Glep Privacy Policy

Overview

Glep respects your privacy. While Glep’s services are designed for use by business customers, we may process information about you when providing our services and operating our business. This Privacy Policy (the “Policy”) describes how Glep collects, uses, discloses, retains, and protects information that identifies or that could reasonably identify or be linked to an individual, household, or device (“Personal Information”), as well as your rights and choices. For purposes of this Policy, “Glep,” “we,” “our,” and “us” refer to Glep Payments, LLC and its affiliates, and “you” or “your” refers to the individual interacting with us.

When you access or use our Services, you acknowledge that you have read this Policy and understand its contents. In connection with specific Services, we may provide additional “just-in-time” disclosures or notices about our data practices, including our GLBA Consumer Privacy Notice (available at glep.com/legal). These notices may supplement this Policy or provide you with additional choices about how Glep processes your Personal Information.

If you have any questions about this Policy or our privacy practices, contact us at [email protected]. See Section 12 (Contact Us; Data Controller) for more information.

1. Applicability of this Policy & Glep’s Business

This Policy applies to Personal Information we collect and process when you use or interact with:

• our business banking, spend management, payments, card, and related services, including the associated technology we provide for access to and use of those services, such as our web and mobile applications and APIs (the “Services”);
• www.glep.com (the “Website”); and
• our social media, emails, newsletters, advertisements, and other locations or platforms, online or offline, where you interact with our business (collectively, with the Services and Website, the “Business”).

Data protection laws distinguish between entities that determine the purposes and means of processing Personal Information (“Controllers”) and entities that process Personal Information on behalf of other entities (“Processors”). Our terms of use, platform agreements, and related addenda (the “Agreement”), along with the terms and conditions of our partner financial institutions, govern our provision of Services to a business customer (a “Company”). When Glep processes Personal Information on behalf of a Company to provide contracted Services, we do so in accordance with the Agreement and the Company’s instructions, not this Policy. If you wish to exercise rights regarding Personal Information we process on behalf of a Company, you should contact the applicable Company; if we receive a request intended for a Company, we will forward it to the Company for resolution. Glep is not responsible for the privacy practices of any Company, which may differ from those in this Policy.

This Policy does not apply to third-party applications or services used in connection with the Services, or to products, services, or accounts provided by other entities under their own terms or privacy policies (collectively, “Third-Party Services”). For example, a Company may connect accounting systems, bank accounts held at depository institutions, payroll or HR systems, e-commerce platforms, and other products to its Glep account. Third-Party Services are provided by independent third parties under those third parties’ own policies and terms.

2. Personal Information We Collect

The Personal Information we collect depends on the context of your interactions with Glep, the choices you make, the Services and features you use, your location, and applicable law. If you provide us with information about another individual (for example, a co-worker, beneficial owner, vendor, or payee), you represent that you have the authority to do so and have provided any required notices and obtained all necessary rights and consents for us to process that information in accordance with this Policy.

A. Information Provided Directly to Glep

The Services are intended for use by Companies and their administrators, employees, and other authorized users (“Authorized Users”). When you or someone at your Company applies for a Glep account, we may receive information about you, your Company, and individuals associated with your Company, including:

• Contact Information, such as your name, email address, phone number, employer, job title, and address.
• Identity Verification & Risk Information, including Personal Information of a Company’s owners, control persons, beneficial owners, and other relevant personnel, such as name, email address, phone number, date of birth, residential address, country of citizenship, photograph, Social Security number or other tax identification number, driver’s license, passport, or other government-issued identification, information captured through our identity verification process, and other information requested as part of the application, onboarding, underwriting, or compliance processes.
• Account Information, such as usernames, login credentials, bank account information, and other authentication and security credential information.
• Communications, including when you contact sales or support, provide feedback, respond to surveys, or correspond with our teams. We may record audio or video during sales or support calls where permitted and with any required notice or consent.
• Content, including documentation, files, or information you provide, which may include Personal Information about you or others.
• Third-Party Information, including Personal Information you provide about co-workers, contractors, vendors, payees, or referrals, such as their contact information.

