SAP Concur Marketing Privacy Statement
Last Updated: February 1, 2020
This SAP Concur Privacy Statement (“Privacy Statement”) describes the various ways that Concur Technologies, Inc., Concur Holdings (Netherlands) B.V., their subsidiaries, other affiliated and/or related companies, as applicable ("SAP Concur" or "we" or “us” or “our”) process information about you that is collected by SAP Concur in the context of sales and marketing activities through Channels (as defined below) and explains how SAP Concur uses such information for its own business purposes. Please see below in the section called “Data Controller” to better understand which individual SAP Concur legal entity shall be the data controller in any given specific situation. As used in this Privacy Statement, “Personal Data” means any data collected through our Channels that can be used to directly or indirectly identify an individual. The “Channels” are the various SAP Concur online, digital, electronic sites and technologies, such as public-facing sales and marketing websites, software applications, social media pages, chat features and online conversations, tele-prospecting or HTML-formatted e-mail messages we use to pursue our sales and marketing activities. Channels include sales and marketing activities carried out offline, but channels exclude SAP Concur business applications like SAP Concur Travel, Expense or Invoice. If you use SAP Concur business applications like SAP Concur Travel, Expense, or Invoice for which your company, institution, or other providing entity (“Providing Entity”) has subscribed either directly with SAP Concur or indirectly via an authorized reseller, please see the SAP Concur Processor Privacy Statement for information on how we access, use, store, collect or disclose data about you on behalf of your Providing Entity. In this Privacy Statement, “goods and services” includes access to SAP Concur’s web services, offerings, contests, sweepstakes, other content, non-marketing related newsletters, whitepapers, tutorials, trainings, events, conferences, webinars and seminars.
Data Controller. The data controller in any given situation is the SAP Concur legal entity which decides how and why to use your Personal Data for its business purposes. When you visit a SAP Concur Website, the data controller is the SAP Concur entity named in the legal disclosure page on the Website. If the local laws that govern the website do not require any specific legal disclosure, the data controller shall be the SAP Concur legal entity named in the copyright notice displayed on such Website. When you complete an online (registration) form on a SAP Concur Website, the data controller is the SAP Concur entity that is disclosed on the form.
Representative in the European Economic Area (EEA). If the data controller that collected your Personal Data is not a SAP Concur legal entity based in a EEA country, then the representative for the EEA and Switzerland of such data controller is Concur (Netherlands) B.V., located at Amerikastraat 10, 5232 BE ´s-Hertogenbosch, The Netherlands, which you may contact at any time at Privacy-Request@Concur.com.
Links to other websites. This website may contain links to foreign (meaning non-SAP Group companies) websites. SAP Concur is not responsible for the privacy practices or the content of such foreign websites. Therefore, we recommend that you carefully read the privacy statements of such foreign sites.
Use of SAP Concur websites by children. SAP Concur’s Channels are not directed to users under the age of 13. If you are younger than 13, you may not use our Channels. If you are a parent or guardian and believe we may have collected information about a child, please contact us at: Privacy-Request@Concur.com . SAP Concur will take steps to delete the information as soon as possible. Given that SAP Concur is not directed to users under 16 years of age and in accordance with the disclosure requirements of the California Consumer Privacy Act (“CCPA”), SAP does not sell the Personal Data of any minors under 16 years of age.
SAP’s Group Data Protection Officer (DPO) is Mathias Cellarius, SAP SE, Dietmar-Hopp-Allee 16, 69190 Walldorf, Germany, who may be contacted at Privacy@sap.com; or you may contact our group privacy team at any time at Privacy-Request@Concur.com.
We collect your Personal Data. We collect such Personal Data about you directly, indirectly and/or automatically as described below. To the extent permitted by applicable law, we may combine the information collected about you, as described below, including information about the organization for which you work, with other information in our possession or information that you provide to us, and we treat all this information about you as Personal Data.
When you access, use and/or interact with us through a Channel, we directly collect information you voluntarily provide us:
Examples of direct interactions with you through the Channels where you provide us business information and Personal Data about you include the following:
We also obtain business information and Personal Data about you from third party sources, as permitted by applicable law, such as the following:
When you access, use and/or interact with us through a digital Channel, you do so using a “Device,” which is either a personal computer, desktop or laptop, or a mobile device such as a smartphone or a tablet. A “Device Identifier” is the number that is automatically assigned to the Device you use to access the digital Channel, and we may identify your Device through its Device Identifier. The “Tracking Technologies” are the various technologies we use to automatically collect Device Identifiers and other information about you, more precisely the following information:
The information collected through Tracking Technologies may be considered Personal Data under applicable data protection laws. For additional information about our use of Tracking Technologies, please see below in How We Follow Visits and Usage, Why and How You Keep Control (Cookies, Analytics and Advertising).
