Privacy Policy
Last updated: October 2026
ExpensePlus is committed to protecting the privacy of everyone whose personal data we use. This policy explains what personal data we use for our own purposes, why, who we share it with, and your rights. Items in [square brackets] still need your input.
1. Who we are and what this policy covers
ExpensePlus Ltd (company number 09404009, registered office Headingley Enterprise & Arts Centre, Bennett Road, Leeds, England, LS6 3HN) is the controller of the personal data described in sections 2 to 9 of this policy. This means we decide why and how it is used. Our ICO registration number is ZA475586.
This policy covers personal data about people who ask about, trial or use ExpensePlus on behalf of an organisation; our customers' account, billing and data protection contacts; people who book support or join training sessions or our email list; people who write reviews; people who contact us; and visitors to our website.
Definitions we use in this document
"The Service" means our ExpensePlus software, which is accessed online through a web browser. The Service also includes any files you upload to ExpensePlus
"your Organisation" means the church, charity or other organisation that has opened an ExpensePlus account.
"your users" means the individuals within your Organisation who have been given access to The Service.
"us", "we" and "our" refer to ExpensePlus Ltd.
"you" means the person using The Service, or dealing with us, on behalf of your Organisation, or any other person whose data we use as described in this policy.
When we are a processor, not a controller
When your Organisation stores personal data in The Service (for example about its donors, payees, suppliers, customers or employees), your Organisation is the controller and we are its processor. We handle that data only on your Organisation's instructions, under our Data Processing Agreement. This policy does not cover that data. If you are one of those individuals, please contact the organisation. If you contact us, we will pass your request on to them.
The same applies to the log files our servers keep when you use The Service. These record information such as your IP address, the pages you visit, when you access them and changes made within The Service. We process them on behalf of your Organisation, so that you can use The Service and so that we can monitor the health and security of your account. They are kept for 6 months.
Contact. Data Protection Officer, ExpensePlus Ltd, at the address above, or dpo-contact@expenseplus.co.uk.
2. What we collect, why, and how long we keep it
We collect most of this information from you, or from the person at your Organisation who signs up. We also use public sources, such as your Organisation's website and the register of charities, to verify trial requests and to check that your plan is correct. If you are named as a referrer, we receive your name from the customer you referred.
| Who and what | Information | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|---|
| Trial sign-ups and account contacts | Contact name and role, email address, organisation name, charity number, website and any other names it is known by, type of organisation (and denomination, for churches), annual income, financial year start | To create and run your account, verify trial requests, set the correct price plan, match support emails to your account and produce internal reports | Contract (when you subscribe); legitimate interests (verifying trials, reporting) | While your account is active. After cancellation, contact and billing details for 1 year for internal reporting. Unconverted trials: 1 Year |
| How The Service is used (Service Usage Data) | User and organisation identifiers, sign-in and session times, activity counts, feature usage, device, operating system and browser type. Never the content of your records, files or notes | To understand when and how The Service is used, plan capacity, improve The Service and its security, and support customers. This includes aggregated statistics and internal reports that rank users or organisations by activity | Legitimate interests | 1 year |
| Plan checks | The amounts and dates of the income you have recorded in your account (not the names or details of donors, payees or suppliers), and your income as published on public charity registers. This is mainly information about your Organisation, not individuals | To check that your price plan matches your Organisation's income, tell you if it does not, and bill you correctly. If your income is above your plan and you have enabled our support team's access, a member of our team may review the income records behind the total, only to check for mistakes | Contract; legitimate interests (charging the correct price) | The totals are kept no longer than 2 years |
| Billing | Invoices, payments, payment method, overdue accounts. Card payments are handled by Stripe and Direct Debits by GoCardless | To collect payments, keep accounts and chase unpaid invoices | Contract; legal obligation (tax and accounting records) | 6 years from the end of the tax year of the transaction |
| Support requests | Name, email, organisation, and the content of your messages and attachments, including those sent through the 'Contact Us' pop-up on our website | To answer your questions and fix problems | Contract; legitimate interests (providing effective support) | 3 years |
| Support bookings | Name, email, organisation, time and topic of your booking | To arrange one-to-one support sessions with you | Contract; legitimate interests | Within 3 years of the date of the last session booked |
| Training, tours and events | Name, email, organisation, session attended, and any recording or chat if you join a recorded session | To arrange the session and follow up with you afterwards | Legitimate interests (helping customers use The Service) |
If you attend as an individual, or for an organisation that does not use ExpensePlus: 4 months after the last session you attend and from backup 1 year later
