Concur Processor Privacy Statement
Last Updated: March 1st, 2018
Your Company may have subscribed to the Concur Services either directly with Concur or indirectly via an authorized reseller of the Concur Services. This privacy statement does not change any terms of a business agreement with your Company or between your Company and a reseller, as applicable, but is simply intended to provide additional information to you regarding the Concur Services. Your Company is regarded as a data controller within the meaning of applicable data protection laws, and Concur's processing of such data for the Concur Services is under the direction of your Company, directly or indirectly as applicable. You should direct any questions about how data about you is used as part of the Concur Services to your Company.
PERSONAL DATA COLLECTED
"Personal Data" means any information relating to you that is entered by or on behalf of your Company or its authorized users of the Concur Services into or derived from their use of the Concur Services. It also includes personal data supplied to or accessed by or on behalf of Concur to provide support for Concur Services. Not all of your Company's data within the Concur Services is Personal Data. As a general matter, Personal Data in the Concur Services includes the following categories of data:
- Personal profile data, such as name, contact information, travel preferences, financial information and account numbers for related connected services
- Organizational information, such as employee identification, payroll, cost center, associated approvers information
- Expense and travel related data, such as expense information, including images of receipts, and travel itineraries
- Mobile data, such as mobile device information and, when enabled, location data
- Data for associated connected services to support travel needs, such as account, loyalty program or rewards numbers for taxi or rental cars, airlines or hotels
The categories of information about you collected or derived within the Concur Services depends, in part, on the Concur Services to which your Company has subscribed and how the Concur Services are configured for your Company.
You provide Personal Data directly when you enter it in Concur Services. In some cases, another user, such as an account administrator, may create an account on your behalf or may provide Personal Data as part of your use of the Concur Services at the direction or with permission of your Company.
Concur Services may obtain Personal Data from other sources, as well, such as back office financial or human resources systems, or from travel agents and travel management companies that work with your Company. Concur Services also connect to third party partners and suppliers like airlines, hotel chains, restaurant chains or ride-sharing services. Each of these connected services may enable Personal Data about you to be transferred into the Concur Services. Generally, these connections are controlled by your Company. But, as described below, you can enable the connection of the Concur Services with certain other Concur or third party services you select that result in the collection of additional sources of Personal Data.
When you use the Concur Services, some information like IP address, device or browser information, logs or clickstream information, for example, is automatically collected about your usage and activity on the Concur Service to address technical support issues and understand how you use the Concur Services. Concur may use certain tracking technologies such as cookies, web beacons, or third party analytics tools to obtain such information.
HOW PERSONAL DATA IS USED
Concur will use Personal Data within the scope of the Concur Services for the following:
- Providing, operating, hosting, maintaining, connecting, and improving the Concur Services, and enabling you to access, use and connect the Concur Services
- Processing and completing transactions within the Concur Services, such as creating and submitting expense reports, or booking corporate travel
- Providing customer service and support, providing you with transactional communications, such as submission or booking confirmations, providing technical notices, updates, security alerts and support and administrative messages
- Providing you with information and support for related Concur Services available to you under your Company's agreement
- Understanding how the Concur Services are being configured and used, how the Concur Services and the user experience can be improved for the benefit of all users, and to develop new products and services
- Investigating and preventing fraudulent transactions, unauthorized access or other security incidents, and other illegal activities
If your Company has subscribed for certain Concur Services that enable your Company to identify and confirm the location of some or all of their users and communicate with them during events such as natural disasters, attacks, or other risk events, then these Concur Services use location information from your profile and travel itineraries in the Concur Services or from the check-in location you provide directly through your mobile device, and they may also attempt to determine location from e-receipts or other partner or vendor services that you have connected to the Concur Services.