Legal Basis for Processing. We collect and process your Personal Data with your consent or as permitted under applicable data protection laws to provide the goods and services you use on the Channels, fulfill your inquiry, operate our business, meet our contractual and legal obligations, ensure compliance, protect the security of our systems and our customers, or fulfil other legitimate interests.
Freely Given Personal Data or Consent. As a general principle, granting your consent and providing business information and Personal Data about you is entirely voluntarily and there are no adverse consequences to you if you do not grant a consent when required under applicable law or do not provide the required information. However, there are circumstances where SAP Concur cannot take action without certain Personal Data because such information is required, such as to process your orders or provide you with access to a web offering or newsletter. In these cases, without the relevant Personal Data, SAP Concur will not be able to provide you with what you requested.
Purposes of Processing. We use and process Personal Data about you for purposes described below:
We may use Tracking Technologies to collect information. The following are some examples of Tracking Technologies we may use:
If you have any problems using the Cookie Preferences link found in the footer of the webpage of this site, please email us at Privacy-Request@Concur.com
Transfers to data processors. We work with affiliated and third party vendors, consultants and other service providers that help us run our sales and marketing activities. These companies provide work and services such as email delivery, postal delivery, collecting business information and Personal Data about you on our behalf, event/campaign registration and management, information technology and related infrastructure services, data analysis and insight, auditing and other similar services. In some cases, these companies need access to some of your Personal Data to carry out their work for us. They are not permitted to use your Personal Data for their own promotional or business purposes.
Transfers to other controllers. Based on your consent, (where legally required), we may transfer your Personal Data to the other entities of the SAP group for the purposes described above of providing you with updates about SAP Concur’s goods and services. The current list of SAP group entities can be found here. Record of any required consent to our sharing your information with the other entities of the SAP group is stored in the SAP Concur Preference Center.
Based on your consent, (where legally required), we may share your contact information with sponsors, co-sponsors and/or exhibitors of events and/or conferences organized and hosted by SAP Concur (such as SAP Concur Fusion) for their own marketing and promotional purposes. Please note that our sponsors, co-sponsors and/or exhibitors may directly request your information at their conference booths or presentations. You should review their privacy policies to learn how they use personal information.
Occasionally, we may engage in joint sales or product promotions with selected business partners to provide content or to host events, conferences and seminars. If you purchase or specifically express interest in a jointly-offered product, promotion or service, we may share relevant Personal Data with those partners as permitted under applicable law. However, please be aware that we do not control our business partners’ use of such Personal Data. Based on your consent (where legally required), we may also transfer your Personal Data to selected business partners for their own marketing and promotional purposes. Our partners are responsible for managing their own use of the Personal Data collected in these circumstances. We recommend you review the privacy policies of the relevant partner to find out more about their handling of your Personal Data.
We may also share information about you as part of an Event, Conference, Seminar or Webinar: If you register for an event, seminar, webinar or conference of SAP Concur, based on your consent we may share basic participant information such as your name, company and email address with other participants of the same event, seminar, webinar or conference to foster the communication and exchange of ideas.
We may also share your information in the following circumstances:
SAP Concur maintains data handling and storage practices and procedures that are designed to promote the integrity and confidentiality of Personal Data. We update and test our security technology on an ongoing basis. We use commercially acceptable means to protect your Personal Data in an effort to prevent loss, misuse and unauthorized access, disclosure, alteration and destruction, but we cannot guarantee its absolute security.
