Privacy

This document describes how we collect and use the data concerning the use of our services. We keep it simple and easy to understand, as our company has been built on openness and our services on trust. Here you will also find our contact information in case you would need any further assistance. If you are a Rydoo user, or just browsing our website, this policy will be applicable to you.

At Rydoo, we understand the needs of privacy and safety. We consider our user’s trust as one of our most valuable assets. Therefore, we want to ensure your data is safe with us.

Rydoo N.V. and Rydoo Sp.Zo.o and their local subsidiaries provide business process outsourcing services in the areas of travel and expense management using modern technology solutions.

Our expense management services allow the client to capture, track and store his business expenditure receipts, as well as to generate and submit for approval the expense reports derived from those receipts, which are uploaded via either web, e-mail and/or mobile applications.

This policy applies to all the platforms you can use to get access to our services and all the data we collect using those platforms.

This policy may change when the applicable legislation changes or if we decide to extend our services. Please visit this page regularly to be kept up to date.

If you do not agree with this Privacy Policy, we kindly advise you to not use or stop using our services.

Information provided by you or your employer

Depending on the services you or your employer have selected, we collect some specific information about you:

• For our expense management services we need your identification data (name, professional email, and information about those expenses that may help your employer reimburse them – which may include bank account number, the scanned receipt, credit card statements, etc.).
• We collect data on behalf of your employer (acting as the data processor), but we also collect data in our name, to improve our services, protect our networks from attacks or intrusions, think of new features which may be useful for you, etc. (In such cases, we are acting as the data controller).

Summary:  We need to see if you (or your company/employer) would be interested into getting our products (legal basis: Legitimate Interest).  (We only process some of this data if you agree to it beforehand – Legal basis: Consent).

In addition, we process some data on behalf of your employer so we can provide you with our services and your employer can fulfill its obligations. (Legal Basis: The performance of a contract).

Summary: Personal data is gathered for a specific purpose and stored also for a specific purpose. The overall rule we apply is that we will delete all the data within 6 months after the end of the year when the data is no longer needed for any purpose. You can find out more about the specific categories in the Data retention section.

Summary: We share the data you submit to us with our other business entities so our teams (in France, Belgium, Portugal, Brazil, or Poland) can get in contact with you and sell you our products and support our customers and users.  We also rely on some of our suppliers to provide our services, you can find out more here.

Rydoo also may provide you access to multiple different service providers through its platforms (e.g. hotels, airlines, rail companies, financial institutions). We need to share your data with them to help you manage your expenses or your trip bookings.

We mainly process your personal data within the European Economic Area (EEA). Being the data processor, Rydoo relies on a limited number of sub-processors to perform well-defined elements of its services. Some of these sub-processors may be located outside of the EEA. They have been selected carefully and all have adequate privacy guarantees in place. To read more about these please see our Subprocessors section.

Summary: We use appropriate technical and operational measures (e.g. data encryption, security audits, hashing, etc.) to secure information collected by Rydoo. We are ISO 27001 certified, you can read more about it here.

Rydoo services are meant to be used only by adult users (over 18 years old). Underage persons’ data collected by an employer will be collected only with parents / legal guardians’ permission (as it is the employer’s responsibility to obtain).

1. Rydoo Sp.zo.o., al. Jerozolimskie 180, 02-486 Warsaw, Poland
2. Rydoo NV, Hendrik Consciencestraat, 40/42 2800 Mechelen, Belgium

Data Protection Officer

For Rydoo Expense, we have appointed Diana Jiménez Aguirre as Data Protection Officer.

in case of any request related to data privacy, you might reach our DPO by e-mail: privacy@rydoo.com.

For Rydoo Travel: We have appointed Karolina Salska as Data Protection Officer.

in case of any request related to data privacy in our Travel Solution, you might reach our DPO by e-mail: travel.privacy@rydoo.com.

From time to time, we may change our privacy practices. We will notify you of any changes to this Policy as required by law. We will also post an updated copy on our website. It will have a different date and version number from the one set out below. Please check our site periodically for updates.

Significant changes will be communicated to your company admin or through an email.

Summary: You have a right to review the information we collect about you. It is available in your profile (so you can rectify it if needed) and you can always ask for access, deletion, ask us to rectify it by emailing us or using this form.

You can always contact us if you believe that we are no longer entitled to use your personal data, or if you have any other questions about how your personal information is used. Please email or write to us using the contact details below. We will handle your request in accordance with all applicable EU & national data protection laws.

Contact: privacy@rydoo.com

Rydoo’s Subprocessors

Rydoo uses carefully selected subprocessors (including third parties, as listed below), subcontractors and content delivery networks to assist it in providing the Rydoo Services as described in our Terms and Conditions.

What is a Subprocessor?

A subprocessor is a third party data processor engaged by Rydoo, including Rydoo’s sister companies, who has or potentially will have access to or process Client’s Data (which may contain Personal Data). In the following sections we will explain which subprocessors we use and what types of activities they perform. We also mention some of our sub-contractors who in principle do not get access to Personal Data but rarely and incidentally might do so. As a precaution, we have taken the necessary measures and safeguards to make sure that everyone’s personal data is properly taken care of such as signing Data Processing Agreements and EU Standard Contractual Clauses with them.

How do we choose a Subprocessor?

We have a careful selection process where we take into consideration the security, privacy and confidentiality practices of proposed subprocessors that will or may have access to or otherwise process Personal Data. We will not select any subprocessor that cannot guarantee to provide the very same level of Data Protection as Rydoo.

Contractual Safeguards

All of our sub-processors need to comply with equivalent obligations as those required from Rydoo (as a Data Processor) as set forth in Rydoo’s Data Processing Agreement (“DPA”), including but not limited to the requirements to:

• Only collect, process and use the types of personal data relating to the categories of data subjects for the purposes of providing the Rydoo Services under the Contract and for the specific purposes required in each case.
• In connection with their subprocessing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy, confidentiality and security, to the extent applicable, as established in Data Protection Laws.
• Provide regular training in security and data protection to personnel to whom they grant access to Personal Data.
• Implement and maintain appropriate technical and organizational measures (including measures consistent with those to which Rydoo is contractually committed to adhere to) and provide evidence of compliance with this obligation.
• Promptly inform Rydoo about any actual or potential security breach.
• Cooperate with Rydoo in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable.

What will happen if we engage a new SubProcessor:

Our Clients will be notified of any changes on this page. If the Client has a reasonable objection to any new or replacement Subprocessor, it shall notify Rydoo of such objections in writing within ten (10) days of the notification and the parties will seek to resolve the matter in good faith.

If Rydoo is reasonably able to provide the Rydoo Services to the Client in accordance with the Main Agreement without using the sub-processor and decides in its discretion to do so, then the Client will have no further rights under this provision in respect of the proposed use of the sub-processor. If Rydoo requires use of the Subprocessor in its discretion, it shall seek to satisfy the Client as to the suitability of the Subprocessor or the documentation and protections in place between Rydoo and the Subprocessor in a period not exceeding ninety (90) days from the Cient’s notification of objections.

If the Client does not provide a timely objection to any new or replacement Subprocessor in accordance with this procedure, the Client will be deemed to have consented to the sub-processor and waived its right to object. Rydoo may use a new or replacement Subprocessor whilst the objection procedure in this section is in process.

Termination rights, as applicable and agreed, are set forth exclusively the Contract.

The following is an up-to-date list (as of the date of this policy) of the names and locations of Rydoo’s Subprocessors, subcontractors and content delivery networks: