PRIVACY NOTICE FOR EU\EEA & UK-BASED CUSTOMERS ONLY

This document, herein referred to as the “Privacy Notice”, outlines the privacy practices of Partnerway OÜ, trading as Spendbase (“We”, “us”, “our”, “Spendbase”) and governs the processing of personal data in connection with the provision of our digital banking, payment, and financial technology services (“Services”) to the EU\EEA & UK-based customers (“Customers”) defined below. 

Your continued use of the Services constitutes your acknowledgment of, and agreement to, the privacy practices described in this Privacy Notice. In the event of any concern relating to this Privacy Notice or how we handle your Personal Data, feel free to contact us at:

Data Protection Officer Attn: Privacy and Compliance Email: privacy@test-partneway.prod.spendbase.co

Spendbase provides business-to-business financial technology services, including corporate card programs and related platform services. All Spendbase accounts are opened and maintained exclusively for business purposes.

Therefore, this Privacy Notice applies to Customers, namely: 

• Business Customers that enter into a contractual relationship with Spendbase, who are treated as commercial entities (“Business Customer”), and
• Individuals who access or use Spendbase services on behalf of a Business Customer, including employees, officers, and cardholders, who act solely in a business or employment capacity (“Authorized User”)

For the purposes of GDPR and UK GDPR, Spendbase acts as data controller in respect of the processing activities described in this Privacy Notice. Our details are set out below.

In accordance with applicable law, Spendbase may act as:

• Independent Data Controller for Personal Data processed for its own legal, compliance, fraud prevention, security, and AML/KYC obligations.
• Data Processor with respect to Authorized User Personal Data processed on behalf of Business Customers for account administration, expense management, and related platform purposes, under applicable data processing agreements.

For information on how this dual-capacity arrangement affects the processing of Authorized User Personal Data, please refer to Section 12 (Authorized Users) below.

A Data Processing Agreement (“DPA“) governing Spendbase’s processing of Personal Data on behalf of Business Customers is available upon request. The DPA sets out the obligations of each party in connection with the processing of Authorized User data and takes precedence over this Privacy Notice to the extent of any inconsistency.

Regulated Service Providers. For UK Customers, cards and accounts are issued by Moorwand Ltd, a company incorporated in England and Wales (company number 08491211), registered office at Fora, 3 Lloyds Avenue, London, EC3N 3DS, authorised by the Financial Conduct Authority under the Electronic Money Regulations 2011 (FRN 900709). For EEA Customers, cards and accounts are issued by Heuro SAS, in partnership with Moorwand Ltd. Heuro SAS is authorised by the Autorité de Contrôle Prudentiel et de Résolution (ACPR) under licence number 17478. These institutions, together with Mastercard International and other payment network partners that participate in the delivery of the Services, process Personal Data as independent controllers for their own regulated purposes — including AML/CTF compliance, sanctions screening, Suspicious Activity Report (SAR) filing, fraud risk management, tokenisation services and account number provisioning, and obligations arising under their own authorisations and applicable financial services regulation. Data flows to these parties constitute disclosures between independent controllers, not processing instructions from Spendbase. Each such institution is independently accountable to its own regulators (including the FCA, ACPR, and applicable national competent authorities) for the Personal Data it receives. Business Customers and Authorised Users may be subject to those institutions’ own privacy notices in addition to this Notice.

Where applicable, Spendbase processes Personal Data in compliance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR);
• UK GDPR and the Data Protection Act 2018 (for UK Customers);
• Directive (EU) 2015/2366 (PSD2) and applicable national implementing measures;
• Regulation (EU) 2022/2554 (DORA) and its regulatory technical standards;
• Applicable AML/KYC legislation, including Directive (EU) 2018/843 (5AMLD) and national implementing measures;
• Contractual obligations with our Regulated Service Providers, card scheme rules, and applicable financial services regulation.

Spendbase collects and processes Personal Data only to the extent necessary to provide the Services, comply with applicable legal and regulatory obligations, prevent fraud and misuse, and operate and secure Spendbase and its Services. Depending on the customer type, we collect Personal Data as follows:

All Authorized User Personal Data is processed solely in connection with the individual’s professional or employment relationship with the relevant Business Customer. Spendbase does not intentionally collect Personal Data for personal, family, or household purposes, does not direct its Services to children, and does not knowingly collect Personal Data from individuals under the age of 18.

