Previous Brex Privacy Policy

Previous Brex Privacy Policy - 20190919

Revised September 19, 2019

Brex Inc. provides financial products and services to growing businesses. We understand that by using Brex, you place your trust in us to handle your data and personal information appropriately, including your personal information and your business’s end users.

We want to make sure that you have all the information necessary about how we process—a fancy way of collectively saying use, collect, transmit, store, share, and erase—personal information, which does not include anonymized or aggregated data, so you can make an informed decision about how you want to interact with our products and services.

We know that you may have questions about how we process your personal information and have laid out how we process personal information about you. We’re constantly open to inquiries and suggestions for how we can improve; please reach out to our Privacy Team at privacy@brex.com.

Table of Contents

Personal Information We Process and How We Process It
How We Use Personal Information
How We Share Personal Information
Where We Store Personal Information
Other Important Information About Your Personal Information
Your Choices About Your Personal Information
Changes to This Privacy Policy
Contacting Us
Previous Privacy Policies

1. Personal Information We Process and How We Process It

The personal information we process depends on the products you use and how you access them. We process information when you directly interact with Brex in the following ways:

Filling out an application and creating a Brex Account
Making a purchase using your physical or virtual Brex Card
Browsing brex.com or using dashboard.brex.com
Using our iOS or Android mobile apps
Connecting accounts to your Brex Account
Calling, chatting, or interacting with Brex (such as Customer Experience or Sales, or texting us a copy of a receipt)
Interacting with us at a conference or event

Information We Process When You Use Our Products and Services

Information needed to apply and create a Brex Account. If you are opening a Brex Account on behalf of a business, we need to process a certain amount of preliminary information about you, your business, and individuals associated with your business to create a Brex Account to comply with our legal and regulatory obligations. When you apply for a Brex Account, we may process:

Your name
Your title or role on your team
Your email
Your phone number
Your password (hashed) - unique and strong, please
Information related to your business, including the business’s legal name, address, Employer Identification Number (EIN), and certain individuals who have an ownership interest in your business.
Bank account information
Other information pertaining to your identity such as copies of a passport, driver’s license, or other national ID
Your Tax Identification Number (TIN) or your Social Security Number (SSN)
Personal information provided to us from third-party companies we partner with to offer services to you (see below)

Information needed to use our products and services. We need to process personal information when your business assigns you a Brex Card or otherwise allows you to use our products and services (for example as an employee or authorized representative). To use these services, we may process:

Your name
Your email
Your phone number

Information processed when you make a transaction. Each time you make a payment using a Brex Card we receive information about your transaction. We may receive this information directly from you or from our financial partners (including Emigrant Bank or Sutton Bank) or the card networks (Mastercard or Visa). We may process:

Payment method information (card number, card type, PIN)
Purchase amount
Purchase date
Purchase location
Whether you made the purchase online or in a store
Receipt information
Information provided to us by the card network associated with transactions, merchants, or cardholders

Information automatically processed when you visit our websites or use our mobile app. We process personal information automatically when you visit our website or use our mobile app to make our services work, to prevent fraud and enhance security, to understand your preferences, and to tailor services to you for the best possible experience. We may process:

Browser and device information.

IP address
Mobile and other hardware or device identifiers
Operating system
Browser information, such as type and version
Referring and exit pages, including landing pages and pages viewed
Device event information, including crash reports, request and referral URLs and system activity details

Information about your use of our website or mobile app.

Your location
What you click on and what you type, time you spend on our websites, and other user experience information

Cookies and trackers. We also use cookies and other activity tracking tools to help our website function effectively. These tools allow us to:

Provide you services such as those that allow you to chat with our Customer Experience team
Perform website analytics
Improve the advertisements you see
Prevent fraud and prevent attacks against our websites and services
Advertise Brex products and services, and additional products and services from our partner companies

We use cookies and trackers to assign you a unique identifier so we can record:

Websites you visit
Length of time the advertisement was visible
IP Address

You can block these at anytime using you web browser settings, but doing so may limit browsing experience and your ability to use certain features of our services.

