Privacy Policy
1. Introduction
This Supplier Privacy Statement explains how Gopaddi collect, use, disclose, and protect information relating to Suppliers and their authorised users when they access, register on,
or integrate with our websites, websites, mobile applications, dashboards, APIs, features, functionalities, and integrated services in our travel, tourism, hotel, restaurant, nightlife, and events verticals (collectively, the “Operating System” or “OS”).
The OS also includes Workspace Management and, within it, Expense Management (together, the “Workspace”). Expense Management is the set of business tools through which corporate customers manage employee travel and
expense requests, cash advances, reimbursements, corporate and virtual card transactions, retirements, vendor payments, invoices, budgets, approvals, controls and audits, including the integrations that connect the Workspace to
a corporate customer’s own systems, such as enterprise resource planning (ERP), human resources, banking and document management systems.
expense requests, cash advances, reimbursements, corporate and virtual card transactions, retirements, vendor payments, invoices, budgets, approvals, controls and audits, including the integrations that connect the Workspace to
a corporate customer’s own systems, such as enterprise resource planning (ERP), human resources, banking and document management systems.
Suppliers and their authorised users can use the Workspace through the Gopaddi web app and the Gopaddi mobile app. Clause 3.7 explains what these apps collect and how we handle it.
This Privacy Statement applies to hotels, vacation rental operators, travel agencies, restaurants, nightlife venues, event organizers, tour operators, destination management companies, attractions, hospitality providers, and other suppliers that offer products or services through the marketplace on our OS.
It also applies to vendors, contractors, service providers, merchants and other businesses that supply goods or services to a corporate customer and whose information is processed through the Workspace, whether or not they
offer services through our marketplace. This includes Suppliers that are paid through the Workspace, that issue invoices or receipts submitted in the Workspace, or that appear as the merchant on an employee expense claim or card transaction.
offer services through our marketplace. This includes Suppliers that are paid through the Workspace, that issue invoices or receipts submitted in the Workspace, or that appear as the merchant on an employee expense claim or card transaction.
For purposes of this Privacy Statement, "Supplier" includes the Supplier entity and its owners, directors, officers, employees, contractors, agents, authorized users, and representatives.
By accessing or using the OS, you acknowledge that you have read and understood this Privacy Statement.
Unless otherwise defined herein, capitalized terms shall have the meanings assigned to them in the applicable Master Services Agreement, Terms of Use, or other governing agreement.
2. Scope and Application
This Privacy Policies applies in various situation including when a Supplier:
- Creates or manages an account on the OS;
- Lists, promotes, distributes, markets, or sells products and services through the OS;
- Receives bookings, reservations, orders, requests, or inquiries through the OS;
- Integrates systems, applications, APIs, or booking platforms with the OS;
- Communicates with customers, travelers, guests, diners, attendees, corporate customers, or Company personnel through the OS;
- Participates in marketing, loyalty, advertising, co-branding, analytics, or partnership programs offered through the OS; or
- Uses supplier management, inventory management, payment, settlement, reporting,
- Is onboarded as a vendor by a corporate customer in the Workspace, or appears in a corporate customer’s vendor master data that is synchronised with the Workspace;
- Submits, or is named on, a quotation, purchase order, invoice, receipt, hotel folio, ticket or other document processed in the Workspace;
- Is paid, or is the subject of a payment request, vendor payment, advance or reimbursement processed through the Workspace; or
- Is the merchant on a corporate or virtual card transaction received into the Workspace from a card issuer or bank.
This Privacy Statement applies to personal information processed by the Company in its capacity as a controller, business, or equivalent role under applicable privacy laws.
Where Suppliers receive, access, or process personal information relating to travelers, guests, diners, attendees, customers, or corporate users through the OS, the parties' respective privacy obligations may be governed by applicable Supplier Agreements, Data Processing Agreements, Booking Terms, and applicable law.
3. Information You Provide
3.1. We collect information relating to Suppliers, your authorised users, operations and transactions conducted through the OS.