Where permitted by law, Spendbase may create and use aggregated or de-identified data derived from Personal Data for analytics, reporting, benchmarking, and service improvement. Such data does not identify any individual and is not treated as Personal Data under applicable law.

Spendbase collects Personal Data from the following lawful and transparent sources:

Under GDPR and UK GDPR, Spendbase is required to identify a lawful basis for each processing activity. Spendbase processes Personal Data on the following legal bases pursuant to Article 6 GDPR (and, for special category data, Article 9 GDPR where applicable) and for the purposes consistent with the nature of our Services. Personal Data is not used for purposes incompatible with the original reason it was collected.

Legitimate interests assessment. Where Spendbase relies on Art. 6(1)(f) (legitimate interests), it has assessed that the processing is necessary for the legitimate interest pursued, and that this interest is not overridden by the interests or fundamental rights and freedoms of the data subjects concerned. Data subjects may request further information on these assessments or object to such processing — see Section 14 (Data Subject Rights) below.

Spendbase does not sell Personal Data and does not disclose Personal Data except as necessary to operate the Services, comply with legal and regulatory obligations, protect the security and integrity of the platform, or as otherwise permitted by law. All service providers are contractually required to maintain privacy and security practices consistent with this Notice and applicable law.

Personal Data is retained only for as long as necessary to fulfill the purposes for which it was collected, in accordance with applicable legal and regulatory requirements, contractual obligations, and our internal data governance policies.

Where retention is no longer required, Personal Data is securely deleted, anonymized, or de-identified in accordance with applicable policies and technical controls.

Spendbase implements and maintains administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction, consistent with the Article 32 GDPR and applicable law, including DORA requirements on ICT risk management.

• Administrative safeguards: Policies and procedures governing data access, confidentiality, employee training, incident response, vendor management, and compliance oversight. Access to Personal Data is limited to personnel and service providers who require it for legitimate business purposes and who are subject to confidentiality obligations.
• Technical safeguards: Access controls, multi-factor authentication, encryption in transit and at rest, logging and monitoring, network security controls, and vulnerability management.
• Incident response: Spendbase maintains procedures to detect, respond to, and recover from security incidents. Where required by GDPR Art. 33, Spendbase will notify the competent supervisory authority within 72 hours of becoming aware of a notifiable personal data breach. Where required by Art. 34, affected data subjects will be notified without undue delay. Where the breach affects card programme operations, Spendbase will also notify Moorwand Ltd and Heuro SAS in accordance with its contractual obligations and applicable card scheme incident reporting requirements. 

While Spendbase takes reasonable and appropriate measures to protect Personal Data, no system or method of transmission can be guaranteed to be completely secure. Business Customers and Authorized Users are responsible for maintaining the confidentiality of their access credentials and for using the Services in a secure manner.

Spendbase is a global technology company. Personal Data collected in connection with the Services may be processed in countries outside the EU/EEA or United Kingdom, including in the United States. Key infrastructure providers include:

• Amazon Web Services (AWS) — mainly EU/EEA regions (including Ireland and Frankfurt), rarely US;
• Google Cloud Platform (GCP) — EU/EEA regions and the US;
• Other sub-processors as disclosed in the DPA.

Where Personal Data is transferred to a third country, Spendbase relies on the following transfer mechanisms, as applicable:

• European Commission adequacy decisions;
• Standard Contractual Clauses (SCCs)  and\or UK International Data Transfer Agreements (IDTAs)
• Other appropriate safeguards pursuant to Art. 46 GDPR or Art. 46 UK GDPR, as applicable.

Business Customers may request further information on transfer destinations, applicable safeguards, and copies of relevant transfer mechanisms by contacting privacy@test-partneway.prod.spendbase.co 

Personal Data processed by Moorwand Ltd and Heuro SAS in their capacity as independent controllers may be subject to separate international transfer arrangements under their own regulatory frameworks, including transfers to Mastercard International’s processing infrastructure. Customers should refer to those institutions’ own privacy notices for further information.

Spendbase processes Personal Data relating to Authorized Users solely in connection with the Services provided to the relevant Business Customer and in accordance with Business Customer instructions, applicable contractual terms, and applicable law.

Business Customer responsibilities. Business Customers are responsible for: (i) determining which individuals are authorized to access the Services and managing their access rights and credentials; (ii) ensuring that Authorized User information provided to Spendbase is accurate, current, and lawfully obtained; (iii) informing Authorized Users about how their Personal Data is collected, used, and shared in connection with the Services, including through internal policies and notices where required by applicable employment, privacy, and data protection laws; and (iv) ensuring their use of Authorized User data complies with applicable law.

