BILL Supplemental Privacy Notice for European and United Kingdom Residents

Effective Date: January 22, 2024

This Notice supplements the Our Privacy Notice and applies to Our Websites and Services in the European Union (“EU”) and the United Kingdom (“UK”).  

To comply with the requirements of the European General Data Protection Regulation (“GDPR”) for Our EU and UK users, this Supplemental Privacy Notice (“Supplement”) outlines the legal bases on which We rely to process Your personal information and provides other information required by the GDPR.  The terms and conditions contained in this Supplement apply only to the personal information of EU and UK residents We may process.

BILL Operations, LLC is the data controller.  Our representative in the UK is:  

Our representative in the EU is:

Legal Bases for Processing Your Information

BILL will only process Your information where we have a legal basis to do so. The legal basis will depend on the reason(s) BILL collected and needs to use Your personal information.  We describe these legal bases and some accompanying examples in more detail below.  

Consent

BILL processes certain personal information based on Your consent, which You may revoke at any time. For example:

Contractual necessity

BILL processes Your personal information as is necessary for the adequate performance of the contract with You. For example:

• We process Your information to create and manage Your account, process and receive payments, provide customer service, and send You messages, updates, security alerts, and account notifications;
• We process Your information to verify Your identity so that We may provide the Services to You;
• We transfer Your information outside of the EU and the UK to the U.S. and Canada in order to provide the Services.

Legitimate interests

BILL processes Your personal information where it is necessary for Our or a third party’s legitimate interests. For example:

• We process Your information to keep the Services safe and secure, such as to implement and enhance security measures and protections, protect against a breach of the law or fraud, enforce or defend legal rights, claims, or obligations, and enforce our Terms of Service;
• We process Your information to undertake marketing activities and provide You with advertisements both on and off BILL Website , measure and analyze the effectiveness of Our ads, and offer You products or services that may be of interest to You, in accordance with applicable law; 
• We process Your information to provide and improve the Services and Your experience with the Services, and to understand and improve Our business; and
• We share Your information across the BILL Companies to provide You with cohesive and seamless Services.  For example, where the Services require the engagement of other BILL Companies, We share your information with such affiliates to provide and improve the Services.

Legal obligation

BILL processes Your personal information to comply with Our legal obligations. For example:

• We may process, retain, and share Your information if it is necessary to respond, based on applicable law, to a valid legal request; 
• We may process and retain Your information for tax, legal reporting and auditing obligations; and
• We may process, retain and share Your information as is necessary to comply with the legal requirement to which We are subject, for example, anti-money laundering regulations.

Transfers of Personal Information

To facilitate Our global operations, BILL may transfer, store, and process Your information within our corporate family, partners, and service providers, including in the United States and Canada.  Laws in these countries may differ from the laws applicable to Your country of residence.  In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in these other countries may be entitled to access Your personal information.

Where Your information is transferred outside the EEA, We will take all steps reasonably necessary to ensure that Your data is subject to appropriate safeguards, such as relying on a recognized legal adequacy mechanism, and that it is treated securely and in accordance with this Supplement and our Privacy Notice.

We will provide further information on the means to ensure an adequate level of data protection, such as a copy of the EU Model Clauses, on request.  To request a copy, please contact our EU or U.K. data representative.  

How long we keep Your personal information

The period for which We retain Your information varies according to the use of that information. In some cases, there are legal requirements to keep certain data for a minimum period of time. Unless specific legal requirements dictate otherwise, We will retain Your information as long as is necessary to perform the Services, comply with our legal obligations, and as permitted by law. 

Your rights

You may have some of the following rights under applicable law.  While some of these rights apply generally, certain rights apply only in certain limited cases. Please note that We may ask You to verify Your identity and request before taking further action on Your request.  You can contact our EU or U.K. data representative to exercise any of the following rights.  

Data access and portability

If You are unable to obtain the desired information by logging into Your account, or if You are not currently a customer, You can request certain copies of Your personal information held by us.  In certain instances, You also have the right to request copies of personal information that You have provided to us in a structured, commonly used, and machine-readable format and/or request us to transmit this information to another service provider (where technically feasible).

Deletion

If You are unable to delete the desired information by logging into Your account, or if You are not currently a customer, You can request that We delete Your personal information, subject to certain limitations and restrictions.  Please note that if You request the erasure of Your personal information:

• We may retain and use Your personal information as necessary for our legitimate business interests, such as prevention of money laundering, fraud detection and prevention, and enhancing safety;
• We may retain and use Your personal information to the extent necessary to comply with our legal obligations. 
• To the extent another party has received Your personal information in the course of Bill.com providing Services to You, the other party may continue to retain Your information; and
• Copies of Your personal information may not be removed from our backup systems for a period of time.

Rectification

If You are unable to correct the desired information by logging into Your account, You can request that We correct inaccurate or incomplete personal information about You.  

Restriction of processing

You can ask Us to limit the ways in which We use Your personal information.  

Revoke consent

Where the processing of Your personal Information by us is based on consent, You have the right to withdraw that consent without detriment at any time.  If You withdraw Your consent to the use of Your information for the purposes set out in this Supplement and the Privacy Notice, You may not have access to all (or any) of our Services and We might not be able to provide You all (or any) of the Services under this Supplement, Privacy Notice, and our Terms of Service. In certain cases, We may continue to process Your information after You have withdrawn consent if We have a legal basis to do so.  

If You would like to change Your cookie settings, You may do so at any time by clicking here:

‍

Lodging complaints

If Your request or concern is not satisfactorily resolved by Us, You may lodge a complaint with our EU or UK representative or approach Your local data protection authority.