In connection with providing the Services, we also collect and process additional Personal Information of Authorized Users submitted by, on behalf of, and relating to a Company’s Authorized Users, such as:

• Authorized User Data, including name, email, phone number, employer, job title, role, login credentials, and other information used by your Company to invite and manage Authorized Users.
• Transaction Data, including information associated with payments, transfers, bill payments, reimbursements, and card transactions made through your Company’s Glep account, such as purchase details, payment mechanism, amount, location, merchant information, and any annotations or coding you provide.
• Connected Data, including information and documentation relating to you made available to us by Third-Party Services connected to the Services (for example, linked bank accounts, accounting systems, payroll or HR systems). If you link a bank account, we may receive information about that account, such as routing and account numbers and account balance. We may continue to access and receive Connected Data from a Third-Party Service until it is disconnected by you or your Company.
• Receipt and Invoice Data, including information you submit to pay invoices and process receipts, which may include photos, PDFs, and the contents of emails or messages, along with associated metadata.
• Vendor and Payee Data, including the identity and contact information of vendors and payees, payment details, contracts and purchase orders, and information needed to complete tax documentation (such as tax classification and tax identification number).

B. Information Generated and Collected Automatically

We collect certain information automatically when you use or interact with our Website, Services, and other parts of our Business:

• Use Data, including information and metadata about the pages or content you visit, features you interact with, time spent, login and crash data, Third-Party Services you connect, your preferences and selections, and referring and exiting pages.
• Device Data, including the type of device or browser you use, operating system and settings, internet service provider, and device identifiers such as IP address.
• Location Data, including approximate location derived from your IP address or business information.

We use log files, cookies, web beacons, pixels, tags and scripts, and software development kits (SDKs) to assist with this collection. For information about your choices regarding these technologies, see Section 6 (Your Rights and Choices). You can also limit collection of certain information by changing your device and software settings, although doing so may limit the features available to you.

C. Information Collected from Other Sources

We also collect Personal Information from other sources, including:

• Partner Financial Institutions, including banks, card networks, payment processors, money transmitters, and other entities that provide or support delivery of financial services through or in connection with the Services.
• Identity Verification, Fraud, Compliance, and Financial Information Providers, which help us verify identity, supplement our understanding of your Company and its personnel, maintain security, prevent fraud, and comply with legal obligations, and may provide information such as name, address, phone number, photograph, government identification, device information, sanctions-screening results, and credit or risk information.
• Credit Bureaus and Commercial-Data Providers, in connection with verification, underwriting, and risk management.
• Vendors and Counterparties transacting with or supporting Companies, such as merchants and accounting firms.
• Service Providers, which help us operate our Business.
• Affiliates, as described in Section 5.
• Joint Marketing, Referral, and Business Partners, which may share information about overlapping or referred customers, such as contact information.
• Publicly Available Sources, including information in the public domain that helps us identify potential customers and partners or conduct due diligence and risk management.

3. How We Use Personal Information

We use Personal Information for business and commercial purposes in accordance with this Policy, including:

• To Provide and Maintain Our Business. To provide, operate, and manage the Services, Website, and other parts of our Business, including to open, administer, and service accounts; enable you to use cards and payment tools; verify financial information; establish and enforce limits; and prevent or address technical issues.
• To Verify Identity and Manage Risk. To conduct know-your-customer (KYC), know-your-business (KYB), sanctions, anti-money-laundering (AML), fraud, security, credit, underwriting, and eligibility reviews, including in an automated fashion where permitted.
• To Process Transactions. To process payments, transfers, invoices, reimbursements, disputes, chargebacks, refunds, repayments, and collections.
• To Communicate with You. To send notices, updates, security alerts, and information about changes to our policies and terms; to respond to support requests and feedback; and to provide transactional, relationship, and, where applicable, marketing communications.
• To Detect, Prevent, and Respond to Fraud and Security Incidents. To maintain the safety and security of our Business and manage risk, including investigating suspicious activity and detecting and preventing potential security incidents, fraudulent or unauthorized transactions, and breaches of our policies and terms.
• To Comply with Legal Obligations and Enforce Our Rights. To fulfill legal, regulatory, tax, payment-network, partner-bank, and contractual obligations, including cooperating with government authorities, courts, and regulators; maintaining compliance records; protecting our legal rights; and pursuing available remedies.
• To Develop and Improve Our Business. To identify and troubleshoot issues, improve and expand our products and operations, and develop new features and functionality.
• For Auditing and Research. To conduct internal reporting, auditing, and research.
• For Marketing and Advertising. To develop, send, and measure advertising and direct marketing about Glep products, offers, promotions, events, and Services, where permitted by law. If you connect a bank account to your Company’s Glep account, we will not use your bank account information to market our Business on third-party advertising platforms.
• To Generate De-identified or Aggregated Information. To develop de-identified, aggregated, or anonymized information, which we may use for any purpose permitted by law.
• At Your Direction. To fulfill any other purpose at your direction, including as expressed through your or your Company’s use of Services functionality.
• With Notice to You and Your Consent. We may otherwise use Personal Information after providing notice to you and obtaining your consent.

