with applicable law, payment network rules, and legal process, to investigate suspicious or potentially fraudulent activity, and where required in response to lawful requests by regulators, courts, law enforcement, and other public authorities, including to meet national security, anti-money laundering, or law enforcement requirements. |
| 192 | We disclose personal data to third-party services that help us verify your and your Company's identity and perform other compliance functions. | — | Removed |
| 193 | In addition, to prevent fraud and safeguard our customers and Business, we disclose information to risk and security partners, including personal data about interactions with our Services and transactions. | — | Removed |
| 194 | Public Authorities. | — | Removed |
| 195 | We may disclose personal data to public authorities, such as financial services or other regulators to comply with applicable law, payment network rules, and legal process, to investigate suspicious or potentially fraudulent activity, and where required in response to lawful requests by regulators, courts, law enforcement, and other public authorities, including to meet national security, anti-money laundering, or law enforcement requirements. | — | Removed |
| 197 | For information about your rights and choices regarding how we share personal data about you, please see Section 6 - Your Rights and Choices below. 6. | 124 | For information about your rights and choices regarding how we share personal data about you, please see Section 7 - Your Rights and Choices below. 7. |
| 198 | Your Rights and Choices Permanent link: 6. | 125 | Your Rights and Choices Permanent link: 7. |
| 201 | Access, Correction, Deletion, and Objection to or Restriction of Processing Ramp Services are intended for use by business customers ("Companies"), and you may only use a Ramp account if you are an employee or other Authorized User of a Company that has opened a Ramp account. | 128 | Access, Correction, Deletion, and Objection to or Restriction of Processing Ramp Services are intended for use by business customers (each a "Company"), and you may only use a Ramp account if you are an owner, administrator, or Authorized User of a Company. |
| 202 | The information in a Company's Ramp Account is governed by our Agreement with the Company. | 129 | The information in a Company's Ramp Account is governed by our Agreement with the Company, and the Company and its administrators determine how personal data is processed on the Company's behalf. |
| 203 | You should direct questions about personal data we are processing on behalf of a Company to that Company and its administrators. | 130 | You should direct questions about personal data we process on behalf of a Company to that Company and its administrators. |
| 204 | If you are an Authorized User, you may also be able to access, update, or delete certain personal data within your Company's Ramp account through the Services. | 131 | If you are an Authorized User, you may also be able to access, update, or delete certain personal data within your Ramp account through the Services. |
| 205 | However, the Company and its administrators are generally responsible for determining how that personal data is processed. | 132 | You may contact Ramp directly about personal data processing described in this Privacy Policy for which Ramp acts as a Controller, whether or not you have a Ramp account. |
| 206 | Subject to limitations under applicable law, residents of certain jurisdictions have rights and choices with respect to your personal data, including the right to: Know what personal data we process about you and to access and receive an electronic copy of your personal data. | 133 | Subject to limitations under applicable law, residents of certain jurisdictions have rights and choices with respect to your personal data, including the right to: Know what personal data we process about you and access and receive an electronic copy of your personal data. |
| 209 | Under certain circumstances, in jurisdictions such as the U.K. and the E.U., the right to request that we restrict processing of your personal data and/or to object to how we process personal data about you. | 136 | Under certain circumstances, in jurisdictions such as the U.K. and the E.U., request that we restrict processing of your personal data and/or object to how we process personal data about you. |
| 210 | Where we process your personal data based on consent, the right to withdraw that consent at any time with respect to future processing. | 137 | Where we process your personal data based on consent, withdraw that consent at any time with respect to future processing (however, depending on the circumstances, this may limit the usefulness or availability of certain services). |
| 211 | These rights may be limited, for example, if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights), or if you ask us to delete information which we are required by law to keep or have a compelling legitimate interest to keep. | 138 | These rights may be limited, for example, if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights), or if you ask us to delete information which we are required by legal or contractual obligations to keep or have a compelling legitimate interest to keep. |
