Imprest provides card infrastructure and employee card services to companies. Running that program means we handle information about the company, the people who administer it, and the employees who receive cards.

This policy describes what we collect, why we collect it, who we share it with, and the choices people have. It applies to the Imprest platform, the APIs, card issuing and settlement carried out with our partners, and this website.

The Imprest entity named in the program agreement is responsible for this policy. If no program agreement names an entity, Imprest as the operator of this website is responsible for information collected through the site.

This policy covers personal information about:

• People who enquire about Imprest, including through this website.
• Administrators, finance users, and other people a company invites onto the platform.
• Owners, directors, and other people we must identify when we verify a company.
• Employees and other people a company asks us to issue a card to.
• People whose details appear on a transaction, a dispute, or a support request.

The company that opens the program decides which employees receive cards and what those employees are told about the program. Imprest does not open a personal account for an employee.

For information a company sends us so we can run its program, the company and Imprest each have duties. In many cases the company decides why an employee is issued a card and what the card may be used for, and Imprest decides how the platform, ledger, and controls operate. Where the law treats one of us as a processor for the other, the program agreement sets out that arrangement, including instructions, security, and assistance with requests from people.

Card issuing, identity checks, and movement of funds may be performed by a regulated partner named in the program agreement. That partner is responsible for the personal information it processes under its own terms and privacy notice.

We do not sell personal information, and we do not use employee spend to build advertising profiles.

Depending on the program, we collect:

• Identity and role details for administrators and signatories, such as name, work email, phone number, and job title.
• Company records we need to know the business, including registration documents, ownership and control, and addresses.
• Cardholder details the company provides so a card can be issued to a named person, such as name, role, delivery address, and the last digits of the card.
• Program activity: authorisations, settlements, merchant, amount, currency, time, card status, limits, and the ledger entries those events create.
• Support and security records, including messages you send us, login events, device and browser data, and API credentials used to call the service.
• Information from identity, sanctions, and fraud-prevention providers when we or a partner must complete checks.

We do not need a card PIN, and we ask companies and employees not to send one. A card network or issuer may handle a PIN under its own rules when a person sets or uses it.

We use personal information to:

• Open and administer the company program, including roles, cards, limits, and funding.
• Authorise, decline, record, and settle payments, and show that activity on the ledger.
• Send webhooks and exports the company has asked for.
• Verify the company and the people connected to it, and monitor for fraud, sanctions exposure, and other financial crime.
• Provide support, investigate errors and disputes, and keep the platform secure.
• Meet legal, regulatory, network, and accounting duties, and establish or defend a legal claim.
• Understand how the service is used, in aggregated or de-identified form, so we can keep it reliable.

We do not use employee transaction data to market other products to those employees.

Where UK or EU data-protection law applies, we rely on one or more of these grounds:

• Contract: the information is needed to provide the program the company has asked for.
• Legal obligation: including checks required by anti-money-laundering, sanctions, and card-network rules.
• Legitimate interests: securing the platform, preventing fraud, improving reliability, and communicating with the people who run the program, where those interests are not overridden by the person’s rights.
• Consent: only where we ask for it separately, for example a non-essential cookie. Consent can be withdrawn.

Other countries impose their own conditions. We apply the requirements that govern the program agreement and the place where the relevant Imprest entity or partner operates.

We share personal information only as needed to run the service:

• The company and the administrators it has authorised, so they can see the cards and the ledger they are responsible for.
• Card issuers, card networks, and payment processors who authorise and settle a payment.
• Banks and other funding partners who receive or return company funds.
• Identity, sanctions, and fraud-prevention providers used for verification and monitoring.
• Infrastructure suppliers who host the platform, deliver email, or provide support tools, under contracts that limit their use of the information.
• Professional advisers, auditors, and insurers where the work requires it.
• Courts, regulators, law enforcement, and card networks when the law or a network rule requires it.
• A buyer or successor of the relevant business, if the program is transferred, and we will tell the company when we do.

An employee’s full spend history is available to the roles the company assigns. It is not shown to other Imprest customers.

Card networks and hosting providers may process information in countries other than the company’s. Where UK or EU law requires a safeguard for a transfer out of that region, we use a lawful mechanism such as an adequacy decision or standard contractual clauses, together with any extra measures those rules require.

The program agreement names the main partners for a company’s program. A company may ask us for a description of the relevant safeguards.

We keep personal information for as long as the program is open and for the period afterwards that the law, card-network rules, or a dispute requires. Financial-crime and accounting records are often kept for at least five years after the relationship ends, and longer where a specific claim or investigation is open.

When a card is cancelled, we keep the ledger entries that card created. We do not delete a transaction record while we are required to hold it. Information we no longer need is deleted or irreversibly de-identified.

We use access controls, encryption in transit, and monitoring designed for a card program. Administrators are required to protect their credentials, and companies are required to remove access when a person leaves. No method of storage or transmission is perfectly secure. A company should tell us at once if it believes an account, card, or API key has been compromised.

Depending on where a person lives, they may have the right to ask for a copy of their personal information, to correct it, to delete it, to restrict or object to certain uses, and to receive information they provided in a portable form. Where processing is based on consent, they may withdraw that consent. They may also complain to a data-protection authority. In the United Kingdom that authority is the Information Commissioner’s Office.

Employees should usually start with their company, because the company decides who receives a card and holds the employment relationship. They may also contact Imprest. We may need to ask the company before we change or delete program records, and we may refuse a request where the law requires us to keep the information, including for financial-crime and accounting duties.

We will not discriminate against a person for exercising a privacy right. We may need to confirm identity before we act on a request.

The contact form on the homepage keeps what you type in your browser so you can review it. Submitting the form does not send the company name, email address, or any other detail to Imprest. If you close the page, that information is not kept by us.

The site may store a strictly necessary cookie or similar technology so the page can function. We do not use advertising cookies on this site. Server logs may record an IP address, the browser type, and the pages requested, and we use those logs to keep the site available and to investigate abuse. Logs are kept only as long as that purpose requires.

We may update this policy when the product, our partners, or the law changes. The effective date at the top of this page will change when we do. If a change materially affects a company program, we will also give notice through the platform or by email, in line with the terms of service.

Questions about this policy, and requests to exercise a privacy right, can be sent to the address in the program agreement or through the contact published on this website. Please say which company the request relates to, so we can find the right records.

Back to Imprest