If you attend as a user from an organisation that uses or is trialling ExpensePlus: until 30 days after that organisation’s subscription ends (and from backup 1 year later), or, if it never subscribes, 40 days after its free trial ends (and from backup 1 year later) Any session recordings are automatically deleted after 90 days (and from backup 10 days later) |
| User Suggestions | Name, email, organisation | To track new features that users would like us to develop | Legitimate interests (enabling customer feedback) | 1 year after the organisation the subscription of the organisation they are part of ends |
| File transfers | Your name and email address, and the files we send you | To send you files you have asked for, such as copies of your documents when you cancel | Contract | The transfer link expires after 3 days, and WeTransfer then deletes the files within 48 hours. WeTransfer keeps its own records about the transfer under its privacy policy. |
| Service messages | Contact details | To tell you about technical problems, security issues, new features and training | Contract; legitimate interests (keeping you informed about a service you use) | As for account contacts |
| Referrals | The referral code we save in a cookie for 7 days when you arrive from a referrer, and the name of the referrer | To thank the organisation that referred you | Consent (for the cookie); legitimate interests (thanking referrers) | The cookie lasts 7 days. If you sign up, we keep a record of who referred you for as long as your subscription is active. We delete it from our live systems within 30 days after your subscription ends, and from our backups within 60 days after it ends. If you do not subscribe after your free trial, the same periods run from the end of the trial. |
| Enquiries | Contact details and your message | To respond to your enquiry, and only for that purpose | Legitimate interests | 3 years |
| Email list | Name and email address | To send you our newsletter and updates | Consent. You can unsubscribe at any time | Until you unsubscribe, then a record that you did |
| Reviews | Name, organisation, website and profile image you give us | To publish your review on our website | Consent. You can withdraw it at any time and we will remove the review | Until you withdraw consent |
| Website visitors | Cookie and device information | To make our website work, protect it from spam and abuse, and understand how it is used | See our Cookies Policy | See our Cookies Policy |
| Your rights and legal claims | Details of your request and our reply | To respond to requests and complaints, and to establish or defend legal claims | Legal obligation; legitimate interests | Requests and complaints: a record of the request and our reply for 6 years after we close the case. We keep any copy of your data that we send you only for as long as needed to deal with your request and any follow-up, and no longer than 2 years. We keep these records and copies longer only if a claim or regulator investigation is ongoing. |
LoveGivingis our online donation platform for organisations that use ExpensePlus. When someone gives through a charity’s LoveGiving page, the charity is the controller of the donor’s personal data and we are its processor, in the same way as for The Service. We handle donor data only on the charity’s instructions, under our Data Processing Agreement, and make it available to the charity within ExpensePlus. This policy does not cover that data. Donations are processed by Stripe, which handles the payment details. If you have given to a charity through LoveGiving, please contact that charity about your data and your rights.
Our legitimate interests are: running and securing The Service; understanding and improving how it is used; charging the correct price; communicating with customers; supporting and training users; keeping accurate business records; and defending legal claims. When we analyse how The Service is used, we never use the content of your records, we do not use it to market to your users, and we publish or share statistics outside ExpensePlus only in a form that cannot identify you or anyone else. You have the right to object to any use that relies on legitimate interests (see section 7).
You do not have to give us this information, but we cannot create your account or provide The Service without your contact and billing details. We do not use automated decision-making that has legal or similarly significant effects on you. Plan checks are automated calculations, but we email your system administrator contact before moving you to a different plan, and you can ask us to look again [confirm that a member of our team decides before any plan change].
3. Who we share your information with
We do not sell your personal data. We share it only with:
- Suppliers that help us run our business, listed below. They act on our instructions under contracts that require them to protect it, unless stated.
- Professional advisers, such as accountants, lawyers and insurers.
- HMRC and other authorities, where the law requires it.
- A buyer, if we sell or restructure the business. We would tell you about any changes to how your data is used.
| Supplier | What is does for us | Where |
|---|---|---|
| Linode (Akamai) and Amazon Web Services |
Host The Service and its backups, which include your account and user details | UK |
| Stripe | Card payments for your subscription | US |
| GoCardless | Direct Debit payments for your subscription | UK |
| Google (Gmail and Workspace) | Email and documents | US |
| Google reCAPTCHA | Protects our website forms and sign-in from spam and abuse | US |
| Google Analytics | Website statistics, only if you consent | US |
| Help Scout | Handles support requests, including the 'Contact Us' pop-up on our website | US |
| Acuity Scheduling (Squarespace) |
One-to-one support session booking | US |
| Zoom | Online training, tours and events | US |
| WeTransfer | Sends files to you, such as copies of your documents | Netherlands (EEA) |
| Mailchimp | Sends our newsletter | US |
| Slack | Internal communication, which can include customer contact details | US |
Stripe and GoCardless also use your payment details for their own regulated payment services, under their own privacy notices.