| 213 | To exercise any of your rights, please submit a request through our Privacy Center ↗. | 140 | To exercise any of your rights, you can submit a request through our Privacy Center ↗ or email us at privacy@ramp.com. |
| 215 | We may require additional information from you to help us verify your identity and process your request. | 142 | We may verify your identity to exercise certain rights, in which case we will request information reasonably needed to verify your identity and process the request; if we cannot complete required verification, we may deny that request. |
| 216 | If we are unable to verify your identity, we may deny your request. | — | Removed |
| 218 | However, if you wish to make your request directly to us, please provide the name of your Company on whose behalf we processed your personal data. | 144 | However, if you wish to make your request directly to us, please provide the name of the Company on whose behalf we processed your personal data. |
| 219 | We will refer your request to that Company, and we will support them as required by applicable law to respond to your request. | 145 | We will refer your request to that Company, and we will support them as required by applicable law to respond to your request to the extent we are able to verify that you are associated with that Company and applicable law permits the notification. |
| 220 | In certain jurisdictions, you have the right to appeal to us a decision we've made to refuse to take action in response to your exercise of one of the rights above. | 146 | If you do not have a Ramp account but your personal data appears in a Company's connected records, communications, prompts, or outputs because a Company supplied it, retrieved it through an authorized connection, or otherwise generated it through interactions with our Business, we will refer the portion of your request concerning processing on the Company's behalf and address any portion concerning Ramp's own Controller processing ourselves. |
| 147 | Where the Company that instructed us is itself a Processor for another organization, we will refer your request to the Company we have a direct relationship with, which remains responsible for further routing consistent with its own obligations. | ||
| 148 | If you are concerned about the way in which we are managing your personal data, please contact us using the contact details set out below. | ||
| 149 | Complaints must be lodged in writing. | ||
| 150 | We will deal with the matter within a reasonable time and will keep you informed of the progress of our investigation. | ||
| 151 | If we have not responded to you within a reasonable time or if you feel that your complaint has not been resolved satisfactorily, you can contact us to discuss your concerns. | ||
| 152 | You can appeal to us a decision we've made to refuse to take action in response to your exercise of one of the rights above. | ||
| 222 | Residents of the E.U., Switzerland, and the U.K. also have the right to lodge a complaint with the data protection regulator in your jurisdiction. | 154 | If you reside in certain jurisdictions, including Australia, the E.E.A., Switzerland, and the U.K., you have the right to lodge a complaint with the data protection regulator in your jurisdiction. |
| 156 | If you reside in the U.K., you also have the right to submit a data protection complaint to us directly by emailing us at privacy@ramp.com. | ||
| 230 | If you are unable to opt-out through those methods, you can email us at privacy@ramp.com. | 163 | If you are unable to opt out through those methods, you can email us at privacy@ramp.com. |
| 234 | After you send the SMS message "STOP" to us, we will send you a SMS message to confirm that you have been unsubscribed. | 167 | After you send the SMS message "STOP" to us, we will send you an SMS message to confirm that you have been unsubscribed. |
| 236 | Text messaging originator opt-in data and consent will not be shared, sold, rented, or otherwise disclosed by us for marketing purposes. | 169 | For more information, refer to our Text & SMS Terms. 3. |
| 237 | For more information, please see the Agreement. | — | Removed |
| 238 | You may be required to communicate your preferences separately to opt out of receiving messages through other platforms, such as WhatsApp. 3. | — | Removed |
| 251 | You can instruct your browser or device, by changing its settings, to decline or delete cookies and similar technologies ("Cookies"). | 182 | You can instruct your browser or device to decline or delete cookies and similar technologies ("Cookies") by changing the appropriate settings. |
| 252 | Please be aware that if you disable or remove Cookies some parts of our Business may not function correctly and settings and preferences controlled by those Cookies, including advertising preferences, may be deleted and may need to be reset. | 183 | If you disable or remove Cookies, some parts of the Services or our Websites may not function correctly and settings and preferences controlled by those Cookies, including advertising preferences, may be deleted and may need to be reset. |
