Data Processing Terms

Version 1.0 · Last updated: 22 October 2026

These Data Processing Terms (“DPA”) form part of the agreement between ExpenC (“ExpenC”, “we”, “us”) and the organisation that uses the ExpenC service (the “Customer”, “you”). They apply whenever we process personal data on your behalf, and they meet the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act 2018.

You accept these terms when you set up your organisation's ExpenC account, or by signing an order or quote that refers to them. If they conflict with any other agreement between us on data protection, these terms apply.

1. Definitions

“Personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in the GDPR. The “Service” means the ExpenC web app, mobile apps and related support. “Customer personal data” means personal data we process on your behalf through the Service.

2. Roles

• You are the controller of customer personal data, and we are your processor.
• You are responsible for having a lawful basis for the processing, for telling your staff how their data is used (our Privacy Policy can help), and for making sure your instructions to us comply with data protection law.

3. Your instructions

• We process customer personal data only on your documented instructions. These terms, our agreement with you, and the way your administrators use the Service (for example inviting staff, approving claims, exporting, archiving or deleting data) are your instructions.
• If EU or Irish law requires us to process the data in another way, we will tell you first, unless that law forbids it.
• We will tell you straight away if we believe an instruction breaks data protection law.

4. What we process

The subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects are described in Annex A.

5. Confidentiality

Everyone at ExpenC who can access customer personal data is bound by a duty of confidentiality, and access is limited to the people who need it to run and support the Service.

6. Security

We take the technical and organisational measures required by Article 32 GDPR, described in Annex B. We may update them over time, as long as the overall level of protection does not go down.

7. Sub-processors

• You give us general authorisation to use the sub-processors listed in Annex C.
• We will tell you at least 14 days before we add or replace a sub-processor. You may object on reasonable data protection grounds; if we cannot resolve your objection, you may end the agreement before the change takes effect.
• We bind each sub-processor by written contract to data protection obligations at least as protective as these terms, and we remain responsible to you for their work.

8. Transfers outside the EU

Customer personal data is stored in the European Union (Ireland). It is transferred outside the European Economic Area only in line with Chapter V of the GDPR. The one current transfer, receipt scanning by Anthropic in the USA (see Annex C), is covered by the European Commission's Standard Contractual Clauses.

9. Helping you meet your obligations

• Data subject requests. Your administrators can view and correct staff data in the Service. We will help you answer requests to access, correct, erase, restrict or receive a copy of personal data, within the time limits the GDPR sets. If a person contacts us directly about customer personal data, we will pass the request to you and will not answer it ourselves, except to tell them we have done so.
• Other obligations. Taking into account the information available to us, we will help you with security, breach notifications, data protection impact assessments and any prior consultation with a supervisory authority.

10. Personal data breaches

If we become aware of a personal data breach affecting customer personal data, we will notify you without undue delay, and in any event within 72 hours. We will tell you, as far as we know at the time, what happened, the categories and approximate number of people and records affected, the likely consequences, and what we have done or propose to do. We will update you as we learn more and will help you meet your own notification duties.

11. Keeping, returning and deleting data

• Receipts are kept for 12 months. Before they are deleted, your administrators are offered a full archive (claim details and receipt files) and have at least 30 days to download it.
• Claim details (dates, amounts and descriptions) are kept for as long as the agreement continues, so your reports keep working.
• When the agreement ends, you can export your data until your access ends. We then delete all customer personal data within 30 days, and remove it from backup copies within 90 days, unless EU or Irish law requires us to keep it.
• You are responsible for keeping any records you must retain yourself, including expense records you must keep for six years under section 886 of the Taxes Consolidation Act 1997. The archive and exports in the Service are how we return your data to you.

12. Audits and information

We will give you the information reasonably needed to show that we comply with these terms, such as our Security page and answers to your security questionnaires. If that is not enough, you or an independent auditor bound by confidentiality may audit our compliance, on at least 30 days' written notice, during business hours, no more than once a year (unless after a personal data breach or at a supervisory authority's request), and at your own cost. An audit must not give access to other customers' data.

13. Liability

Each party's liability under these terms is subject to any limits agreed between us.

14. Duration

These terms apply for as long as we process customer personal data, including after the agreement ends until the data is deleted.

15. Changes

We may update these terms to reflect changes in the law, in our sub-processors or in the Service. We will tell your administrators about material changes in advance. Each version is numbered and dated at the top of this page.

16. Governing law

These terms are governed by the laws of Ireland, and the Irish courts have exclusive jurisdiction.

17. Contact

Data protection questions: sales@dikoro.com

Annex A: Description of the processing

Subject matter and nature. Hosting and operating an expense claims service: storing, displaying and transmitting the data below.

Purpose. To let the Customer's staff submit expense and mileage claims with receipts, route them for approval, export approved claims to accounting software (such as Sage), keep records and reports, send notifications about claims, and keep the Service secure.

Duration. For the term of the agreement, then as set out in section 11.

Data subjects. The Customer's employees, managers and administrators who use the Service.

Special categories of data. None are processed on purpose. A description or receipt entered by a user may reveal one by chance (for example a pharmacy receipt).

Annex B: Technical and organisational measures

Annex C: Sub-processors