SpendConsole is committed to protecting personal information and maintaining the privacy, security and trust expected of an enterprise technology provider.

This Privacy Policy explains how SpendConsole collects, holds, uses, discloses and protects personal information in connection with our websites, enterprise software platform, services and business operations.

SpendConsole operates in Australia and the United Arab Emirates and handles personal information in accordance with applicable privacy and data-protection laws, including the Australian Privacy Act 1988 and Australian Privacy Principles (APPs) and, where applicable, the UAE Personal Data Protection Law and other applicable UAE privacy requirements.

This Policy applies to individuals who interact with SpendConsole, including customer users, supplier representatives, business contacts, website visitors and other individuals whose personal information may be processed through the SpendConsole platform.

SpendConsole provides an Enterprise Payables Orchestration platform to enterprise customers.

In many circumstances, SpendConsole processes personal information on behalf of a customer as part of providing our platform and services. The customer determines the business purpose for processing that information and SpendConsole processes it in accordance with the customer’s instructions and our contractual obligations.

In other circumstances, such as when you visit our website, contact us directly, request information or engage with SpendConsole as a business, SpendConsole may determine how and why personal information is processed.

Where SpendConsole processes personal information on behalf of a customer, questions or requests concerning the underlying business transaction or customer-controlled information may need to be directed to that customer.

The information SpendConsole collects or processes depends on the nature of your interaction with us and the services our customers use.

It may include general categories of information such as:

• business identity and contact information;
• account, authentication and access information;
• supplier, transaction and payment-related information;
• documents and information submitted through customer business processes;
• communications and support information; and
• technical, security and usage information associated with our websites and platform.

SpendConsole may also process other information provided or authorised by our customers where reasonably necessary to provide the relevant services.

We do not sell personal information.

Personal information may be provided directly by you, by a SpendConsole customer, through customer-authorised systems and integrations, through supplier interactions, through use of our websites and platform, or through other legitimate business interactions.

We use and process information where reasonably necessary to:

• provide, operate and support the SpendConsole platform and services;
• manage users, suppliers and business relationships;
• facilitate enterprise payables and related business processes;
• process, validate and reconcile transactions;
• support compliance, security, fraud prevention and risk management;
• provide analytics, intelligence and recommendations;
• facilitate authorised payment-related processes;
• maintain auditability and platform security;
• provide technical and customer support;
• improve the reliability and performance of our services;
• administer our business relationships; and
• meet contractual, legal and regulatory obligations.

Where SpendConsole acts on behalf of a customer, our processing is also governed by the applicable customer agreement and instructions.

SpendConsole uses artificial intelligence, machine learning, analytics and rules-based automation as part of its enterprise platform.

These technologies may assist with activities such as processing and validating information, identifying patterns and anomalies, supporting compliance and risk controls, automating workflows and generating insights or recommendations.

AI and automated processing are used within governed enterprise processes and appropriate controls.

Where SpendConsole processes customer-controlled information using these technologies, the processing is undertaken in connection with the services configured or authorised by the relevant customer.

Automated outputs may support business decisions but do not necessarily constitute final decisions about individuals without appropriate business rules, controls or human oversight.

SpendConsole does not publicly disclose proprietary models, methodologies, algorithms, detection techniques or other intellectual property used to provide these capabilities.

SpendConsole does not sell personal information or disclose it for unrelated third-party marketing purposes.

We may disclose or make information available where reasonably necessary to:

• the relevant SpendConsole customer and its authorised users;
• authorised suppliers or participants in customer business processes;
• SpendConsole personnel and affiliated entities;
• trusted technology and service providers supporting our operations;
• customer-authorised enterprise, financial or technology providers;
• professional advisers, auditors and insurers; or
• regulators, courts, law-enforcement agencies or other authorities where required or authorised by law.

We require third parties handling information on our behalf to be subject to appropriate confidentiality, privacy and security obligations.