| 253 | You can modify your Cookie preferences for our Website by opting out on our Your Privacy Choices ↗ page. | 184 | You can modify your Cookie preferences for our Websites by opting out on our Your Privacy Choices ↗ page. |
| 254 | If you use multiple browsers or devices, you may need to instruct each browser or device separately. | 185 | If you use multiple browsers or devices, you need to instruct each browser or device separately. |
| 257 | We may use session-replay technologies to understand how users interact with the Service, including clicks, scrolling, page navigation, and technical information about a session, to troubleshoot, secure, and improve the Service. | 188 | We use session-replay technologies to understand how users interact with the Services, including clicks, scrolling, page navigation, and technical information about a session, to troubleshoot, secure, and improve the Service. |
| 259 | Where required by law, we obtain your consent before enabling session replay. 2. | 190 | Where required by law, we will obtain your consent before enabling session replay. 2. |
| 262 | Our Website is designed to respect your GPC preferences. 3. | 193 | Our Websites are designed to respect your GPC preferences. 3. |
| 277 | To opt out of targeted advertising, "sales," or "sharing" (as defined by applicable law) of your personal data, visit our Your Privacy Choices page or click the "Your Privacy Choices" in the footer of our Website. | 208 | This section addresses personal data we process as a Controller in connection with our own advertising, such as data about Website visitors and prospects; we do not carry out targeted advertising, "sales," or "sharing" using personal data we process on a Company's behalf as a Processor. |
| 209 | To opt out of targeted advertising, "sales," or "sharing" (as defined by applicable law) of your personal data, visit our Your Privacy Choices page or click the "Your Privacy Choices" link in the footer of our Websites. | ||
| 289 | You will be notified prior to a recording, and if you want to opt out of or don't want to opt in to the recording, as the case may be, you should follow the instructions presented in the notice. 7. | 221 | You will be notified prior to a recording, and if you want to opt out of or don't want to opt in to the recording, as the case may be, you should follow the instructions presented in the notice. 8. |
| 290 | International Data Transfers Permanent link: 7. | 222 | International Data Transfers Permanent link: 8. |
| 295 | In certain situations, regulators, courts, and law enforcement agencies might be entitled to access your personal data (for more information see Section 5 - Disclosure of Personal Data by Ramp). | 227 | In certain situations, regulators, courts, and law enforcement agencies might be entitled to access your personal data (for more information see Section 6 - Disclosure of Personal Data by Ramp). |
| 296 | For personal data transferred from the European Economic Area ("E.E.A."), Switzerland, or the U.K., we will provide appropriate safeguards for transfers of your personal data outside of those jurisdictions, including: (1) transferring the personal data to countries recognized by the European Commission ↗, the Swiss Federal Data Protection and Information Commissioner ↗, and/or U.K. Information Commissioner's Office ↗ as offering an adequate level of protection for personal data; (2) transferring the personal data pursuant to contractual obligations, including Standard Contractual Clauses ↗ ("SCCs") and addenda specific to Switzerland and/or the U.K., as applicable; and (3) confirming service providers to which we transfer personal data have active self-certification under the E.U.-U.S. Data Privacy Framework, the U.K. Extension to the E.U.-U.S. DPF, or the Swiss-U.S. DPF, as applicable. | 228 | For personal data transferred from the European Economic Area ("E.E.A."), Switzerland, or the U.K., we will provide appropriate safeguards for transfers of your personal data outside of those jurisdictions, including: (1) transferring the personal data to countries recognized by the European Commission ↗, the Swiss Federal Council ↗, and/or U.K. Secretary of State ↗ as offering an adequate level of protection for personal data; (2) transferring personal data pursuant to contractual obligations, including Standard Contractual Clauses ↗ ("SCCs") and addenda specific to Switzerland and/or the U.K., as applicable; and (3) confirming service providers to which we transfer personal data have active self-certification under the E.U.-U.S. Data Privacy Framework, the U.K. Extension to the E.U.-U.S. DPF, or the Swiss-U.S. DPF, as applicable. |
| 300 | For more information about our security measures, visit our Trust Center ↗. | 232 | For more information about our security measures, visit our Trust Center ↗. 9. |
| 301 | If you are a resident of the province of Quebec, please note that we transfer and store personal data outside of Quebec province. 8. | 233 | Lawful Basis for Processing Personal Data Permanent link: 9. |
| 302 | Lawful Basis for Processing Personal Data Permanent link: 8. | — | Removed |