Information processed when you interact with Brex teams. We may process personal information about you when you call, chat, email, or interact with members of Brex teams (such as Customer Experience, Sales, or Marketing), including:

Your name
Your email, phone number, or other contact information
Content of your communications and survey responses

Information processed when you enter into a sweepstakes, contest, or other promotion. We may process personal information when you enter a sweepstakes, contest, or promotion to administer those programs, including:

Your name
Your email, phone number, or other contact information
Other personal information required for you to participate

Information Processed from Our Business Partners and Service Providers

We process personal information we receive from financial partners, identity verification services, and other third-party service providers, and information you share with us about your use of their products and services:

To comply with regulatory and reporting obligations
To facilitate your use of our products or services, or other products and services
To underwrite your account
To conduct fraud monitoring, prevention, and detection
To fulfill commitments to our business partners
To fulfill a request made by you

Information necessary to comply with regulatory and legal requirements. When you open a Brex Account as a business owner or an administrator on behalf of a business, or you provide information as an individual with an ownership interest in a business, we process personal information we receive from identity verification services and other third-party service providers that we must keep to comply with the law, including:

Your name
Your phone number
Your SSN
Your current or previous addresses
Your date of birth

Information processed to integrate third-party products and services with your Brex Account. When you choose to link your Brex Account with products and services provided by our business partners, we process personal information we receive from them to ensure our products and services work properly together.

Your bank. To underwrite, provide you the highest credit limit possible, and determine your eligibility for Brex Rewards, we require you to give us information about your business’s finances and access to your business’s bank account. We use a third-party service provider to process information about your business’s bank account. When you link your bank account we process the bank account credentials and all information associated with the bank accounts associated with those credentials, including:

Unique identifiers associated with your bank
Account names
Bank account type
Transaction history and related information
Account balances
Bank routing and account numbers

If you do not link your bank directly, we process information you provide with copies of your bank statements and other financial information about your business.

To link your bank account with you Brex Account, a secure third-party service provider may use and store your bank account credentials. We do not store your bank account credentials on Brex systems.

Brex Account connections. We offer the ability to connect your Brex Account with accounting services (such as QuickBooks Online, Xero, and Netsuite), travel services, and other products and services. We both provide personal information to and receive information from these services on your behalf.

Accounting and expenses services. When you direct us to connect your Brex Account to these services we collect certain information to make those integrations work, including:

Unique identifiers associated with the third-party connected account
Information associated with your general ledger account
General ledger account codes
Locations
Classes
Departments
Email addresses

The information we collect may differ based on the accounting service and the choices you make relating to that service.

Travel services. When you book travel through dashboard.brex.com/travel, we process information from our travel partners about your travel plans, including:

Unique identifiers associated with the travel service
Details about your booked flight
Details about your hotel reservation
Rewards points balances and transfer information

Financial partners. We get information from financial service providers such as our issuing bank and our card networks to make our services work. The information we get includes personal information related to your transactions using a virtual or physical Brex Card as described above.

Information processed to conduct fraud monitoring, prevention, and detection. We process personal information from our business partners, financial service providers, credit reporting agencies, identity verification services, public sources, and other third parties to prevent fraud.

Information processed as a result of a business partnership, referral, or agreement. We enter into agreements with financial partners and other businesses that provide products and services related to ours, and as a result of these partnerships, Brex may receive personal information related to that particular business or partnership. We may process information about:

You and your relationship with the business partner
Your email or other contact information
Your membership or relationship status with the business partner

2. How We Use Personal Information

We process your personal information for the reasons stated specifically in this policy, but we may also process personal information processed about you to:

Operate our business and provide tailored services to you.

Communicate with you about the products and services by phone, text, email, or chat
Monitor, prevent, and detect fraud or unauthorized activity
Secure our systems and products
Mitigate financial loss, claims, liability, and other harm to our users, Brex, our partners, or third parties
Manage, operate, and improve the performance of our products and services
Provide you with tailored recommendations
Identify, fix, and troubleshoot bugs and errors
Facilitate reporting, analyzing performance, and auditing
Understand how you use our services so we can make enhancements or improvements
Facilitate business relationships or comply with contractual obligations
Comply with our regulatory, legal, and compliance obligations
Advertise or market services and products to you
Determine eligibility for, calculate, and provide Brex Rewards
Compare information for accuracy and verify it with third parties
If you elect to share information about your geolocation, we will use this information to enhance the security of our products and services and to prevent fraud

Provide you with support.

Help identify and troubleshoot problems with your account
Survey your opinions through surveys or questionnaires
Communicate with you and respond to your specific requests or questions
Manage and send you notifications, confirmations and important information about your card and our products and services

Anonymized and aggregated data. To better target advertisements, improve, and market our products and services, and for other promotional purposes, we may reasonably transform personal information into de-identified information removing or masking information that could be used to identify you and by aggregating or combining de-identified data with other information. If you don’t want us to use your data in anonymized or aggregate form, contact us at privacy@brex.com.