The sub-processors that handle data held in The Service on behalf of customers are listed separately on our Third Party Sub Processors page.
4. Transfers outside the UK
Our database and backups are in the UK. Some of our suppliers are in the United States. Where we send personal data outside the UK, we make sure it has a lawful safeguard. For the suppliers below, this is usually the UK Extension to the EU-US Data Privacy Framework where the supplier is certified, with the UK Addendum to the EU Standard Contractual Clauses (the UK's approved addendum) as the alternative, as set out in the supplier's own data processing terms.
| Supplier | Safeguard |
|---|---|
| Stripe | UK Extension to the EU-US Data Privacy Framework; UK Addendum as fallback |
| Google (Gmail and Workspace) | UK Addendum to the EU Standard Contractual Clauses, in Google's Cloud Data Processing Addendum |
| Google Analytics and reCAPTCHA | UK Extension to the EU-US Data Privacy Framework; Standard Contractual Clauses with the UK Addendum where Google does not rely on that |
| Help Scout | UK Extension to the EU-US Data Privacy Framework; UK Addendum as fallback |
| Acuity Scheduling (Squarespace) | UK Extension to the EU-US Data Privacy Framework; UK Addendum as fallback |
| Zoom | UK Extension to the EU-US Data Privacy Framework; Standard Contractual Clauses with the UK Addendum as fallback |
| Mailchimp | UK Extension to the EU-US Data Privacy Framework; Standard Contractual Clauses with the UK Addendum as fallback |
| Slack | UK Extension to the EU-US Data Privacy Framework, or Standard Contractual Clauses with the UK Addendum |
| WeTransfer | Netherlands: covered by UK adequacy regulations for the EEA. Any onward transfers by WeTransfer are under its own privacy policy |
| GoCardless | UK company. Any transfers GoCardless makes within its group or to its suppliers are under its own privacy notice |
5. How secure is your information?
We take security very seriously and will do everything within our power to keep your information safe. Full details of the steps we have taken to manage your data securely can be found on our Security page.
6. How long do we keep your information?
The retention periods for each type of information we use as a controller are in the table in section 2. We review the data we hold from time to time and delete data that is no longer needed for the purpose we collected it. You are responsible for keeping your account contact details and system administrator up to date in the Organisation Settings screen of The Service.
Backups. Our daily backups are kept for 30 days and our monthly backups for 7 years. Where a subscription or free trial ends, we delete the account's data from our live systems within 30 days and from our backups within 60 days, as set out in our Data Processing Agreement.
7. Your rights
Under the UK GDPR and the Data Protection Act 2018, you have the right to:
- be informed about how we use your data (this policy);
- access a copy of the data we hold about you;
- correct inaccurate or incomplete data;
- delete your data in certain circumstances, for example where we no longer need it or you withdraw consent;
- restrict how we use your data in certain circumstances, for example while we check its accuracy;
- data portability: to receive data you gave us, where we use it by consent or contract, in a common electronic format;
- object to our use of your data where we rely on legitimate interests, such as when we analyse how The Service is used, and to object at any time to direct marketing, which we will always stop; and
- withdraw consent at any time, where we rely on it.
To use any of these rights, email dpo-contact@expenseplus.co.uk or write to the address above. We will reply within one month, and we may need to confirm your identity first. There is normally no charge. Some rights apply only in certain circumstances, and we will explain if we cannot act on a request.
8. Complaints
If you are unhappy with how we have used your data, please tell us first at dpo-contact@expenseplus.co.uk, by post, or through any channel you used to contact us. We will acknowledge your complaint within 30 days, investigate it, keep you informed, and tell you the outcome.
You also have the right to complain to the Information Commission, which continues to be known as the ICO, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to contact us first.
9. Cookies
Our website uses necessary cookies, and optional functional, support and analytics cookies that we only set if you choose to allow them. You can change your choice at any time using the 'Cookie settings' link at the bottom of any page. We do not use marketing cookies. For the full list of cookies, what they do and how long they last, see our Cookies Policy.
10. Changes to this policy
We may update this policy from time to time. The date of the latest version is shown at the top. If we make a material change, we will tell you by email or in The Service before it takes effect.