| 304 | Where we are the Controller of your personal data, we rely on the following lawful bases: At your direction and in performance of a contract we have with you. | 235 | Where we are the Controller of your personal data, we rely on the following lawful bases: Performance of a contract, where the processing is necessary to perform that contract or take steps at your request before entering into it. |
| 305 | Compliance with our legal obligations or to preserve or enforce our legal rights. | 236 | Compliance with our legal obligations. |
| 307 | To further the legitimate interests of Ramp or a third party, for example, to: (1) administer and conduct our business, including maintaining and improving the Services; (2) detect, prevent, and respond to security incidents; (3) detect and prevent fraud; and (4) conduct marketing and analytics activities. 9. | 238 | To further the legitimate interests of Ramp or a third party, for example, to: (1) administer and conduct our business, including maintaining and improving the Services; (2) detect, prevent, and respond to security incidents; (3) detect and prevent fraud; (4) conduct marketing and analytics activities; and (5) establish, exercise, or defend legal claims, where these interests are not overridden by your interests or fundamental rights and freedoms. 10. |
| 308 | Automated Decision-Making and Artificial Intelligence Permanent link: 9. | 239 | Automated Decision-Making and Artificial Intelligence Permanent link: 10. |
| 310 | Depending on the product and workflow, AI Systems may assist with tasks such as: verifying identity and business information; detecting and preventing fraud, suspicious activity, sanctions or compliance risks, unauthorized transactions, and security threats; supporting business application review, underwriting, eligibility, and risk-management processes for financial products; matching receipts, invoices, transactions, accounting information, and other records; applying Company policies, controls, workflows, and product settings; generating policies and workflows; and improving, troubleshooting, and securing our Services. | 241 | Depending on the product and workflow, AI Systems may assist with tasks such as: verifying identity and business information. detecting and preventing fraud, suspicious activity, sanctions or compliance risks, unauthorized transactions, and security threats. supporting business application review, underwriting, eligibility, and risk-management processes for financial products. improving, troubleshooting, and securing our Services. |
| 242 | The examples in this section concern Ramp's Controller processing. | ||
| 243 | Customer-directed AI functionality is governed by the applicable agreement and data processing addendum between Ramp and the relevant Company. | ||
| 312 | Ramp does not use AI Systems to make a decision based solely on automated processing that produces legal or similarly significant effects for an individual subject to this Privacy Policy. 10. | 245 | Ramp does not use AI Systems to make decisions based solely on automated processing that produces legal or similarly significant effects for an individual subject to this Privacy Policy. |
| 313 | Security Permanent link: 10. | 246 | With respect to residents of the E.E.A., we do not use AI Systems classified as "High Risk." 11. |
| 247 | Security Permanent link: 11. | ||
| 316 | We recommend you use strong passwords, use multi-factor authentication to access your account, and otherwise follow your Company's information security practices. | 250 | We recommend you use strong passwords or passphrases, passkeys, multi-factor authentication, and otherwise follow your Company's information security practices. |
| 317 | If you suspect unauthorized activity with respect to your Ramp account or you suspect a security incident has occurred, you should contact us immediately at security@ramp.com. 11. | 251 | If you suspect unauthorized activity with respect to your Ramp account or you suspect a security incident has occurred, you should contact us immediately at security@ramp.com. 12. |
| 318 | Use by Minors Permanent link: 11. | 252 | Use by Minors Permanent link: 12. |
| 322 | If you are a parent or guardian of a minor and believe your minor uses the Services, contact us at privacy@ramp.com. 12. | 256 | If you are a parent or guardian of a minor and believe your minor uses the Services, contact us at privacy@ramp.com. 13. |
| 323 | Retention Permanent link: 12. | 257 | Retention Permanent link: 13. |