4. How We Disclose Personal Information

We disclose Personal Information in accordance with this Policy to the following categories of recipients. We may disclose information that does not identify you (including aggregated or de-identified information) for any purpose except as prohibited by law or applicable contractual obligation.

• Affiliates. We may disclose Personal Information to affiliates and related entities of Glep Payments, LLC for everyday business purposes such as operations, administration, compliance, and provision of the Services. Our affiliates are companies related to Glep by common ownership or control and include Glep Financing LLC.
• Service Providers. We disclose Personal Information to service providers that process information on our behalf, such as cloud infrastructure, hosting, analytics, identity verification, fraud prevention, compliance, payments processing, communications, customer support, security, marketing, billing, collections, and professional-services providers. We impose contractual restrictions on service providers’ processing of Personal Information.
• Business Customers. We disclose Personal Information to your Company so that we can provide Services on the Company’s behalf, including to process transactions, report on use of the Company’s Glep account, respond to questions and requests, and comply with law. Your Company can assign roles to Authorized Users with different permissions, and some Personal Information about your use of the Services may be visible to other Authorized Users or individuals acting on behalf of your Company. Each Company is an independent entity, and its processing of Personal Information is subject to its own policies and terms.
• Partner Financial Institutions. We disclose Personal Information to partner banks, card networks, payment processors, money transmitters, and other financial-service partners to support their customer identification, risk, and compliance programs, and so they can determine eligibility for, and provide, products and services to your Company, either directly or through us. For example, to comply with know-your-customer requirements, we may disclose your name, contact information, date of birth, residential address, government identification, and transaction information.
• Identity Verification and Risk Providers. We disclose Personal Information to third parties that help us verify identity, prevent fraud, screen against sanctions lists, and perform other compliance and risk functions.
• Credit Reporting Agencies and Financial Information Providers. We may disclose information about your Company and its Glep account to credit reporting agencies and financial information providers to verify information, assess creditworthiness, and report on performance. While this information is generally about the Company, it may include Personal Information.
• Vendors, Payees, and Transaction Counterparties. We disclose Personal Information to entities that transact with or support your Company, such as confirming the status of payments to a recipient vendor, or in connection with disputes, tax reporting, reconciliation, or compliance reviews.
• Providers of Connected Services. We disclose Personal Information to Third-Party Services and their providers if you or your Company choose to connect them to the Services.
• Referral and Joint Marketing Partners. We may disclose Personal Information to partners in connection with referral programs or joint marketing activities with other financial companies conducted under formal agreements, consistent with our GLBA Consumer Privacy Notice.
• Analytics, Marketing, and Advertising Providers. We disclose Personal Information to analytics and advertising providers to conduct analytics and place advertisements for our Business, where permitted by law. If you connect a bank account to your Company’s Glep account, we will not disclose your bank account information to market our Business on advertising platforms.
• Mergers and Acquisitions. We may disclose Personal Information to an acquiring entity, legal counsel, consultants, or others in connection with, or during negotiations of, any proposed or actual merger, acquisition, financing, reorganization, bankruptcy, or sale or transfer of all or a portion of our business or assets. In accordance with applicable law, we will use reasonable efforts to notify you of any transfer of Personal Information to an unaffiliated third party in such a transaction.
• Public Authorities and Legal Process. We may disclose Personal Information to regulators, courts, law enforcement, and other public authorities to comply with applicable law, payment-network rules, and legal process; to investigate suspicious or potentially fraudulent activity; and where required to meet national-security, anti-money-laundering, or law-enforcement requirements. We may also disclose Personal Information to protect the rights, property, life, health, security, and safety of Glep, the Services, our Business, or others.
• At Your Request; With Your Consent. We may disclose Personal Information at your request or direction, or otherwise after providing notice to you and obtaining your consent.