As part of a global group of companies, SAP Concur has affiliates and third-party service providers within, as well as outside of, the EEA. Therefore, your Personal Data may be transferred, used, processed or stored in the United States or any other country where SAP Concur operates or maintains facilities or call centers, including jurisdictions that may not have data privacy laws that provide protections equivalent to those provided in your home country. We take steps designed to ensure that the Personal Data we collect under this Privacy Statement is processed according to the provisions of this Privacy Statement and applicable law wherever the data is located. By providing your information to us on our Channels, you agree to that transfer, storage, and processing in the United States and other countries outside of the European Union. Also, we may transfer your data from the United States to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Channels. When we transfer Personal Data from the European Economic Area and Switzerland to other countries, some of which have not been determined by the European Commission to have an adequate level of data protection, such transfer is based on the Standard Contractual Clauses (according to EU Commission Decision 87/2010/EC or any future replacement) in order to contractually ensure that your Personal Data is subject to a level of data protection which applies within the EEA. You may obtain a redacted copy (from which commercial information and information that is not relevant has been removed) of such Standard Contractual Clauses by sending a request to Privacy-Request@Concur.com.
We store and retain your Personal Data for as long as necessary to fulfill the purposes described in this Privacy Statement, such as to provide goods and services requested by you, respond to your inquiries or for other essential purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements, or until you object to SAP Concur’s use of your Personal Data (if SAP Concur’s use of your Personal Data is based on a legitimate interest) or you withdraw your consent (if SAP Concur’s use of your Personal Data is based on your consent). For clarity, in circumstances where we are required by law to retain your Personal Data longer, such as for tax, legal, accounting or other purposes, or where we need your Personal Data to assert or defend against legal claims, we will retain such information until the end of the relevant retention period or the resolution of such claims.
Preference Center and Choices. You can customize and control your marketing communication preferences by updating the Personal Data you provide us and your subscription settings in the SAP Concur Preference Center, or, for users of the SAP Business Exchange, in the account settings of the user’s profile, where you can return at any time to change your elections. You can also unsubscribe from promotional emails by: (1) following the unsubscribe instructions in our emails; or (2) emailing us at Privacy-Request@Concur.com. You can find details on how to automatically unsubscribe from e-mail communications in the SAP Concur Preference Center, or, for users of the SAP Business Exchange, in the account settings of the user’s profile. If you have any problems using any of these opt-out mechanisms, please contact us at Privacy-Request@Concur.com. Please note that even if you unsubscribe from promotional email messages, we may still need to contact you with transactional information related to the goods and services you have ordered or requested on the Channels.
Cookies. Cookies are small text files placed on your computer while visiting certain sites on the Internet used to identify your computer. Please see “Managing Preferences” under the “HOW WE FOLLOW VISITS AND USAGE, WHY AND HOW YOU KEEP CONTROL (COOKIES, ANALYTICS AND ADVERTISING)” above. Please remember that if you delete your cookies, or use a different browser or computer, you will need to set your cookies preferences again. If you have any problems using this cookie preference mechanism, please contact us at Privacy-Request@Concur.com.
Do Not Track. If you are a US resident, please be aware that we may not recognize or respond to every type of “do not track” signal or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer’s online activities over time and across third-party websites or online services, but we give you certain choices about how we collect Personal Data as described in this Privacy Statement.
Analytics and Advertising. You can customize and control the privacy practices of our third-party advertisers and analytics service providers through the cookie preferences link on our website where you can also review their privacy policies and learn more about your choices about information they collect from you. Please see “Managing Preferences” under the “HOW WE FOLLOW VISITS AND USAGE, WHY AND HOW YOU KEEP CONTROL (COOKIES, ANALYTICS AND ADVERTISING)” above. In addition, the Network Advertising Initiative offers information about some of the Internet advertising companies we may use, including how to opt-out of interest based advertising they deliver. To opt-out of Google Analytics web tracking you can download Google Analytics Opt-out Browser Add-on.
Your European Privacy Rights
If required by applicable law (e.g. because the SAP Concur entity using this privacy statement has its registered seat in a country of the EEA or you are within a country of the EEA), we adhere to the following rights described below.
You can request from SAP Concur access at any time to information about which Personal Data SAP Concur processes about you and the correction or deletion of such Personal Data. Please note, however, that SAP Concur can or will delete your Personal Data only if there is no statutory obligation or prevailing right of SAP Concur to retain it. Kindly note further that if you request that SAP Concur deletes your Personal Data, you will not be able to continue to use any SAP Concur services that require SAP Concur’s use of your Personal Data.
If SAP Concur uses your Personal Data based on your consent or to perform a contract with you, you can further request from SAP Concur a copy of the Personal Data that you have provided to SAP Concur. In this case, please contact Privacy-Request@Concur.com and specify the information or processing activities to which your request relates, and whether the Personal Data should be sent to you or another recipient. SAP Concur will carefully consider your request and discuss with you how it can best fulfill it.