| 326 | The following describes the principal retention triggers and criteria we use: Record category Retention period or criteria Account, user, and product records For the life of the relevant account, user relationship, or enabled product, followed by the period reasonably needed to close the account, complete pending activity, provide requested exports, maintain audit trails, resolve disputes, and meet legal obligations Applications, identity-verification, ownership, underwriting, and compliance records From collection or the application decision through the period required by financial-services, anti-money-laundering, sanctions, credit, recordkeeping, or other applicable law, generally measured from the application decision, account closure, transaction, or end of the relevant relationship Transaction, payment, card, reimbursement, invoice, receipt, travel, procurement, and accounting records For the life of the relevant account, user relationship, or enabled product, followed by the period reasonably needed to close the account, complete pending activity, provide requested exports, maintain audit trails, resolve disputes, and meet legal obligations Connected Data and Company content While the relevant connection or product is enabled and thereafter for the period needed to complete pending workflows, honor the Company's deletion or export instructions, protect account integrity, and satisfy legal, contractual, audit, and dispute requirements. | 260 | This section describes retention for Ramp's Controller purposes. |
| 327 | This includes, where applicable, prompts, messages, files, connected records, generated outputs, feedback, and workspace or sharing information SaaS products. | 261 | For personal data processed on a Company's behalf, retention and deletion are governed by the Agreement, DPA, and Company's documented instructions, including settings and configurations within the Services. |
| 328 | Security, fraud, authentication, and technical logs For periods based on the security purpose, sensitivity, and risk of the data, including the time needed to detect patterns, investigate incidents, prevent repeat abuse, maintain system integrity, and satisfy security or legal requirements Support, sales, research, event, and business communications For the duration of the interaction and thereafter based on the nature of the communication, the status of the relationship, quality and training needs, recording choices, and applicable legal, contractual, and dispute requirements Website, cookie, analytics, and advertising data For the periods described in our Cookie Policy or the applicable tool, consent, or preference setting; marketing contact information is retained until you opt out or it is no longer needed, with suppression records retained to honor your choice Privacy requests, consents, objections, and compliance records For the period needed to respond to the request or administer the choice and thereafter to demonstrate compliance, prevent repeated unauthorized requests, and meet applicable limitation and recordkeeping periods We periodically review whether personal data remains necessary for the stated purpose. | 262 | The following describes the principal retention triggers and criteria we use: Record Category Retention Period or Criteria Account, user, and product records For the duration of the relevant account or customer relationship and thereafter for the period needed to complete account closure and billing, maintain required records, resolve disputes, protect security, and meet legal obligations Applications, identity-verification, ownership, underwriting, and compliance records From collection or the application decision through the period required by financial-services, anti-money-laundering, sanctions, credit, recordkeeping, or other applicable law, generally measured from the application decision, account closure, transaction, or end of the relevant relationship. |
| 329 | When a retention period expires or the applicable purpose no longer requires identifiable data, we delete, de-identify, or anonymize the data, or place it in a restricted archive when continued storage is required by law. | 263 | Biometric data is stored for the period set out in our Biometric Privacy Notice Transaction, payment, card, reimbursement, invoice, receipt, travel, procurement, and accounting records For the period needed for the applicable purpose for which Ramp acts as a Controller, including applicable recordkeeping periods. |
| 330 | Data subject to a legal hold, regulatory inquiry, investigation, dispute, fraud-prevention need, or security incident may be retained until the matter and any related preservation period end. | 264 | Customer-directed records held solely on a Company's behalf are governed by the DPA Connected Data and content processed for Ramp's independent Controller purposes For the period needed for the specific Controller purpose, such as resolving a support request, investigating fraud or abuse, complying with law, or resolving a dispute, subject to applicable product-specific data controls. |
| 265 | This does not establish retention periods for content processed solely on a Company's behalf Security, fraud, authentication, and technical logs For periods based on the security purpose, sensitivity, and risk, including the time needed to detect patterns, investigate incidents, prevent repeat abuse, maintain system integrity, and satisfy security or legal requirements Support, sales, research, and business communications For the duration of the interaction and thereafter based on the nature of the communication, the status of the relationship, quality and training needs, recording choices, and applicable legal, contractual, and dispute requirements Website, cookie, analytics, and advertising data For the periods described in our Cookie Policy or the applicable tool, consent, or preference setting; marketing contact information is retained until you opt out or it is no longer needed, with suppression records retained to honor your choice Privacy requests, consents, objections, and compliance records For the period needed to respond to the request or administer the choice and thereafter to demonstrate compliance, prevent repeated unauthorized requests, and meet applicable limitation and recordkeeping periods Data retention in certain Services can be configured by account administrators or users. | ||