Glep does not sell Personal Information for monetary consideration, and Glep does not disclose Personal Information to affiliates or nonaffiliates for them to market their own products or services to you.

5. GLBA and Financial Privacy Notices

Certain Personal Information we collect in connection with financial products or services is subject to the Gramm-Leach-Bliley Act (GLBA) and related regulations. Our GLBA Consumer Privacy Notice, available at glep.com/legal, describes the reasons we can share that information, whether Glep shares it, and whether you can limit that sharing. Where information is governed by the GLBA notice, that notice controls with respect to the practices it describes. Information subject to the GLBA and similar financial-services laws may be exempt from certain state privacy laws.

Some Glep products or partner-provided financial services may also be subject to additional privacy notices provided by our partner financial institutions. Those notices may describe additional collection, use, disclosure, retention, and privacy-choice practices.

6. Your Rights and Choices

A. Access, Correction, Deletion, and Objection

The Services are intended for use by Companies, and you may only use a Glep account if you are an Authorized User of a Company. The information in a Company’s Glep account is governed by our Agreement with the Company. You should direct questions about Personal Information we process on behalf of a Company to that Company and its administrators. As an Authorized User, you may also be able to access, update, or delete certain Personal Information within your Company’s account through the Services.

Subject to limitations under applicable law, residents of certain jurisdictions have the right to:

• Know what Personal Information we process about you and to access and receive a copy of it, including in a portable format.
• Correct inaccurate Personal Information about you.
• Request that we delete Personal Information about you.
• In certain jurisdictions (such as the E.U. and U.K.), request that we restrict processing of, or object to our processing of, your Personal Information.
• Where processing is based on consent, withdraw that consent at any time with respect to future processing.
• Not receive discriminatory treatment for exercising your rights.

These rights may be limited, for example, where fulfilling your request would reveal Personal Information about another person, infringe the rights of a third party, or require us to delete information we are required by law to keep — including for legal, regulatory, security, fraud-prevention, AML, sanctions, accounting, tax, or recordkeeping reasons.

To exercise your rights, contact us at [email protected]. We will confirm receipt of your request and respond within the time limits prescribed by law. We may require additional information to verify your identity and authority; if we cannot verify your identity, we may deny your request. If your Personal Information has been processed by us on behalf of a Company, please contact the Company directly; if you make your request to us, please provide the name of the Company, and we will refer your request to that Company and support them as required by applicable law.

In certain jurisdictions, you have the right to appeal a decision we make regarding your request. To submit an appeal, contact us at [email protected] with the subject line “Privacy Request Appeal.” Depending on where you live, you may also have the right to lodge a complaint with your state attorney general or applicable data protection regulator.

B. Communication Preferences

• Emails. You can opt out of promotional emails at any time by following the unsubscribe instructions in those emails or by contacting [email protected]. You cannot opt out of transactional and relationship emails, such as those about your Company’s Glep account, transactions, servicing, security, or our ongoing business relations.
• Text or SMS Messages. If you have opted in to text messages, you can opt out at any time by replying “STOP.” Text messaging opt-in data and consent will not be shared, sold, rented, or otherwise disclosed by us for marketing purposes.
• Push Notifications. You can opt out of mobile push notifications by adjusting your device settings or uninstalling the mobile app.