3. How We Share Personal Information

Sharing for business purposes only. Brex may provide personal information to third parties to improve our products and services, to operate our business, and to help Brex market to potential customers. We may share all of the categories of information listed in this Privacy Policy with other companies:

To operate Brex’s products and services or support general operations of Brex’s business
To integrate the products and services of our business partners with your Brex Account
To use third-party cloud services to host our website and store the information we process about you
For any other legitimate business purpose

No sale of personal information. We do not and will not sell or allow other businesses process your personal information for their own use without your express consent, unless it is either required by law or we determine that disclosure is reasonably necessary to enforce our rights, protect our property or operations, or enforce the rights and protect the property or operations of our business partners and customers.

Making a payment. We share some personal information about you, such as your name and information about the payment method, with the person or merchant that you are paying.

Anonymous or aggregated information. We may share anonymized or aggregated information, or other data that does not directly identify you or your business, with third parties.

Affiliate sharing. Brex Inc. may share personal information we process about you with other Brex companies to provide additional services to you, determine eligibility for new products and offers, and for other legitimate business interests.

Service providers. We share your personal information with our service providers who operate and provide services on our behalf. These service providers need access to your personal information to perform information processing, manage or enhance our customer information, tailor services to you and your preferences, and perform other services related to our business. We work with our service providers to make sure that they do not sell the personal information that we share with them.

Advertising. We may use third parties to send advertisements on our behalf. We may only share a very limited set of personal information required to deliver our advertisements to you (such as an email address to deliver the message to you), and we do not permit third parties to use or share your personal information to advertise unaffiliated products or services to you. These third parties may also use cookies or similar tracking tools to identify you through your browser usage. While you may disable these tools in your browser settings, you may still receive non-targeted advertisements we sent as part of a general marketing campaign.

Financial and business partners. We share personal information to facilitate the services we provide to you with our business and financial partners.

Card issuing partners. Brex partners with Emigrant Bank and other banks to issue cards to you. Brex owns and controls the transaction data and other personal information we share with card issuing partners. We share the personal information you provide with your application for a Brex Account with our card issuing partners to comply with our contractual obligations and to facilitate compliance with their and our regulatory obligations. Our card issuing partners do not sell or use your personal information or use any related data to market or to develop products and services, or for any other purpose not authorized by us.

Credit reporting agencies. We share your business information with credit reporting agencies to verify information about your business and to report on your business’s performance, which in some cases may contain personal information.

Card network partners. Mastercard or Visa separately processes information related to your use of your cards. For more information on how Mastercard and Visa handle your personal information, please visit Mastercard’s Global Privacy Notice or Visa’s Global Privacy Notice, respectively.

Partnerships and referrals. We share personal information to facilitate referral partnerships. For example, if you were referred to us through an organization we may provide confirmation to that organization that your business opened a Brex Account with us, and information relating to your Brex Account activity solely for the purpose of calculating any referral fees we owe related to the referral.

Sharing authorized by you, your users, or authorized representatives. We continually enhance our products and services by integrating with products and services provided by other companies. For these integrations to work and with your explicit consent, we may need to share your personal information with them. Information we share with these companies will be used and disclosed according to that company’s privacy policy. You should review the privacy policy of any company that has access to your personal information related to the integration with your Brex Account.

Accounting and expenses integrations. We offer integrations with many popular accounting services (such as QuickBooks Online, Xero, and Netsuite). We share information with those services solely as directed by you, your users, or authorized representatives.

Travel partners. We share personal information with our travel partners. Our travel partners use this information solely to book travel and provide services to you.

Corporate transactions. In the event of a corporate sale, merger, reorganization, dissolution or similar event, personal information and data we process from you may become part of the assets we transfer or share in preparation for any such transaction. Any acquirer or successor of Brex may continue to process personal information consistent with this Privacy Policy.

Compliance and compelled disclosure. We may share personal information:

to comply with applicable law, regulation or payment network rules
to enforce our contractual rights
to protect the rights, privacy, safety and property of Brex, you, our customers, our business partners, or others
to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include authorities outside your country of residence. When complying with court orders and other similar legal processes, Brex strives for transparency. We will make reasonable efforts to notify our customers and users of any disclosure of their personal information, unless we are prohibited by law, court order, or exigent circumstances prevent us from doing so.