| 266 | Where that is the case, our retention complies with the relevant description made available in the settings, privacy notice, or the Agreement. | ||
| 267 | We periodically review whether personal data remains necessary for the stated purpose. | ||
| 268 | When a retention period expires or the applicable purpose no longer requires identifiable data, we delete, de-identify, or anonymize the personal data, or place it in a restricted archive when continued storage or processing is required by law. | ||
| 269 | Personal data subject to a legal hold, regulatory inquiry, investigation, dispute, fraud-prevention need, or security incident may be retained until the matter and any related preservation period end. | ||
| 332 | Where Ramp processes personal data solely on behalf of a Company, retention and deletion are also governed by the Agreement and the Company's instructions. 13. | 271 | Where Ramp processes personal data solely on behalf of a Company, retention and deletion are also governed by the Agreement and the Company's instructions. 14. |
| 333 | Changes to this Privacy Policy Permanent link: 13. | 272 | Changes to this Privacy Policy Permanent link: 14. |
| 336 | We reserve the right to change and reissue this Privacy Policy at any time by posting an updated version on our Website. | 275 | We reserve the right to change and reissue this Privacy Policy at any time by posting an updated version on our Websites. |
| 337 | If we make material changes in the way we collect, use, or disclose your personal data, we will provide you reasonable advanced notice of the changes before they take effect for you. | 276 | If we make material changes in the way we collect, use, or disclose your personal data, we will provide you notice of the changes before they take effect for you. |
| 338 | If we have an existing relationship with you, you represent a Company, or if you are an Authorized User, we may provide you notice through our Website, through your Company's Ramp Account, or directly using the contact information you have provided to us. | 277 | If we have an existing relationship with you, you represent a Company, or if you are an Authorized User, we may provide you notice through our Websites, through your Company's Ramp Account, or directly using the contact information you have provided to us. |
| 339 | If we do not have an existing relationship with you (for instance, if you only visit our Website), any notice we provide will be posted to our Website. | 278 | If we do not have an existing relationship with you (for instance, if you only visit our Websites), any notice we provide will be posted to our Websites. |
| 340 | If you continue using the Services after those changes are in effect, our processing of your personal data will be subject to the new Privacy Policy. | 279 | If you continue using the Services after those changes are in effect, our processing of your personal data as a Controller will be subject to the new Privacy Policy. |
| 341 | We encourage you to regularly review this Privacy Policy to ensure that you remain aware of what personal data we collect, how we use and otherwise process it, under what circumstances we will disclose it to third parties, and your privacy rights and choices. 14. | 280 | We encourage you to regularly review this Privacy Policy to ensure that you remain aware of what personal data we collect, how we use and otherwise process it, under what circumstances we will disclose it to third parties, and your privacy rights and choices. 15. |
| 342 | Contact Us; Data Controller Permanent link: 14. | 281 | Contact Us; Data Controller Permanent link: 15. |
| 343 | Contact Us; Data Controller If you have questions about this Privacy Policy or our practices with respect to personal data, or if you have difficulty accessing the information in this Privacy Policy, please contact us: By email: privacy@ramp.com By mail: Ramp Business Corporation, Attn: Privacy Counsel, 28 West 23rd, Floor 2, New York, NY 10010 Ramp may process personal data in accordance with the instructions of or on behalf of a Company, including when providing Services to a Company under an Agreement. | 282 | Contact Us; Data Controller If you have questions about this Privacy Policy or our practices with respect to personal data, or if you have difficulty accessing the information in this Privacy Policy, please contact us: By email: privacy@ramp.com By mail: Ramp Business Corporation, Attn: Privacy Counsel, 28 West 23rd Street, Floor 2, New York, NY 10010 Where we act as the Controller, the Controller is Ramp Business Corporation, unless we specify otherwise in writing. |
| 344 | In this context, Ramp acts as a Processor and the Company acts as a Controller. | 283 | If your Company's Agreement specifies another Ramp entity, that entity is the Controller of your personal data. 16. |