C. Tracking Technology Controls

• Cookies and Similar Technologies. Most browsers accept cookies by default. You can instruct your browser or device to decline or delete cookies, although some parts of our Business may not function correctly if you do.
• Global Privacy Control. Certain browsers and extensions support the Global Privacy Control (“GPC”) signal. Where required by applicable law, our Website is designed to respect GPC preferences.
• Do Not Track. There is no industry consensus on how to respond to “Do Not Track” signals, so we do not monitor or take action on them unless and until the law requires us to do so.
• Analytics and Targeted Advertising. You may opt out of certain online behavioral advertising by visiting the Digital Advertising Alliance (aboutads.info/choices) or Network Advertising Initiative (networkadvertising.org/choices) opt-out pages, and out of certain Google Analytics collection at tools.google.com/dlpage/gaoptout. Opting out applies only to the specific browser or device used, and you may continue to see advertising, including from us.

7. Retention

Subject to applicable law, we retain Personal Information for as long as we have a business or operational purpose to retain it and as necessary to comply with (or demonstrate compliance with) our legal and regulatory obligations, resolve disputes, prevent fraud, collect amounts owed, and enforce our rights and agreements.

Because Glep operates in a regulated financial-services environment, our retention obligations may require us to retain Personal Information after you are no longer an Authorized User or your Company’s Glep account has closed, and may in some cases prohibit us from deleting Personal Information after you have asked us to delete it. We may also continue to share information after the customer relationship ends, as permitted by law and as described in this Policy and our GLBA Consumer Privacy Notice. When the applicable retention period elapses, we will delete, de-identify, or anonymize Personal Information in accordance with our policies and procedures.

8. Security

We use various technical, organizational, administrative, and physical measures designed to protect Personal Information from loss, theft, misuse, and unauthorized access, disclosure, alteration, or destruction. These measures include computer safeguards, access controls, encryption of information in transmission to or from Glep, secured files and facilities, vendor oversight, and incident-response procedures. We also train employees to comply with our privacy and security standards and policies, and we may request proof of identity before disclosing Personal Information to you.

However, no security program or transmission of information over the internet is entirely secure, and we cannot guarantee the security of your Personal Information. We recommend you use strong passwords, enable multi-factor authentication, and follow your Company’s information security practices. If you suspect unauthorized activity on your Glep account or a security incident, contact us immediately at [email protected].

9. Use by Minors

We do not direct our Services or any other aspects of our Business to minors. We do not knowingly collect Personal Information (as defined by the U.S. Children’s Online Privacy Protection Act, or “COPPA”) from children under 13, and we do not knowingly “share” or “sell,” as those terms are defined under applicable law, the Personal Information of minors under 18. If you are a parent or guardian and believe a minor has provided Personal Information to Glep, contact us at [email protected].

10. Third-Party Services

The Services may contain links to, or allow you or your Company to connect, Third-Party Services. Third-Party Services are not controlled by Glep, and their collection, use, disclosure, and protection of information are governed by their own terms and privacy policies. When you enable an integration, we may receive, process, and disclose information through that integration at your or your Company’s direction.

11. Changes to this Policy

Our Services and Business may change from time to time, and we may need to collect new Personal Information or use Personal Information in different ways. We reserve the right to update this Policy at any time by posting an updated version at glep.com/legal/privacy-policy. If we make material changes to the way we collect, use, or disclose Personal Information, we will provide reasonable advance notice before the changes take effect — through the Website, your Company’s Glep account, or the contact information you have provided, if we have an existing relationship with you. If you continue using the Services after changes are in effect, our processing of your Personal Information will be subject to the updated Policy. We encourage you to review this Policy periodically.

12. Contact Us; Data Controller

If you have questions about this Policy or our privacy practices, or wish to lodge a complaint, please contact us:

• By email: [email protected]
• By mail: Glep Payments, LLC, Attn: Privacy, 600 California St, San Francisco, CA 94108

Glep may process Personal Information in accordance with the instructions of or on behalf of a Company, including when providing Services under an Agreement. In that context, Glep acts as a Processor and the Company acts as the Controller. Glep also acts as a Controller when it directly determines the purposes and means of processing Personal Information in other business contexts described in this Policy, such as complying with regulatory obligations applicable to our Business. Where we act as the Controller, the Controller is Glep Payments, LLC, unless we specify otherwise in writing.