3.2. Supplier Business Information
3.2.1. We collect information your organization and business operations such as:
- Business legal name
- Trade names and brands
- Business registration numbers
- Tax registration details
- Business addresses
- Website URLs and social media accounts
- Industry certifications and accreditations
- Business licenses, permits, approvals, and registrations
- Hotel, restaurant, venue, attraction, transportation, tourism, event, travel or other service information
- Inventory, availability, and allocation information
- Menus, itineraries, schedules, packages, experiences, and service description
- Pricing details
- Reservation, booking, and fulfillment information
- Marketing materials
- Photographs, videos, logos, and promotional content
- Business performance and operational metric
3.3. Personal Information of Supplier Representative
We collect personal information relating to individuals acting on behalf of a Supplier.
3.3.1. Identity and Contact Information
• Full name
• Job title
• Business email address
• Telephone number
• Business contact information
• Profile photographs
• Usernames and authentication credentials.
3.3.2. Verification Information
• Government-issued identification documents
• Beneficial ownership information
• Results of sanctions, politically exposed person and watch-list screening carried out at a corporate customer’s request or to meet legal obligations
3.4. Financial and Settlement Information
3.4.1. We collect financial and payment-related information necessary to facilitate transactions and settlements. Such information may include:
• Bank account details
• Payment authorisation mandate
• Invoice and billing information
• Transaction histories
• Financial institution information.
• Tax identification numbers, VAT and withholding tax details applied to invoices and payments
• Payment terms, remittance advice and payment status
• A history of changes to bank account details, including who made the change and when
3.4.2. Financial and settlement information may constitute personal information where it relates to an identified or identifiable individual, including sole proprietors, beneficial owners, authorized signatories, employees, contractors, or Supplier representatives.
3.4.3. Regardless of whether such information constitutes personal information under applicable law, Gopaddi treats Supplier banking and settlement information as highly confidential financial information and applies appropriate technical, organizational, and administrative safeguards to protect it.
3.5. Customer and Guest Information Processed Through the OS
3.5.1. In connection with travel arrangements, hospitality services, tourism activities, reservations, orders, bookings, dining, nightlife experiences, events, and other related services, Suppliers may receive, access, or process personal information relating to travelers, guests, diners, attendees, customers, and corporate users through the OS. This information may include:
• Names
• Contact information
• Reservation and booking information
• Travel itineraries
• Accommodation details
• Dining preferences
• Loyalty program information
• Event attendance information
• Customer support interactions
• Service preferences and special requests.
We collect personal information relating to individuals acting on behalf of a Supplier.
3.3.1. Identity and Contact Information
• Full name
• Job title
• Business email address
• Telephone number
• Business contact information
• Profile photographs
• Usernames and authentication credentials.
3.3.2. Verification Information
• Government-issued identification documents
• Beneficial ownership information
• Results of sanctions, politically exposed person and watch-list screening carried out at a corporate customer’s request or to meet legal obligations
3.4. Financial and Settlement Information
3.4.1. We collect financial and payment-related information necessary to facilitate transactions and settlements. Such information may include:
• Bank account details
• Payment authorisation mandate
• Invoice and billing information
• Transaction histories
• Financial institution information.
• Tax identification numbers, VAT and withholding tax details applied to invoices and payments
• Payment terms, remittance advice and payment status
• A history of changes to bank account details, including who made the change and when
3.4.2. Financial and settlement information may constitute personal information where it relates to an identified or identifiable individual, including sole proprietors, beneficial owners, authorized signatories, employees, contractors, or Supplier representatives.
3.4.3. Regardless of whether such information constitutes personal information under applicable law, Gopaddi treats Supplier banking and settlement information as highly confidential financial information and applies appropriate technical, organizational, and administrative safeguards to protect it.
3.5. Customer and Guest Information Processed Through the OS
3.5.1. In connection with travel arrangements, hospitality services, tourism activities, reservations, orders, bookings, dining, nightlife experiences, events, and other related services, Suppliers may receive, access, or process personal information relating to travelers, guests, diners, attendees, customers, and corporate users through the OS. This information may include:
• Names
• Contact information
• Reservation and booking information
• Travel itineraries
• Accommodation details
• Dining preferences
• Loyalty program information
• Event attendance information
• Customer support interactions
• Service preferences and special requests.