| 345 | Ramp may also act as a Controller when directly determining the purposes for and means of processing personal data in other business contexts as set out in this Privacy Policy, like complying with regulatory obligations applicable to our Business. | 284 | Additional Information for California Residents Permanent link: 16. |
| 346 | Where we act as the Controller, the Controller is Ramp Business Corporation, unless we specify otherwise in writing. 15. | — | Removed |
| 347 | Additional Information for California Residents Permanent link: 15. | — | Removed |
| 351 | At or before the time of collection of your personal data, you have the right to know the categories of personal data and sensitive personal data to be collected (see Section 3 - Personal Data Ramp Processes), the purposes for the collection and use of your personal data (see Section 4 - How We Use Personal Data), whether your personal data is "sold" or "shared" (as defined under California law), and how long your personal data is retained (see Section 12 - Retention). | 288 | At or before the time of collection of your personal data, you have the right to know the categories of personal data and sensitive personal data to be collected (see Section 3 - Personal Data We Process), the purposes for the collection and use of your personal data (see Section 5 - How We Use Personal Data), whether your personal data is "sold" or "shared" (as defined under California law), and how long your personal data is retained (see Section 13 - Retention). |
| 354 | Categories of Personal Data We Collect California law requires businesses collecting or disclosing personal data to provide notices and means to exercise those rights. | 291 | Categories of Personal Data We Collect California law requires businesses collecting or disclosing personal data to provide notices and information about privacy rights and methods to exercise those rights. |
| 357 | Employment Information. | 294 | Professional or Employment-related Information. |
| 362 | Audio and/or Video Recording. | 299 | Audio, Electronic, Visual, or Similar Information, such as photographs, recordings, communications, and submitted content. |
| 364 | Precise Geolocation Data when you choose to enable certain features such as trip mileage reimbursement. | — | Removed |
| 366 | For further details on personal data we collect, including the sources from which we receive personal data, review Section 3 - Personal Data Ramp Processes. | 302 | For further details on personal data we collect, including the sources from which we receive personal data, review Section 3 - Personal Data We Process and Section 4 - Sources of Personal Data We Collect. |
| 367 | We collect and use these categories of personal data for the business purposes described in Section 4 - How We Use Personal Data above. | 303 | We collect and use these categories of personal data for the business purposes described in Section 5 - How We Use Personal Data above. |
| 368 | We disclose the personal data to the categories of persons set out in Section 5 - Disclosure of Personal Data by Ramp above. | 304 | We disclose the personal data to the categories of persons set out in Section 6 - Disclosure of Personal Data by Ramp above. |
| 319 | This applies where we can verify your association with the Company and applicable law permits notification. | ||
| 320 | We address requests concerning our own Controller processing directly. | ||
| 386 | Do Not Sell or Share My Personal Data Our business model is to provide corporate card, spend management, and related services to Companies, not selling personal data. | 324 | Do Not Sell or Share My Personal Data Our business model is providing corporate card, spend management, and related spend management services to Companies, not selling personal data. |
| 325 | We do not "sell" or "share" personal data we process on a Company's behalf as a Processor. | ||
| 328 | We do not carry out targeted advertising, sales, or sharing using sensitive personal data or personal data we process on a Company's behalf as a service provider. | ||
| 391 | You can exercise this right by modifying your preferences for our Website on our Your Privacy Choices ↗ page or by enabling the Global Privacy Control ↗ ("GPC") on your browser or extension. | 331 | You can exercise this right by modifying your preferences for our Websites on our Your Privacy Choices ↗ page or by enabling the Global Privacy Control ↗ ("GPC") on your browser or extension. |
| 395 | We collect certain categories of Sensitive Personal Information, including Social Security numbers, driver's license numbers, passport numbers, other government-issued identification numbers, and biometric information collected through our identity verification process. | 335 | We collect certain categories of Sensitive Personal Information, including Social Security numbers, driver's license numbers, passport numbers, other government-issued identification numbers; citizenship information; Ramp account login information or financial-account or payment-card information in combination with credentials that permit access to an account; and biometric information processed to uniquely identify you during identity verification or account recovery. |