13. Additional Disclosures for California Residents

These additional disclosures apply only to California residents and only to the extent applicable.

A. Notice at Collection

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CPRA”), requires businesses collecting or disclosing Personal Information to provide notices and means to exercise rights. In the past 12 months, we have collected the following categories of Personal Information enumerated in the CPRA:

• Identifiers, including name, postal address, email address, online identifiers (such as IP address), Social Security number, driver’s license number, passport number, or other similar identifiers.
• Customer records, including phone number, billing address, and bank account information.
• Characteristics of protected classifications under California or federal law, such as citizenship.
• Commercial or transaction information, including records of products or services purchased, obtained, or considered.
• Internet activity, including browsing history and interactions with a website, email, application, or advertisement.
• Non-precise geolocation data.
• Employment information.
• Audio recordings, where collected in connection with support or sales calls.
• Inferences drawn from the above information about predicted characteristics and preferences.
• Sensitive Personal Information, including government identifiers, account log-in credentials, and financial account information. We use Sensitive Personal Information only for purposes permitted under the CPRA, such as providing the Services, verifying identity, preventing fraud, maintaining security, and complying with law, and we do not use it to infer characteristics about you.

For details on sources, review Section 2. We collect and use these categories for the business purposes described in Section 3, and disclose them to the categories of persons described in Section 4. Retention is addressed in Section 7. Much of the Personal Information we process is collected, used, and disclosed subject to the GLBA and is exempt from the CPRA.

B. Right to Know, Correct, and Delete

You have the right to request: the categories of Personal Information we have collected about you; the categories of sources; the categories of Personal Information disclosed for a business purpose or “sold” or “shared”; the categories of recipients; the business or commercial purposes for collecting, “selling,” or “sharing”; and the specific pieces of Personal Information we have collected about you. Subject to exceptions, you also have the right to request correction or deletion of your Personal Information. To exercise these rights, contact [email protected]. We may require information to verify your identity, and if we cannot verify your identity, we may deny your request. If your Personal Information has been processed by us as a service provider on behalf of a Company, please contact that Company directly, or provide us the Company’s name and we will refer your request. You will not receive discriminatory treatment for exercising your rights.

C. “Sales,” “Sharing,” and Opt-Out

Our business model is providing banking, card, and spend-management services to Companies — not selling Personal Information, and we do not sell Personal Information for monetary consideration. However, under California law, some marketing practices — such as disclosure of Website visitor data for targeted advertising and analytics — may be considered a “share” or “sale.” To the extent our marketing practices constitute a “share” or “sale,” you can opt out by adjusting your cookie preferences on our Website or activating the Global Privacy Control on your browser or device. Opt-out preferences are specific to each browser or device.

D. Shine the Light

California residents may request (i) a list of the categories of Personal Information disclosed to third parties during the preceding calendar year for those third parties’ own direct marketing purposes, and (ii) the categories of third parties to whom such information was disclosed. As stated above, Glep does not disclose Personal Information to third parties for their own direct marketing purposes. To make a request, write to [email protected] with “California Shine the Light Request” in the subject line.

E. Authorized Agent

You can designate an authorized agent to submit requests on your behalf. We may require signed proof of the agent’s permission and may verify your identity directly before responding.

14. Additional Disclosures for Nevada Residents

Nevada law (NRS 603A.340) allows Nevada consumers to submit requests directing a business not to sell certain kinds of covered information. Glep does not sell covered information for monetary consideration as defined under Nevada law. Nevada consumers who wish to submit a request may contact us as described in Section 13.

15. Additional Disclosures for Residents of Virginia, Colorado, Connecticut, and Other U.S. States

Residents of certain U.S. states have rights under applicable state privacy laws, including the right to confirm whether we process your Personal Information; access, correct, delete, and obtain a portable copy of your Personal Information; and opt out of targeted advertising, the sale of Personal Information, or profiling in furtherance of decisions that produce legal or similarly significant effects. Note that Personal Information processed subject to the GLBA is generally exempt from these laws. To exercise these rights or appeal a decision, contact [email protected] as described in Section 6 and Section 13.