We do not publicly disclose detailed subprocessor, integration or infrastructure arrangements where doing so would unnecessarily expose security-sensitive, commercially confidential or proprietary information. Where applicable, relevant information is made available to enterprise customers through contractual, security and due-diligence processes.

SpendConsole operates in Australia and the United Arab Emirates and supports customers operating internationally.

Depending on the customer deployment, authorised users, support arrangements and services being provided, personal information may be accessed or processed across Australia and the United Arab Emirates or otherwise as agreed with the relevant customer.

Where personal information is disclosed internationally, SpendConsole takes reasonable steps to ensure appropriate privacy and security protections are maintained in accordance with applicable law and contractual requirements.

Customer-specific hosting, data-residency, access and cross-border processing requirements may be governed by the relevant customer agreement.

SpendConsole does not publish the physical locations or detailed architecture of its hosting and data-centre infrastructure for security reasons.

Security by Design

SpendConsole maintains an ISO/IEC 27001-certified Information Security Management System and applies stringent enterprise security standards to protect customer and personal information.

We maintain administrative, organisational and technical safeguards appropriate to the nature and sensitivity of the information processed. These include controls relating to areas such as access management, encryption, monitoring, resilience, vulnerability management and incident response.

Specific security architecture, controls and configurations are not detailed publicly for security reasons. Detailed security information may be provided to enterprise customers through appropriate security assessment and due-diligence processes.

No information system can guarantee absolute security. SpendConsole continually reviews and improves its security practices in response to evolving threats, technology and regulatory requirements.

Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it is processed or as required by applicable contractual, legal, regulatory, security or audit requirements.

Where SpendConsole processes information on behalf of a customer, retention and deletion may also be governed by that customer’s instructions and applicable contractual arrangements.

Depending on the applicable law and circumstances, individuals may have rights concerning their personal information, including rights to request access, correction or deletion, object to or restrict certain processing, or obtain information about how their personal information is handled.

Requests relating to information SpendConsole holds for its own purposes can be submitted to:

privacy@spendconsole.ai

We may take reasonable steps to verify your identity before responding.

Where SpendConsole processes information on behalf of an enterprise customer, the customer may be responsible for responding to the request. In those circumstances, we may refer you to the relevant customer or assist that customer in responding in accordance with our obligations.

Applicable rights and exceptions vary between jurisdictions.

SpendConsole websites use cookies and similar technologies to support website functionality, security, analytics and user experience.

Where required, users are provided with notice and appropriate cookie consent controls.

By providing consent through our cookie controls, you authorise the use of cookies and similar technologies in accordance with the choices presented to you.

You may be able to modify your cookie preferences through the controls provided on our website or through your browser settings.

SpendConsole may send operational and transactional communications relating to use of the platform, including account, supplier, transaction, workflow, compliance, payment, support and security notifications.

These communications are necessary to provide or administer the relevant services and are distinct from marketing communications.

Where permitted by law, SpendConsole may also send business or marketing communications. Recipients may opt out of marketing communications using the unsubscribe mechanism provided.

Opting out of marketing communications does not prevent SpendConsole or its customers from sending necessary transactional, service or security communications.

If you have a privacy question, request or complaint, please contact:

privacy@spendconsole.ai

We will review privacy complaints and respond within a reasonable period having regard to the circumstances and applicable requirements.

Where a matter relates to information controlled by a SpendConsole customer, we may coordinate with or refer the matter to that customer.

If you are not satisfied with our response, you may have the right to raise the matter with the relevant privacy or data-protection authority, including the Office of the Australian Information Commissioner (OAIC) in Australia or the relevant authority in the United Arab Emirates, as applicable.

For technical support rather than privacy enquiries:

support@spendconsole.ai

SpendConsole may update this Privacy Policy periodically to reflect changes to our platform, business practices, technologies or applicable requirements.

The current version will be published on the SpendConsole website and identified by its version number and effective date.

Material changes will be communicated where required or appropriate.

Privacy enquiries: privacy@spendconsole.ai

Technical support: support@spendconsole.ai