Details of Processing
1. Subject Matter and Duration of Processing
(i) The subject matter of the processing is the provision of the Services under the Agreement.
(ii) The duration of the processing corresponds to the term of the Agreement, until deletion of Controller Personal Data in accordance with Section 9 of this DPA.
2. Nature and Purpose of Processing
2.1 Processor will process Controller Personal Data solely to provide the Services and related technical support, including:
(i) user account management (creation, authentication, activity logging);
(ii) provision of access to Spendbase Platform functionalities (subscription tracking, spend/expense visibility, card management, reporting);
(iii) secure storage and backup of data within the platform;
(iv) monitoring, troubleshooting, and security incident
(v) responding to Controller’s support requests.
2.2 responding to Controller’s support requests.
3. Categories of Data Subjects
Employees, contractors, or other authorized users of Controller accessing the Services.
4. Categories of Personal Data
(i) Identification and contact data (e.g., name, business email address, role/title);
(ii) Account and authentication data (e.g., login credentials, usage logs, IP address);
(iii) Usage data (e.g., user activities, settings, preferences);
(iv) Vendor’s data (account identifiers and related metadata strictly necessary to perform billing management and promotional credit allocation under the Services, where applicable, and to the extent linked to identifiable administrative users or billing contacts);
(v) Communication data (e.g., support queries, feedback provided to Spendbase).
5. Special Categories of Data
None. The Parties agree that Processor shall not process any special categories of personal data as defined under GDPR Article 9.
6. Frequency of Transfers
Continuous, as required to provide the Services during the Agreement term.
7. Retention
Controller Personal Data is retained only for the term of the Agreement and shall be deleted in accordance with Section 9 of this DPA.
8. Competent Supervisory Authority
The supervisory authority of the EU Member State in which Controller is established.