In short: the organization is in charge of the personal data it puts into Expense Management. NVDRA Technologies processes that data only to provide the Service on the organization’s instructions, keeps it confidential and secure, uses vetted service providers, helps with requests and incidents, and returns or deletes the data when the organization leaves.
Scope and roles
These Data Processing Terms form part of the Terms of Service between NVDRA Technologies (“we”) and each organization that uses Expense Management. They apply to personal data that the organization or its Users put into Expense Management (“Organization Data”).
- The organization decides why and how Organization Data is processed (it is the “controller”).
- NVDRA Technologies processes Organization Data on the organization’s behalf (it is the “processor”).
- Data we use for our own purposes (NVDRA accounts, billing, security logs), is covered by our Privacy Policy, not by these terms.
Details of the processing
| Subject matter | Providing Expense Management and the connected NVDRA applications chosen by the organization. |
|---|---|
| Duration | While the organization’s account is open, plus the return and deletion period below. |
| People concerned | The organization’s staff, and people named in expenses and receipts (such as vendors). |
| Types of data | Names and roles of staff, expense details, payment details and receipt files. |
| Operations | Collecting, recording, storing, organising, displaying, transmitting (including by email and push notification), backing up, exporting and deleting. |
Processing only on the organization’s instructions
We process Organization Data only to provide, secure and support the Service, as set out in the Terms, these Data Processing Terms and the settings the organization chooses, or as required by law. If the law requires us to process it in another way, we will tell the organization first unless the law forbids it. If we think an instruction breaks the law, we will say so.
We do not sell Organization Data, use it for advertising, or combine it with other data to build profiles of people.
The organization’s duties
- Have a lawful basis, and consent where needed, for the data it enters.
- Tell its people clearly how it uses Expense Management (it may link to our Privacy Policy).
- Enter only the data it needs, keep it accurate, and set roles so that each person sees only what they need.
- Keep its own sign-in details and devices secure, and remove access promptly when someone leaves.
Confidentiality and our staff
Only NVDRA staff who need access to provide support, maintain the Service or keep it secure may access Organization Data. They are bound by confidentiality and their access is recorded. Signing in as a User from the NVDRA Admin Panel is limited to senior administrators, needs a recorded reason, shows a visible banner, ends by itself and is kept in the audit log.
Security measures
- Encrypted connections (HTTPS) for all access, and one-way hashing of passwords.
- Role-based access within each organization, and separation of each organization’s data from others’.
- Private files stored outside the public web folder; signed and verified connections between NVDRA applications.
- Regular backups, security updates and monitoring, and audit logs of sensitive actions.
Service providers (sub-processors)
The organization authorises us to use service providers to help provide the Service, currently in these categories: hosting and backup; email delivery; and browser and phone push notification services. We give each provider only the data it needs, require it to protect the data, and remain responsible for its work. We will update the list in the Privacy Policy before adding a new category of provider, and a organization that objects on reasonable grounds may close its account and receive a refund of the unused part of its paid year.
Helping with requests
If someone contacts us directly about Organization Data, we will refer them to the organization and, where appropriate, tell it. The organization can answer most requests itself in Expense Management. Where it cannot, we will help within a reasonable time.
Security incidents
If we become aware of a breach of security leading to accidental or unlawful loss, alteration, disclosure of or access to Organization Data, we will notify the organization without undue delay, and in any case within 72 hours of confirming it, with what we know about what happened, the data affected and what we are doing about it. We will help the organization inform the people affected and any authority where required.
Return and deletion of data
- While its account is open, the organization can export its records and delete records and files.
- When the organization closes its account, the data stays available for export for 30 days. We then delete it from the live system within a further 60 days. Backups are overwritten within 90 days.
- We may keep data longer only where the law requires us to, and only for that purpose. On request we will confirm deletion in writing.
Requests from authorities
If a court or authority asks us for Organization Data, we will check that the request is lawful, disclose only what is required, and tell the organization before disclosing, unless the law forbids it.
Information and audits
We will give the organization the information reasonably needed to show that we meet these terms, for example by answering a security questionnaire once a year. Any on-site audit must be agreed in advance, be reasonable in scope, and respect the confidentiality of other organisations’ data.
Contact
NVDRA Technologies
Email: support@nvdra.com