3.5.2. Depending on the circumstances and applicable agreements, the Company and Supplier may act as independent controllers, joint controllers, or controller and processor with respect to such information.
3.6. Information Processed Through Workspace Management and Expense Management
3.6.1. When a corporate customer uses the Workspace, the following information about Suppliers may be entered by the corporate customer or its employees, provided by you, extracted from documents, or received from the corporate customer’s systems:
3.6.1.1. Vendor Master Information
• Vendor name, vendor number and vendor category
• Tax identification and registration numbers
• Business address and contact person details
• Bank account details and payment terms
• Onboarding, approval and blocked status, and the date of the last change
3.6.1.2. Invoice, Receipt and Document Information
• Quotations, purchase orders, contracts, invoices, credit notes, receipts, hotel folios, tickets, boarding passes and goods received notes
• Invoice numbers, dates, line items, quantities, amounts, currencies and taxes
• Images and files of these documents, and the data read from them by optical character recognition (OCR)
3.6.1.3. Transaction and Card Information
• Payment requests, vendor payments, advances, reimbursements and retirements that name or pay the Supplier
• Approval history, payment status and settlement references
• Corporate and virtual card transaction data received from card issuers or banks, such as merchant name, merchant category code (MCC), amount, currency, date, time and location
3.6.1.4. Control, Audit and Risk Information
• Results of policy checks applied by the corporate customer, such as warnings, holds and exception approvals
• Duplicate and fraud indicators, for example a receipt or invoice that matches an earlier submission, a split transaction, an altered receipt, or a recent change to bank details
• Pre-payment audit findings, queries and their resolution
• An audit trail of who viewed, created, changed, approved or paid each record and when
3.6.2. Supplier information processed in the Workspace is visible only to the corporate customer that holds it and to the Gopaddi personnel and sub-processors who need it to provide the service. It is not shared with other corporate customers or used to market to you.
3.7. Information Collected by the Gopaddi Mobile and Web Apps
3.7.1. When you or your team members use the Workspace through the Gopaddi mobile app or web app, the apps collect the information below. All of it is linked to the Workspace of the organisation you use the app for: your employer or the Supplier you act for, or the corporate customer that invited you. That organisation decides how the information is used, as explained in clause 2.1.
3.7.1.1. Account Information
• Name, email address and user ID, used to sign you in, show who created, submitted or approved a record, and contact you about your account.
3.7.1.2. Device ID and Push Token
• A device ID and push notification token, used only to send Workspace notifications to your device, for example when an invoice is queried, a document is requested or a payment is released.
• The push token is deleted when you sign out of the app, turn off its notifications, or your access ends.
3.7.1.3. Receipts, Documents and Financial Information
• Photos of receipts and invoices, and other documents you upload.
3.6. Information Processed Through Workspace Management and Expense Management
3.6.1. When a corporate customer uses the Workspace, the following information about Suppliers may be entered by the corporate customer or its employees, provided by you, extracted from documents, or received from the corporate customer’s systems:
3.6.1.1. Vendor Master Information
• Vendor name, vendor number and vendor category
• Tax identification and registration numbers
• Business address and contact person details
• Bank account details and payment terms
• Onboarding, approval and blocked status, and the date of the last change
3.6.1.2. Invoice, Receipt and Document Information
• Quotations, purchase orders, contracts, invoices, credit notes, receipts, hotel folios, tickets, boarding passes and goods received notes
• Invoice numbers, dates, line items, quantities, amounts, currencies and taxes
• Images and files of these documents, and the data read from them by optical character recognition (OCR)
3.6.1.3. Transaction and Card Information
• Payment requests, vendor payments, advances, reimbursements and retirements that name or pay the Supplier
• Approval history, payment status and settlement references
• Corporate and virtual card transaction data received from card issuers or banks, such as merchant name, merchant category code (MCC), amount, currency, date, time and location
3.6.1.4. Control, Audit and Risk Information
• Results of policy checks applied by the corporate customer, such as warnings, holds and exception approvals
• Duplicate and fraud indicators, for example a receipt or invoice that matches an earlier submission, a split transaction, an altered receipt, or a recent change to bank details
• Pre-payment audit findings, queries and their resolution
• An audit trail of who viewed, created, changed, approved or paid each record and when
3.6.2. Supplier information processed in the Workspace is visible only to the corporate customer that holds it and to the Gopaddi personnel and sub-processors who need it to provide the service. It is not shared with other corporate customers or used to market to you.