4. Where We Store Personal Information

We provide and direct our services only to businesses in the United States and for use exclusively by their employees or authorized representatives. We may process and store personal information for the purposes described in this Privacy Policy in the United States or any other country in which Brex, its subsidiaries, affiliates, or service providers operate. We will store this information while we continue to provide products and services to you, to operate our business, comply with contractual obligations, and for as long as required by law.

If you ask us to delete specific personal information (see “Your Choices About Your Personal Information” below), we will honor your request unless deleting the information prevents us from billing for our products and services, calculating taxes, conducting required audits, or carrying out other legitimate business functions, or we are required by law or contractual obligation to keep that information.

5. Other Important Information About Your Personal Information

Security. We use organizational, technical, and administrative measures to protect personal information; however, no data security program is entirely secure. Please contact us immediately if you believe that your personal information or any other confidential information that you have provided to us is no longer secure or has been lost or stolen. If we confirm that there has been a breach of personal information or confidential data related to you, we will notify you.

Use by minors. If you are under the age of 16, you may not have a Brex Account or use our products or services. We do not knowingly process any information from, or direct any of our products or services to children under the age of 16. Please do not provide us with any personal information related to children under the age of 16.

Personal information related to administrators, employees, company owners, and authorized persons. In some circumstances, we require you to provide us with personal information relating to another person (such as providing us with personal information about the owners of your business during the application process or providing us with personal information about your employees). Do not provide us with any personal information unless you have obtained consent of these persons or you are sure the disclosure of the personal information is otherwise permitted by law. You must inform all other persons whose information you share with us how we process personal information and all other terms of this Privacy Policy.

Brex Account users. Our products and services are intended for use only by businesses, and you may only use a Brex Account or Card if you are an employee or other authorized representative of a business that has opened a Brex Account. The business’s administrator is responsible for the Brex Account and cards associated with that business. An administrator can: restrict, suspend, or terminate your access to or ability to use the services, access personal information about you, access or retain information stored with us, and restrict your ability to edit, restrict, modify, or delete information associated with your use of our products and services.

6. Your Choices About Your Personal Information

Electronic communications. You may choose not to receive promotional emails from us by following the unsubscribe/opt-out instructions in those emails, but we may still send you non-promotional messages relating to information about your our products and services such as updates to our platform agreement, privacy notices, security alerts, and other notices relating to your access to or use of our products and services.

Deletion or closure of a Brex Account. You can close your Brex Account at any time per the terms set out in our Platform Agreement. If you are a Brex Account administrator, please contact Customer Experience to close your Brex Account, otherwise please contact your business’s administrator to have your access to Brex Cards deleted. Closure or deletion of your Brex Account will mean that you permanently lose access to the Brex Account, personal information, and data associated with the Brex Account. Certain personal information or de-identified information associated with your business’s Brex Account may nonetheless remain on systems owned or maintained by Brex where required to comply with the law or our contractual obligations.

Application rejection. To comply with legal and regulatory obligations, we retain certain personal information associated with rejected applications for a Brex Account.

California rights. If you are a California resident, you have certain rights over the information that we have about you. Starting January 1, 2020, you can:

Access a copy of any personal information we have about you
Delete any personal information we have about you when we do not have legal or contractual obligations to keep the information
Correct any personal information we have about you either in your settings, contacting your Brex Account administrator, or by contacting us as provided below

Exercising your choices. To exercise your choices about your personal information, please contact us at our Customer Experience team at (833) 228-2044 during available support hours. If you are an end user of Brex’s services and not a direct customer of Brex (for example, your business uses Brex and you’re an employee or authorized representative of that business), you should direct requests relating to your personal information to the administrator of your business’s Brex Account. We will not discriminate against you for exercising any of your rights.

Sale of personal information (“Do Not Sell My Personal Information”). We do not sell your personal information.

7. Changes to This Privacy Policy

We may make minor updates to this Privacy Policy, and we encourage you to visit this site from time to time to be aware of and review any updates. We will notify you of material changes, changes that limit any of the rights you have related to the manner in which we process your personal information under this Privacy Policy, or that we are required to disclose by law via a prominent notice on our website, login screen, your mobile app, or via email at least 30 days prior to the changes taking effect. We also provide information about how our Privacy Policy has changed over time in the Previous Privacy Policies section or on our Github.

8. Contacting Us

If you have concerns, questions, or would just like to better understand our privacy practices at Brex, please send an email to privacy@brex.com or if you prefer to contact us by mail, please write to Brex Inc., Attn: Legal, 153 Townsend St., Floor 6, San Francisco, CA 94107.

9. Previous Privacy Policies

06.06.2018