| 404 | We may contact you to verify your identity directly, as well as the authorized agent's permission, before we send a response to the request. | 344 | We may contact you to verify your identity directly for requests to know, access, delete, or correct personal data, as well as the authorized agent's permission, before we send a response to the request. |
| 408 | Notice of Financial Incentives At times, we offer certain opportunities or rewards through contests, sweepstakes, and other special offers and promotions (collectively, "Offers") (see Section 4 - How We Use Personal Data). | 348 | Notice of Financial Incentives At times, we offer certain opportunities or rewards through contests, sweepstakes, and other special offers and promotions (collectively, "Offers") (see Section 5 - How We Use Personal Data). |
| 411 | We may disclose your personal data to third parties as described in Section 5 - Disclosure of Personal Data of this Privacy Policy, including data analytics providers, advertising technology vendors, and social media platforms. | 351 | We may disclose your personal data to third parties as described in Section 6 - Disclosure of Personal Data of this Privacy Policy, including data analytics providers, advertising technology vendors, and social media platforms. |
| 414 | If you want to withdraw from an ongoing or upcoming Offer, you can do so by emailing privacy@ramp.com. 16. | 354 | If you want to withdraw from an ongoing or upcoming Offer, you can do so by emailing privacy@ramp.com. 17. |
| 415 | Additional Information for Canadian Residents Permanent link: 16. | 355 | Additional Information for Canadian Residents Permanent link: 17. |
| 416 | Additional Information for Canadian Residents Data Transfers from Quebec Permanent link: Data Transfers from Quebec If you are a resident of the province of Quebec, please note that we transfer and store personal data outside of Quebec province. | 356 | Additional Information for Canadian Residents Ramp designates Privacy Counsel to oversee privacy compliance. |
| 417 | Data Disclosure to Telecommunications Carriers Permanent link: Data Disclosure to Telecommunications Carriers Personal data will be shared with telecommunication providers or mobile network operators for the purposes of identity verification. 17. | 357 | You may request access to personal data under Ramp's control and information about its use and disclosure, and challenge its accuracy or completeness. |
| 418 | Additional Information for UK Residents Permanent link: 17. | 358 | To ask questions or challenge our compliance, contact privacy@ramp.com. |
| 359 | We will respond within the time required by applicable law, explain any lawful denial, and investigate complaints and take appropriate measures where a complaint is justified. | ||
| 360 | You may also contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator. | ||
| 361 | Personal data may be processed outside Canada, including in the United States, as described in Section 8 - International Data Transfers. | ||
| 362 | Data Transfers from Quebec Permanent link: Data Transfers from Quebec If you are a resident of the province of Quebec, please note that we transfer and store personal data outside Quebec province. | ||
| 363 | Ramp is committed to protecting personal data and has implemented measures to protect your personal data, including: Internal policies and procedures that define the roles and responsibilities of our employees, representatives, and service providers throughout the life cycle of personal data and limit their access to that information on a "need-to-know" basis. | ||
| 364 | Physical, electronic and procedural safeguards designed to comply with relevant standards to protect personal data. | ||
| 365 | If the information is collected or stored electronically, technical safeguards such as encryption, firewalls, passwords, anti-virus software and similar measures. | ||
| 366 | Designated personnel to monitor our compliance with applicable privacy laws. | ||
| 367 | Procedures for receiving, investigating, and responding to complaints or inquiries about our information handling practices. | ||
| 368 | Contractual protections designed to ensure that service providers with whom we share personal data maintain adequate protections and security standards. | ||
| 369 | You may request access to personal data under Ramp's control and information about its use and disclosure, and may challenge its accuracy and completeness. | ||
| 370 | Please see Section 7(A) of this Privacy Policy for more details on your privacy rights and how they may be exercised. | ||
| 371 | To ask a question or challenge compliance, contact us as described in Section 15. | ||
| 372 | Data Disclosure to Telecommunications Carriers Permanent link: Data Disclosure to Telecommunications Carriers Personal data will be shared with telecommunication providers or mobile network operators for the purposes of identity verification. 18. | ||
| 373 | Additional Information for UK Residents Permanent link: 18. | ||
Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.