Furthermore, you can request from SAP Concur that SAP Concur restricts your Personal Data from any further processing in any of the following events: (i) you state that the Personal Data SAP Concur has about you is incorrect, subject to the time SAP Concur requires to check the accuracy of the relevant Personal Data, (ii) there is no legal basis for SAP Concur processing your Personal Data and you demand that SAP Concur restricts your Personal Data from further processing, (iii) SAP Concur no longer requires your Personal Data but you state that you require SAP Concur to retain such data in order to claim or exercise legal rights or to defend against third party claims, or (iv) in case you object to the processing of your Personal Data by SAP Concur based on SAP Concur’s legitimate interest, subject to the time required for SAP Concur to determine whether it has a prevailing interest or legal obligation in processing your Personal Data.
As applicable under French law, you can also send us specific instructions regarding the use of your Personal Data after your death.
California Privacy Rights
For individuals within the State of California, you instead have the right (i) to request from SAP Concur access to your Personal Data that SAP Concur collects, uses, or sells (if applicable) or discloses about you; (ii) to request that SAP Concur delete Personal Data about you; (iii) to opt-out of the sale of Personal Data, if applicable; (iv) to non-discriminatory treatment for exercise of any of your data protection rights; and (v) in case of request from SAP Concur for access to your Personal Data, for such information to be portable, if possible, in a readily usable format that allows you to transmit this information to another recipient without hindrance. Please note that, in accordance with the disclosure requirements under the CCPA, SAP Concur is exempt from providing a notice pursuant to CCPA to opt-out because SAP Concur does not and will not sell your Personal Data.
Please note, however, that SAP Concur can or will delete your Personal Data only if there is no statutory obligation or prevailing right of SAP Concur to retain it. Kindly note further that if you request that SAP Concur deletes your Personal Data, you will not be able to continue to use any SAP Concur services that require SAP Concur’s use of your Personal Data.
Please direct any requests to exercise your rights to Privacy-Request@Concur.com or, if you are located in the State of California. SAP Concur will consider your request under applicable law and verify any relevant legal requirements and exemptions. You can also designate another person to submit requests to exercise your data protection rights to SAP Concur. You can give authorization to such person by granting them a limited power of attorney to exercise your data protection rights on your behalf.
SAP Concur will decline to process requests that are manifestly unfounded, excessive, fraudulent, or are not otherwise required by local law.
How will SAP Concur verify requests to exercise data protection rights?
SAP Concur will take steps to ensure that it verifies your identity to a reasonable degree of certainty before it will process the data protection right you want to exercise. When feasible, SAP Concur will match Personal Data provided by you in submitting a request to exercise your rights with information already maintained by SAP Concur. This could include matching two or more data points you provide when you submit a request with two or more data points that are already maintained by us.
For requests from individuals within the State of California, in accordance with the verification process set forth in the CCPA, SAP Concur will require a more stringent verification process for deletion requests, or for Personal Data that is considered sensitive or valuable, to minimize the harm that might be posed to you by unauthorized access or deletion of your Personal Data. If SAP Concur must request additional information from you outside of information that is already maintained by SAP Concur, SAP Concur will only use it for the purposes of verifying your identity so you can exercise your data protection rights, or for security and fraud-prevention purposes.
We may update this Privacy Statement from time to time without notice to you other than posting the revised Privacy Statement on the Channels or by providing such notice about or obtaining consent to changes as may be required by applicable law. If we change our Privacy Statement, we will post those changes to this Privacy Statement and change the "last updated" date above. We encourage you to periodically review this Privacy Statement for the latest information on our privacy practices.
Notwithstanding the right you may have to lodge a complaint as stated above in “How can you exercise your data protection rights?”, if you have any questions about this Privacy Statement or to file any complaint regarding this Privacy Statement, please contact us at the following address:
Concur Technologies, Inc.
601 – 108th Avenue NE, Suite 1000
Bellevue, WA 98004
Attention: Privacy Manager
Telephone: (888) 883-8411
SAP Concur will investigate and attempt to resolve complaints and disputes regarding the collection, use, and disclosure of Personal Data by referencing the privacy principles stated in this Privacy Statement. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at feedback-form.truste.com/watchdog/request.