3.7. Information Collected by the Gopaddi Mobile and Web Apps
3.7.1. When you or your team members use the Workspace through the Gopaddi mobile app or web app, the apps collect the information below. All of it is linked to the Workspace of the organisation you use the app for: your employer or the Supplier you act for, or the corporate customer that invited you. That organisation decides how the information is used, as explained in clause 2.1.
3.7.1.1. Account Information
• Name, email address and user ID, used to sign you in, show who created, submitted or approved a record, and contact you about your account.
3.7.1.2. Device ID and Push Token
• A device ID and push notification token, used only to send Workspace notifications to your device, for example when an invoice is queried, a document is requested or a payment is released.
• The push token is deleted when you sign out of the app, turn off its notifications, or your access ends.
3.7.1.3. Receipts, Documents and Financial Information
• Photos of receipts and invoices, and other documents you upload.
• Expense, invoice, payment and other financial information you enter or that is read from your documents, as described in clause 3.6.
• This information is stored in the Workspace of the organisation it belongs to, kept separate from other organisations’ information, and visible only as described in clause 3.6.2.
3.7.2. Face ID and Touch ID. If you choose to unlock the mobile app with Face ID, Touch ID or your device’s fingerprint or face unlock, the check is carried out on your phone only, by your phone’s own operating system. Your face or fingerprint data is never sent to Gopaddi, a corporate customer or anyone else, and is never stored by the app. The app only receives a result showing whether the check passed.
3.7.3. No tracking or advertising. Information collected through the Gopaddi mobile and web apps for the Workspace is not used to track you across other companies’ apps or websites, and is not used for advertising. We do not share it with advertising or social media partners, advertisers or data brokers.
3.7.4. Deletion. You can ask for your account or this information to be deleted through your organisation’s Workspace administrator or by contacting us, as explained in clause 14.
• This information is stored in the Workspace of the organisation it belongs to, kept separate from other organisations’ information, and visible only as described in clause 3.6.2.
3.7.2. Face ID and Touch ID. If you choose to unlock the mobile app with Face ID, Touch ID or your device’s fingerprint or face unlock, the check is carried out on your phone only, by your phone’s own operating system. Your face or fingerprint data is never sent to Gopaddi, a corporate customer or anyone else, and is never stored by the app. The app only receives a result showing whether the check passed.
3.7.3. No tracking or advertising. Information collected through the Gopaddi mobile and web apps for the Workspace is not used to track you across other companies’ apps or websites, and is not used for advertising. We do not share it with advertising or social media partners, advertisers or data brokers.
3.7.4. Deletion. You can ask for your account or this information to be deleted through your organisation’s Workspace administrator or by contacting us, as explained in clause 14.
4. Information we collect Automatically
When Suppliers access or use the OS, we may automatically collect:
Device and Technical Data
• IP address, device type, app version, device identifiers, crash logs, browser type and settings, and operating system.• Push notification tokens for the Gopaddi mobile app, used only to send you Workspace notifications as described in clause 3.7.
• Pages viewed, search queries, timestamps, features used, referral URLs, and session data.
Location Data
• Approximate location (for example, region or city derived from IP address) and exact location where you enable device permissions.
Cookies and Tracking Technologies
• Data collected via cookies, pixels, SDKs, and similar technologies (see our Cookies Policy).
Cookies and Tracking Technologies
• Data collected via cookies, pixels, SDKs, and similar technologies (see our Cookies Policy).
• Data collected via cookies, pixels, SDKs, and similar technologies (see our Cookies Policy).
5. Information Obtained from Third Parties
We may obtain information from:
• Payment processors and financial institutions• Social media platforms.• Travel partners, event organizers, and other Suppliers.• Advertising and analytics partners.• Identity verification providers.• Government agencies and public registries.• Travel and hospitality partners.
