Tipalti

Tipalti Services Agreement: Key User Implications

> Important scope limitation: The extract refers to additional schedules, the Data Processing Addendum (DPA), Privacy Policy, Order Forms, and other legal documents. Those materials may contain the most important operational, privacy, fee, security, and liability terms. This overview is based only on the text provided.

1. Data Collection and Usage

Tipalti may process several categories of information:

• Customer Data: Information or documentation supplied by the customer, including Payee Information.
• Payee Information: Payees’ identification, payment, tax, and related information needed to provide the services.
• Registration Information: Personal data collected from payees to register for and use the Payee Portal.
• Usage Data: Automatically collected information such as page visits, features used, visit duration, error logs, performance data, and diagnostic data.
• KYC information: Tipalti may require forms and correspondence about the customer and its affiliates for compliance purposes.
• Payment and financial information: The definitions refer to payment instructions, customer funds, linked bank accounts, transactions, and accounts maintained through Tipalti.

When acting as a Processor, Tipalti processes personal data for the customer under the DPA. When processing data for its own legal obligations, Tipalti and the customer are separate Controllers. Tipalti’s controller activities are governed by its separate Privacy Policy.

Practical risk: The Agreement itself does not explain retention periods, security measures, international transfers, breach procedures, or the precise purposes for controller processing. These must be reviewed in the DPA and Privacy Policy.

2. User Rights

The extract does not set out a detailed list of individual privacy rights or a process for exercising them. Rights may arise under applicable law, including the GDPR and California privacy laws, and should be described in the DPA or Privacy Policy.

Depending on the applicable law and the person’s location, rights may include access, correction, deletion, restriction or objection to processing, data portability, and withdrawal of consent. However, the Agreement does not confirm which rights apply, how requests are submitted, or how Tipalti and the customer divide responsibility for responding.

The customer, as Controller for customer-directed processing, is likely responsible for ensuring it has a lawful basis and appropriate notices for the data it submits, particularly payee and tax information.

3. Third-Party Sharing

The Agreement contemplates sharing or processing by:

• Tipalti affiliates;
• Banks and financial institutions holding customer funds;
• Payment and money-transmission providers;
• Payees and suppliers through the Payee Portal;
• Service providers or other parties used to operate the Services; and
• Government, regulatory, or law-enforcement authorities where legally required.

The extract does not provide a complete list of third parties, categories of subprocessors, locations, or opt-out rights. The DPA and Privacy Policy should be checked for subprocessor disclosures and international data-transfer terms.

4. AI/ML Training

There is no express statement in this extract saying whether Customer Data, Payee Information, Registration Information, or Usage Data is used to train artificial-intelligence or machine-learning models.

The definition of Usage Data is broad and includes performance and diagnostic information, but it does not authorize AI training by itself. Users should look for a specific provision in the Privacy Policy, DPA, product schedules, or Order Form addressing model training, analytics, de-identification, or aggregated data.

5. Key Customer Obligations and Restrictions

The customer must:

• Provide accurate information and payment instructions;
• Supply required KYC and compliance information;
• Use the Services in accordance with the Agreement, applicable law, and relevant schedules;
• Ensure Customer Users are authorized to use the Services;
• Handle payee information lawfully and provide required privacy notices or consents; and
• Pay applicable subscription, transaction, and other fees.

The Agreement defines Beta Services, suggesting that separate schedules may impose additional restrictions or disclaimers. The extract does not include detailed prohibited-use rules, security obligations, suspension rights, or service-level commitments.

6. Liability and Disputes

Disputes are generally subject to:

• Binding arbitration, in English, with one arbitrator;
• The arbitration rules and venue determined by the customer’s domicile;
• A waiver of the right to a jury trial;
• Court proceedings only where arbitration is unavailable or unenforceable, in the specified venue; and
• Confidentiality of the arbitration process where legally permitted.

Courts may still be used for injunctive or equitable relief. Arbitration may limit appeal rights and can make collective or jury proceedings unavailable, although the extract does not expressly address class actions.

The provided text refers to limitations of liability but does not include them. Those provisions may substantially restrict recovery, including for indirect damages, lost profits, data loss, or service interruptions. Review the omitted sections and applicable schedules carefully.

7. Changes to the Agreement

Tipalti may amend the Agreement by posting a revised version online. Changes generally become effective when posted. If a revision is a “Substantial Change”—one imposing material additional obligations or removing material customer rights—Tipalti must provide 30 calendar days’ prior notice.

Notices may be sent to the customer’s listed physical address, an administrator’s email address, or through the Service for administrative or fee matters. Customers should keep contact details current and monitor the website, email, and dashboard.