CHOICES YOU HAVE REGARDING PERSONAL DATA
Certain parts of the Concur Services permit you to make choices about what information is collected about you, how it is used, and with what third parties it is shared. As you use the Concur Services you will encounter choices, such as whether to enable e-receipts, enroll in My Travel Network , or connect with partner services you already use in the App Center. These features of the Concur Services can be enabled through settings in your Concur Services profile or through the Concur App Center. You can find out more about the Personal Data used and shared through these tools when you are presented the option to connect.
Concur mobile applications also enable you to make choices about Personal Data related to your location. If subscribed to by your Company, Concur's mobile applications features like Drive or ExpenseIt, for example, may base your location on the use of location services through your mobile device, which you may enable or disable through the mobile application itself along with the privacy settings in your mobile device.
You can also choose to connect the Concur Services with other Concur products you have subscribed for individually. Concur applications such as TripIt or Hipmunk are available to you as an individual, and if you have subscribed and set up your own personal account with one or more of these applications, you may be able to connect these personal services with your Concur Services user account.
HOW PERSONAL DATA IS SHARED
Concur may share Personal Data with its global corporate affiliates and their agents and integrated service providers that cooperate to provide the Concur Services throughout the world to the extent necessary to provide the Concur Services.
Personal Data about you in the Concur Services is available to your Company and those other users, persons or third parties to which your Company chooses to provide access. Your Company may direct Concur to make information including Personal Data available to third parties through Concur APIs. As permitted under our agreement for the Concur Services, Concur may also share Personal Data with business partners, service vendors, authorized third-party agents or contractors in order to provide the Concur Services, including processing transactions, website hosting, customer or technical support, or analytics.
As described above, you may choose to link the Concur Services to certain third party sites or services and authorize access, such as through the Concur App Center, enrolling in My Travel Network, or connecting to personal applications like TripIt or Hipmunk. When connected with TripIt, travel itineraries will be automatically synced between your accounts. This can include personal trips contained in TripIt unless you exclude such trips. When connected with Hipmunk, Concur and your Company will share basic information about trips you book and profile and payment information to enable you to receive corporate travel discounts and benefits, if applicable.
Concur may share Personal Data to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of agreements, respond to legal orders or process, or as otherwise required by law, as permitted under our agreement for Concur Services.
HOW PERSONAL DATA MAY BE TRANSFERRED TO THE UNITED STATES
Concur operates Concur Services from data centers in multiple locations globally, including in the United States. Using the Concur Services may result in the transfer, use, processing, or storage of Personal Data in the United States or any other country where Concur operates or maintains facilities or service centers, including jurisdictions that may not have data privacy laws that provide protections equivalent to those provided in your home country. Concur takes steps designed to ensure that the Personal Data is processed according to the provisions of our agreements, including any data processing agreements, as well as intercompany data processing agreements among corporate affiliates, and applicable law wherever the data is located.
RIGHTS FOR CERTAIN USERS
Concur adheres to applicable data protection laws in the European Economic Area, which, if applicable to you, include the following rights:
- Where processing of Personal Data is based on your consent, you have a right to withdraw consent at any time for future processing
- You have a right to request access to, rectification, or erasure of your Personal Data, or to transfer or receive a copy of your Personal Data in a usable format
- You have a right to object to the processing of your Personal Data under certain circumstances
- You have a right to lodge a complaint with an applicable data protection authority
You must contact your Company if you have questions or seek to exercise any of these rights.
SECURITY AND RETENTION OF PERSONAL DATA
Concur uses appropriate standard security technology and organizational measures to protect Personal Data from unauthorized disclosure and will retain Personal Data in active databases for varying lengths of time depending upon the specific Concur Services, type of data, and applicable law and instructions of the data controller.
UPDATES AND QUESTIONS
If Concur changes this privacy statement, Concur will post those changes and change the "last updated" date above. Concur may do this at any time without notice. If you have questions or concerns regarding this privacy statement, you must first contact your Company. If you do not receive acknowledgment of your inquiry, you may direct your inquiry to Concur's privacy coordinator at firstname.lastname@example.org or to your local data protection authority.