• Corporate customers.
• Corporate customers’ ERP, procurement, human resources and document management systems connected to the Workspace (for example vendor master data, cost centres and posting confirmations).
• Card issuers and banks that send corporate and virtual card transaction feeds to the Workspace.
• Sanctions and watch-list screening providers, where a corporate customer has enabled screening.
6. How We Use Information
We use Supplier information for the following purpose
Supplier Onboarding and Relationship Management
• Creating and managing Supplier accounts.• Verifying identities and business legitimacy.• Conducting due diligence and compliance reviews.• Managing Supplier relationships.• Providing training and support.
Booking, Reservation, and Service Fulfillment
• Facilitating reservations, bookings, purchases, and transactions.• Managing inventory and availability.• Coordinating customer, traveler, guest, diner, and attendee services.• Managing cancellations, modifications, refunds, and disputes.
Payment and Financial Operations
• Processing settlements and payouts.• Managing invoices and reconciliations.• Preventing fraud and financial abuse.
Expense Management and Corporate Spend Controls (on behalf of corporate customers)
• Recording Suppliers as vendors and keeping vendor details in line with the corporate customer’s vendor master.
• Matching invoices, receipts and card transactions to employee requests, purchase orders and budgets.
• Applying the corporate customer’s expense policies, approval rules, approval limits and budget checks.
• Checking for duplicate or altered documents, split transactions, unusual amounts and recent bank-detail changes before payment.
• Supporting verification, pre-payment audit, payment release and reconciliation by the corporate customer.
• Sending approved postings and payment information to the corporate customer’s ERP and banking systems.
• Producing reports and audit trails for the corporate customer, its internal control and audit teams, and its external auditors.
• Recording Suppliers as vendors and keeping vendor details in line with the corporate customer’s vendor master.
• Matching invoices, receipts and card transactions to employee requests, purchase orders and budgets.
• Applying the corporate customer’s expense policies, approval rules, approval limits and budget checks.
• Checking for duplicate or altered documents, split transactions, unusual amounts and recent bank-detail changes before payment.
• Supporting verification, pre-payment audit, payment release and reconciliation by the corporate customer.
• Sending approved postings and payment information to the corporate customer’s ERP and banking systems.
• Producing reports and audit trails for the corporate customer, its internal control and audit teams, and its external auditors.
Platform Operations and Improvement
• Operating, maintaining, securing, and improving the OS.• Monitoring performance and reliability.• Developing new products and services.• Conducting analytics and business intelligence activities.
Communications
• Sending operational notices and service communications.• Providing customer support.• Delivering account management services.• Sending product updates and training materials.• Providing marketing communications where permitted by law.
Safety, Trust, Security, and Compliance
• Preventing fraud, abuse, and misuse of the OS.• Conducting investigations.• Enforcing agreements and platform policies.• Protecting customers, Suppliers, and the Company• Complying with legal and regulatory obligations.
7. Legal Bases for Processing
Depending on your jurisdiction, we process personal data based on one or more of the following legal bases:
• Consent (for example, marketing, cookies, precise location, sensitive data).• Contract (to provide bookings and facilitate services on the OS).• Legitimate Interests (for example, security, service improvement, analytics).• Legal Obligations.
For information processed in the Workspace on behalf of a corporate customer, the corporate customer is responsible for establishing its own legal basis. Gopaddi processes that information on the corporate customer’s instructions, which it relies on as part of its contract with the corporate customer.
8. Sharing and Disclosure of Personal Information
We may share personal information with:
8.1. Personal Users
• Individual end-customer using the OS to discover, book, purchase, or consume Supplier Services.
8.2. Third Party Service Providers
• Payment processors, cloud hosting, fraud prevention, analytics, customer support, and IT vendors under contractual confidentiality obligations.
8.3. Advertising and Social Media Partners
• For advertising measurement, attribution, and targeted advertising (subject to consent and local law).
• Information processed in the Workspace is never shared with advertising or social media partners.
8.4. Affiliates and Corporate Group
• Our affiliates and subsidiaries for internal business operations and support.
8.5. Legal and Regulatory Authorities
• Where required by law, court directive, or to protect rights, safety, and security.
8.6. Corporate Customers and Their Connected Systems
• The corporate customer whose Workspace holds your information, and its authorised users, such as requesters, approvers, finance, treasury, internal control and audit staff.
• Systems the corporate customer connects to the Workspace, such as its ERP, human resources, banking and document management systems.
• The corporate customer’s external auditors, tax authorities and regulators, where the corporate customer is required or chooses to share records with them.
8.7. Banks, Card Issuers and Payment Partners
• Banks, card issuers and payment partners that send card transaction data to the Workspace or carry out payments released by a corporate customer.
9. Artificial Intelligence and Automated Technologies
We look for opportunities to innovate and improve your experience on the OS by leveraging technologies such as artificial intelligence (AI) systems. We use AI on the OS in various ways such as:
• Enhance inventory and availability management.
• Detect fraud and suspicious activity.
• Support customer service and communications.
• Generate analytics and business insights.
• Improve operational efficiency and platform functionality.
• Read invoices, receipts and other documents submitted in the Workspace and suggest expense categories.
• Flag possible duplicates, altered documents, split transactions and other unusual patterns for review.
In the Workspace, AI and automated checks raise flags and may place a payment on hold, but they do not by themselves reject a Supplier or refuse a payment. Those decisions are taken by authorised personnel of the corporate customer, who can review the information behind each flag.
We assess our AI systems against data protection principles such as data minimization, accuracy and purpose limitation.
11. Data Retention
We retain personal information:
• while your account is active;
• for 1 year after account inactivity or termination for legal, tax, and regulatory purposes; and
• for longer where required for dispute resolution, fraud prevention, or legal compliance.
Information processed in the Workspace on behalf of a corporate customer is kept for the period the corporate customer instructs under its agreement with Gopaddi. Invoices, payment records and audit trails are often subject to tax, accounting and audit record-keeping laws that require them to be kept for several years, which may be longer than the periods above. When the corporate customer's agreement ends, we return or delete its Workspace information as that agreement requires.
We anonymize or delete data when it is no longer required.
12. Security
We implement industry-standard security measures, including encryption in transit and at rest, access controls, monitoring, and incident response procedures. We also ensure that staff are alerted to security risks through continuous training.
In the Workspace, access is limited by role, so each corporate customer user sees only the Supplier information their job requires. Changes to bank details and payment releases require separate people to make and approve them, and every change is recorded in an audit trail.
In addition, we recommend that you:
• create account and protect account using a strong password as well two-factor authentication mechanism where applicable.
• avoid using same password across multiple online services
• read articles we may make available to you on online fraud prevention and data protection.
• tell the corporate customer you supply straight away if you did not request a change to your bank details, as this is a common sign of payment fraud.
• lock the Gopaddi mobile app with Face ID, Touch ID or your device passcode, and sign out of the app on any device you no longer use.
13. International Data Transfers
Your personal data may be accessed from, processed or transferred to countries other than your country residence. These countries may have different data protection laws from your country of residence. Data transfer in these instances is necessary for you to maximally use the services in the OS, and for other purposes stated in this Privacy Statement.
We have Suppliers, other third-party providers and Gopaddi Group companies located in United States, Nigeria and other parts of the world. Your data may be processed in any of those countries. Similarly, our employees may access your personal data from various countries around the world.
Workspace information may also be transferred to the countries where a corporate customer hosts its own connected systems, and through the integration services listed in the Data Privacy Addendum. Gopaddi has put in place necessary safeguards and taken appropriate to ensure that a
Gopaddi has put in place necessary safeguards and taken appropriate to ensure that any access, processing and/or transfer of your personal data is protected in compliance with the relevant data protection law.
14. Your Privacy Rights
Depending on your jurisdiction, you may have the right to:
• Access your personal information
• Correct/rectify inaccurate information
• Delete/erase information (subject to legal/contractual limits)
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Data portability (receive a copy in a usable format)
• Opt out of certain processing such as targeted advertising (where applicable)
Requests can be made via email or in-app privacy controls.
Where your information is held in a corporate customer's Workspace, please send your request to that corporate customer, as it decides how the information is used. If you send the request to us, we will pass it to the corporate customer and help it respond. Some Workspace records, such as invoices and payment records, may need to be kept to meet tax and audit laws even after a deletion request.
Deleting your account or your data. You can ask for your Workspace account, or the information held about you, to be deleted in either of two ways:
• Through your organisation: ask the administrator of the Workspace you use (your own organisation's account administrator, or the corporate customer that invited you), who can remove your access and your account.
• By contacting us: email security@gopaddi.com from the email address linked to your account, naming the organisation whose Workspace you use. Where a corporate customer holds the information, we will pass your request to it and carry out the deletion once it confirms.
When your account is deleted, you can no longer sign in, and we delete your device ID, push token and any profile details that retained records do not need. Invoices, payment records and audit trails that a corporate customer or Gopaddi must keep by law are kept for the periods in clause 11 and then deleted. Uninstalling the mobile app does not delete your account.
15. Children
The OS is not intended for children under 18 (depending on jurisdiction). We do not knowingly collect personal data from children without parental consent.
In limited circumstances we may need to collect from parents or guardians the personal data of minors for the purpose:
• a reservation• the purchase of other travel-related services• In other exceptional circumstances (e.g. features addressed to families).
If we become aware (for example, through a Customer Support request) that we’ve processed personal data about minors without the valid consent of their parent or guardian where required, we will delete it.
16. Third-Party Links and Services
The OS may link to third-party services or websites. We are not responsible for their privacy practices.
17. Updates to This Privacy Policy
This Privacy Policy may be reviewed from time to time. Where updates are made, it will be communicated to you through the OS or by email.
18. Contact Us
If you have any concerns about your personal data, please email the Data Protection Officer (DPO) at security@gopaddi.com
Effective: January 23, 2026
Updated: October 19, 2026
Data Privacy Addendum
- Cloud Infrastructure Provider (AWS): Cloud Infrastructure & Hosting
We use Amazon Web Services (AWS) to host our application infrastructure, databases, storage, networking, logging, and backup systems. AWS processes personal data solely to provide secure, scalable, and reliable cloud infrastructure services
2. Payment Gateway Provider: Payment Processing
Our payment gateway processes financial transactions, including payments, refunds, and recurring billing. Sensitive payment information (e.g., card numbers) is processed directly by the payment provider and is never stored or processed by us.
3. AI Platform Provider: AI & Automation Services
We use LLMs (i.e Gemini) to provide automation, analytics, personalization, and intelligent features such as recommendations, anomaly detection, and operational insights.
4. Integration Platform Provider (SAP Business Technology Platform): ERP Integration
Where a corporate customer connects its SAP systems to the Workspace, we use SAP Integration Suite on SAP Business Technology Platform to move Workspace information, such as vendor master data, cost centres, postings and payment status, between the OS and the corporate customer's SAP and SuccessFactors systems. SAP processes this information only to provide the integration service.
5. Document Processing (OCR): Invoice and Receipt Reading
Images of invoices, receipts and other documents submitted in the Workspace are processed to read their text and amounts. [Name the OCR provider, or state that this runs within our AWS environment.]
6. Card Issuers and Banks: Card Transaction Feeds
Where a corporate customer enables it, its card-issuing bank sends corporate and virtual card transaction data to the Workspace so it can be matched to expense requests.
7. Push Notification Services: Mobile App Notifications
We use push notification services to deliver Workspace notifications to the Gopaddi mobile app. They receive only the device's push token and the notification text, and use them only to deliver the notification. [Name the providers, for example Apple Push Notification service and Firebase Cloud Messaging.]
8. GDPR Compliance Statement
All Subprocessors:
• Are engaged under written agreements containing GDPR-compliant data protection obligations
• Process personal data only on documented instructions from us
• Implement appropriate technical and organizational security measures
• Support data subject rights (access, deletion, rectification, portability)
• Are subject to ongoing vendor risk and compliance assessments
We may update our list of Sub processors from time to time to support business operations