Spendbase’s role. With respect to Authorized User data processed on behalf of Business Customers for platform administration purposes, Spendbase acts as a Data Processor and does not control or determine the purpose or means of such processing. With respect to data processed for Spendbase’s own legal, compliance, fraud prevention, and security obligations, Spendbase acts as an Independent Controller.

Authorized User requests. Authorized Users should direct requests relating to access, correction, or deletion of their Personal Data primarily to the Business Customer that authorized their access to the Services. Where required by law or contract, Spendbase will assist Business Customers in responding to such requests. In the event an Authorized User submits a privacy request directly to Spendbase, Spendbase will endeavor to transfer the request to the relevant Business Customer without undue delay and provide such information as is permitted by law.

Spendbase uses cookies and similar technologies in connection with its websites and platform to operate, secure, and improve the Services. These technologies help ensure platform functionality, protect against fraud and unauthorized access, support analytics and performance monitoring, and maintain service reliability.

Cookies and similar technologies may collect information such as device identifiers, IP address, browser type, operating system, language preferences, access timestamps, and interaction data. This information is used for technical, security, and operational purposes.

Spendbase uses the following categories of technologies:

• Strictly necessary: Required for the operation, security, and authentication of the platform. Cannot be disabled without impairing functionality.
• Functional and performance: Help remember user preferences, analyze platform performance, and diagnose technical issues.
• Analytics: Help understand how the Services are used and improve functionality. Analytics tools are configured to support business operations and are not used for cross-context behavioral advertising.

Spendbase does not engage in consumer-style behavioral advertising and does not use cookies for cross-context behavioral advertising. Non-essential (other than strictly necessary) cookies are placed only with the prior consent of the user, which may be withdrawn at any time via the cookie management tool available on the Spendbase website. Where required by applicable law, Spendbase provides appropriate notices and choices regarding the use of cookies and similar technologies through platform settings or browser controls.

Under GDPR and UK GDPR, individuals whose Personal Data is processed by Spendbase as data controller have the following rights. Because Spendbase operates in a business-to-business context and processes most data in an employment or commercial capacity, some rights may be subject to limitations or exemptions under applicable law.

How to exercise your rights. To exercise any right listed above, Customer shall submit a written request to privacy@test-partneway.prod.spendbase.co  with the subject line “Data Subject Request” and include: (i) data subject full name and email address associated with the account; (ii) the name of the Business Customer data subject is affiliated with; (iii) a description of the right data subject wishes to exercise; and (iv) any additional information reasonably necessary to verify the identity.

Spendbase will verify identity before processing any request and will respond within one calendar month of receipt. Where requests are complex or numerous, this period may be extended by up to two further months, in which case Spendbase will inform the data subject within the initial one-month period. Spendbase will not retaliate against any individual for exercising a privacy right or filing a complaint. Authorised Users should generally direct requests to the Business Customer that authorised their access to the Services.

Right to lodge a complaint. Customers shall have the right to lodge a complaint with a supervisory authority. The competent lead supervisory authority for Spendbase is the 

• Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — www.aki.ee  — for EU GDPR matters;
• Information Commissioner’s Office (ICO) — www.ico.org.uk  — for UK GDPR matters.
• Customers  also have the right to lodge a complaint with the data protection authority in their own EU Member State or UK.

Where Personal Data is processed by Moorwand Ltd or Heuro SAS in their capacity as independent controllers — including card transaction records and e-money account data — data subjects should direct requests relating to such data directly to the relevant institution using the contact details in their respective privacy notices available at the following links: Moorwand Privacy Policy and  Heuro SAS Privacy Policy.

Spendbase may update this Privacy Notice from time to time to reflect changes in our practices, services, legal or regulatory requirements, or operational needs. When we make material changes, we will provide notice through the Spendbase platform by updating the Effective Date shown on this document.

In the event of significant changes that may materially affect how Personal Data is processed, Spendbase will use available means of communication to notify affected Business Customers and Authorized Users before the changes take effect, in accordance with applicable law.

Continued use of the Services after an updated Privacy Notice becomes effective constitutes acknowledgment of the revised Notice, to the extent permitted by law.

For purposes of this Privacy Notice, the following terms have the meanings set forth below: