Tipalti

Supplemental Privacy Notice for California Consumers

This Supplemental Privacy Notice for California Consumers (“California Notice”) applies to California Consumers and their Personal Information, each as defined by the California Consumer Privacy Act of 2018, Cal. Civil Code § 1798.100 et seq., (“CCPA”). This is a supplement to the Tipalti Privacy and provides additional rights to California consumers, as applicable. If there is a conflict between this California Notice and the Privacy Policy, then this California Notice shall govern as applicable for California Consumers. Any capitalized terms used but not defined herein shall have the same meaning as in the CCPA.

  1. Tipalti Does Not and Will Not Sell Personal Information.
  2. Verifiable Consumer Request
  3. Authorized Agent
  4. Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights
  5. Collection of Personal Information
    1. Category of Personal Information
    2. Categories of Sources from which Personal Information was collected
    3. Business or Commercial Purpose for which the Personal Information was collected
    4. Categories of Third Parties with whom Tipalti shares Personal Information
  6. Contact Us and/or Opt-Out
  7. Date of Last Update

1 . Tipalti Does Not and Will Not Sell Personal Information.

Right to Know/Access, and Right to Deletion of Personal Information

Pursuant to the CCPA, as a California Consumer, you may have the following rights with respect to your Personal Information:

  • Right to Know/Access – This right allows you to request that Tipalti provide you with the Personal Information that Tipalti has collected or disclosed to third-party service providers within the 12 month period prior to your request.
  • Right to Deletion of Personal Information – This right allows you to request that Tipalti delete your Personal Information.

2 . Verifiable Consumer Request

In order to exercise your rights in Section 1 above, you must submit a Verifiable Consumer Request to Tipalti. To do so, you must:

Send an email to Privacy@Tipalti.com and include all of the following information:

  • Your relationship with Tipalti (payer, payee, or advertising recipient);
  • The email address through which Tipalti communicates with you;
  • The name you have registered with Tipalti or to whom Tipalti addresses you;
  • A contact phone number so Tipalti may call you in order to verify your identity; and
  • Which rights you are exercising:
    1. Your Right to Access your Data, and/or
    2. Your Right to Delete your Data.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a Verifiable Consumer Request does not require you to create an account with us. We will only use Personal Information provided in a Verifiable Consumer Request to verify the requestor’s identity or authority to make the request.

Responding to Your CCPA Rights Request(s)

Upon submitting your Verifiable Consumer Request, we will (a) respond within forty-five (45) days; or (b) if additional time is required to meet your request, we will notify you by mail or electronically of the reason and extension period, provided, however, such extension shall not exceed forty-five (45) days.

Please note that any disclosures we provide will only cover the 12-month period preceding the Verifiable Consumer Request.

We do not charge a fee to process or respond to your Verifiable Consumer Request provided that it is not excessive, repetitive, or manifestly unfounded.

How We Will Provide the Response

For each Verifiable Consumer Request that is subject to CCPA, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without issue.

3 . Authorized Agent

Designating an Authorized Agent

Only you or a person or entity that is either (i) registered as an agent with the California Secretary of State that you authorize to act on your behalf; or (ii) that you have provided power of attorney to pursuant to Probate Code Sections 4000 to 4465 (“Authorized Agent”) may submit a Verifiable Consumer Request related to your Personal Information. If you choose to use an Authorized Agent, Tipalti may require that you provide the Authorized Agent with written permission to do so, and verify the identity of the Authorized Agent directly with you.

You will not receive discriminatory treatment for exercising any of your CCPA rights. As such, unless permitted by the CCPA, we will not:

  • Deny you goods or services.
  • Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
  • Provide you a different level or quality of goods or services.
  • Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

5 . Collection of Personal Information

a . Categories of Personal Information.

Categories of Personal Information that Tipalti may have collected about Consumers in the preceding 12 month period.

Category of Personal Information Included in Category Does Tipalti Collect?
A Identifiers. A real name, alias, postal address, unique personal identifier, online identifier, internet protocol (IP) address, email address, account name, social security number (SSN), driver’s license number, passport number, or other similar identifiers. Yes
B Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). The Identifiers above, plus a person’s signature, physical characteristics or description, state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. This definition includes any future modifications of the applicable laws. Yes
C Protected classification characteristics under California or federal law. This includes, but is not limited to: age (over 40) race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). This definition includes any modifications of the applicable laws. Yes
D Commercial information. Including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Yes
E Biometric information. Including genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data. No
F Internet or other similar network activity. Including but not limited to browsing history, search history, information regarding a Consumer’s interaction with a website, application, or advertisement. Yes
G Geolocation data. Including physical location or movements. No
H Sensory data. Including audio, electronic, visual, thermal, olfactory, or similar information. No
I Professional or employment-related information. Current or past job history, or performance evaluations. Yes
J Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. This definition includes any of the applicable laws. No
K Inferences drawn from other Personal Information. Used to create a profile about a Consumer reflecting the Consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes. Yes

b . Categories of Sources from which Personal Information was collected.

Categories of sources means types of entities from which Tipalti collects personal information about Consumers.

Category of Personal Information Categories of Sources from which Personal Information was collected
A Identifiers.
  • Directly from the Consumer, customer, website visitors, job applicant
  • Government entities
  • Publicly available sources (such as your LinkedIn profile)
  • Business and channel partners
  • Recruiters
  • Service Providers and third party services
  • Cookies and other tracking technologies
B Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). Same as Identifiers above
C Protected classification characteristics under California or federal law. Same as Identifiers above
D Commercial information. Same as Identifiers above
E Biometric information. If applicable, directly from a Payee submitting the information within an invoice to the Payor.
F Internet or other similar network activity. From our website cookies and other tracking mechanisms
G Geolocation data. If applicable, directly from a Payee submitting the information within an invoice to the Payor.
H Sensory data. If applicable, directly from a Payee submitting the information within an invoice to the Payor.
I Professional or employment-related information.
  • Directly from the Consumer, customer, website visitors, job applicant
  • Government entities
  • Publicly available sources (such as your LinkedIn profile)
  • Business and channel partners
  • Recruiters
  • Service Providers and third party services
J Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). If applicable, directly from a Payee submitting the information within an invoice to the Payor.
K Inferences drawn from other Personal Information.
  • Directly from the Consumer, customer, website visitors, job applicant
  • Government entities
  • Publicly available sources (such as your LinkedIn profile)
  • Business and channel partners
  • Recruiters
  • Service Providers and third party services
  • Cookies and other tracking technologies

c. Business or Commercial Purpose for which the Personal Information was collected.

Categories of sources means types of entities from which Tipalti collects personal information about Consumers.

Category of Personal Information Business or Commercial Purpose for which the Personal Information was collected
A Identifiers.
  • To facilitate, operate, and provide our Services
  • To verify the identity of our Users
  • To determine your eligibility to use our Services
  • To further develop, customize and improve our Services, and to provide you with any such enhanced Services
  • To provide customer assistance and technical support
  • To contact our Users, Consumers, customers, and website visitors with general and personalized service-related notices, surveys and promotional messages including marketing and advertising messages
  • To create aggregated statistical data and other aggregated and/or inferred Non-personal Information, which we, our Users or our business partners may use to operate and improve our respective services
  • To manage and assess risk, enhance our data security and fraud prevention capabilities, and help protect against error, fraud or any illegal or prohibited activity
  • To act as permitted by, and to comply with any legal or regulatory requirements
  • To conduct any additional activities that may require the use of your Personal Information, for which we will request your consent in advance
  • And any other usage delineated in Tipalti’s Privacy Policy
B Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). Same as Identifiers above
C Protected classification characteristics under California or federal law. Same as Identifiers above
D Commercial information. Same as Identifiers above
E Biometric information. N/A
F Internet or other similar network activity. Same as Identifiers above
G Geolocation data. N/A
H Sensory data. N/A
I Professional or employment-related information. Same as Identifiers above
J Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). N/A
K Inferences drawn from other Personal Information. Same as Identifiers above

d. Categories of Third Parties with whom Tipalti shares Personal Information.

Category of Personal Information Categories of Third Parties with whom Tipalti shares Personal Information
A Identifiers.
  • Tipalti’s subsidiaries and affiliated companies
  • Hosting and server co-location service providers
  • Internet service providers and operating systems and platforms
  • Data and cyber security service providers
  • Banks, financial institutions, payment processors, payment accelerators, financial services providers, capital providers, correspondents, and to other financial service providers
  • Credit Bureaus and collection agencies
  • Fraud detection and prevention service providers
  • Data and web analytics, e-mail distribution and monitoring services, session recording, remote access service providers
  • Our business, legal, tax, financial advisors, and other advisors with whom we have a confidential relationship
  • Government/Law Enforcement agencies and legal requests or duties
  • Service providers that help us verify your identity and comply with our legal and regulatory obligations to screen and monitor transactions
  • Recruiters and companies that provide background checking services
  • Third parties to which you have consented to sharing your Personal Information
  • Any other categories delineated in Tipalti’s Privacy Policy
B Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). Same as Identifiers above
C Protected classification characteristics under California or federal law. Same as Identifiers above
D Commercial information. Same as Identifiers above
E Biometric information. N/A
F Internet or other similar network activity. Same as Identifiers above
G Geolocation data. N/A
H Sensory data. N/A
I Professional or employment-related information. Same as Identifiers above
J Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). N/A
K Inferences drawn from other Personal Information. Same as Identifiers above

6. Contact Us and/or Opt-Out

How to contact Tipalti for questions or exercise your rights under this Privacy Policy:

  • Send a letter to Privacy at Tipalti, 1810 GATEWAY DR., SUITE 300, SAN MATEO, CA 94404, or
  • Send an email to privacy@tipalti.com

How to opt-out of receiving Promotional Messages from Tipalti:

7. Date of Last Update – January 1, 2020.

We may amend this California Notice at any time by posting a revised version on our website. The revised version will be effective as of the published effective date. In addition, if the revised version includes a substantial change, we will provide you with twenty-one (21) days’ prior notice via any of the communication means described in Section 9 of the Privacy Policy, or by posting notice of the change on our website. After this twenty-one (21) day notice period, you will be considered as having expressly consented to all amendments to this California Notice. We encourage you to periodically review this page for the latest information on our privacy practices