Privacy Statement for SAP Concur Partner Directory (“Privacy Statement”)

Protecting the individual's privacy is crucial to the future of business. We have created this Privacy Statement to demonstrate our firm commitment to the individual`s right to data protection and privacy. This Privacy Statement outlines how we handle information that can be used to directly or indirectly identify an individual.

A. General Information

B. Processing based on a statutory permission

C. Additional Country-Specific Provisions


A. General Information

Who is the Data Controller? The data controller for the SAP Concur Partner Finder at https://www.concur.com/partners/search is Concur Technologies, Inc., 601 108th Avenue NE, Suite 1000, Bellevue, WA 98004 (“SAP Concur”). The SAP Group’s data protection officer can be reached at privacy@sap.com. You may contact the SAP Concur privacy team at any time at Privacy-Request@Concur.com.


What Personal Data does SAP CONCUR collect? SAP CONCUR collects some information about you in the context of your professional activities, consisting of your First Name, Last Name, Email, Phone Number (optional), Company Name, and Country (“Personal Data”).

Why does SAP CONCUR need your Personal Data? SAP CONCUR requires your Personal Data to:

  • Send your personal data to the SAP CONCUR Partner you requested to be connected to
  • to deliver the ordered goods or services
  • comply with statutory obligations, including checks required by applicable export laws

Although providing Personal Data is voluntary, without your Personal Data,

  • SAP CONCUR cannot send your personal data the SAP CONCUR Partner you requested to be connected to
  • SAP CONCUR cannot deliver the ordered goods or services.

Kindly note that you can request to be put in touch with an SAP CONCUR Partner without providing a consent into SAP CONCUR’s further marketing operations.

From What Types of Third Parties does SAP CONCUR obtain Personal Data? In most cases SAP CONCUR collects Personal Data from you. SAP CONCUR might also obtain Personal Data from a third party, if the applicable national law allows SAP CONCUR to do so. SAP CONCUR will treat this Personal Data according to this Privacy Statement, plus any additional restrictions imposed by the third party that provided SAP CONCUR with it or the applicable national law. These third-party sources include:

  • SAP and/or SAP Group’s business dealings with your employer
  • Third parties you directed to share your Personal Data with SAP CONCUR

How long will SAP CONCUR store my Personal Data? SAP CONCUR will only store your Personal Data for as long as it is required

  • to make SAP CONCUR Partner Finder services available to you
  • for SAP CONCUR to comply with its statutory obligations resulting from applicable export laws
  • for the performance of sending personal data to SAP CONCUR Partners based on your request or until you object against such use by SAP CONCUR if SAP CONCUR’s use of your Personal Data is based on SAP CONCUR’s legitimate business interest as further stated in this Privacy Statement
  • for the performance of sending personal data to SAP CONCUR Partners based on your request or until you revoke your consent granted in this Privacy Statement if SAP CONCUR is processing your Personal Data based on your consent

SAP CONCUR will also retain your Personal Data for additional periods if it is required by mandatory law to retain your Personal Data longer or where your Personal Data is required for SAP CONCUR to assert or defend against legal claims, SAP CONCUR will retain your Personal Data until the end of the relevant retention period or until the claims in question have been settled.

Who are the recipients of your Personal Data and where will it be processed? Your Personal Data will be passed on to the following categories of third parties to process your Personal Data:

  • companies within the SAP Group
  • SAP CONCUR Partners that you are interested in corresponding with

As part of a global group of companies operating internationally, SAP Concur has affiliates (the “SAP Group”) and third-party service providers outside of the European Economic Area (the “EEA”) and will transfer your Personal Data to countries outside of the EEA. If these transfers are to a country for which the EU Commission has not issued an adequacy decision, SAP Concur uses the EU standard contractual clauses to contractually require that your Personal Data receives a level of data protection consistent with the EEA. You can obtain a copy (redacted to remove commercial or irrelevant) of such standard contractual clauses by sending a request to privacy@sap.com. You can also obtain more information from the European Commission on the international dimension of data protection here: European Commission.

What are your data protection rights?

You can request from SAP CONCUR: access at any time to information about which Personal Data SAP CONCUR processes about you and the correction or deletion of such Personal Data. Please note, however, that SAP CONCUR can or will delete your Personal Data only if there is no statutory obligation or prevailing right of SAP CONCUR to retain it. Kindly note further that if you request that SAP CONCUR deletes your Personal Data, you will not be able to continue to use any SAP CONCUR service that requires SAP CONCUR’s use of your Personal Data.

If SAP CONCUR uses your Personal Data based on your consent or to perform a contract with you, you can further request from SAP CONCUR a copy of the Personal Data that you have provided to SAP CONCUR. In this case, please contact the email address below and specify the information or processing activities to which your request relates, the format in which you would like to receive this information, and whether the Personal Data should be sent to you or another recipient. SAP CONCUR will carefully consider your request and discuss with you how it can best fulfill it.

Furthermore, you can request from SAP CONCUR that SAP CONCUR restricts your Personal Data from any further processing in any of the following events: (i) you state that the Personal Data SAP CONCUR has about you is incorrect, subject to the time SAP CONCUR requires to check the accuracy of the relevant Personal Data, (ii) there is no legal basis for SAP CONCUR processing your Personal Data and you demand that SAP CONCUR restricts your Personal Data from further processing, (iii) SAP CONCUR no longer requires your Personal Data but you state that you require SAP CONCUR to retain such data in order to claim or exercise legal rights or to defend against third party claims, or (iv) in case you object to the processing of your Personal Data by SAP CONCUR based on SAP CONCUR’s legitimate interest (as further set out below), subject to the time required for SAP CONCUR to determine whether it has a prevailing interest or legal obligation in processing your Personal Data.

Please note, however, that SAP CONCUR can or will delete your Personal Data only if there is no statutory obligation or prevailing right of SAP CONCUR to retain it. Kindly note further that if you request that SAP CONCUR deletes your Personal Data, you will not be able to continue to use any SAP CONCUR service that requires SAP CONCUR’s use of your Personal Data.

How can you exercise your data protection rights? Please direct any requests to exercise your rights to privacy@sap.com

How will SAP CONCUR verify requests to exercise data protection rights?

SAP CONCUR will take steps to ensure that it verifies your identity to a reasonable degree of certainty before it will process the data protection right you want to exercise. When feasible, SAP CONCUR will match Personal Data provided by you in submitting a request to exercise your rights with information already maintained by SAP CONCUR. This could include matching two or more data points you provide when you submit a request with two or more data points that are already maintained by SAP CONCUR.

SAP CONCUR will decline to process requests that are manifestly unfounded, excessive, fraudulent, or are not otherwise required by local law.

Right to lodge a complaint. If you take the view that SAP CONCUR is not processing your Personal Data in accordance with the requirements in this Privacy Statement or under applicable data protection laws, you can at any time lodge a complaint with the data protection authority of the EEA country where you live or with the data protection authority of the country or state where SAP CONCUR has its registered seat.

Can I use SAP CONCUR’s goods and services if I am a minor or child?

Children. In general, SAP CONCUR Partner Finder service is not directed to users below the age of 16 years, or equivalent minimum age in the relevant jurisdiction. If you are younger than 16 or the equivalent minimum age in the relevant jurisdiction, you cannot register with and use SAP CONCUR Partner Finder.


B. Processing based on a statutory permission

Why does SAP CONCUR need to use my Personal Data and on what legal basis is SAP CONCUR using it?

Processing to fulfill contractual obligation: SAP CONCUR requires your Personal Data to provide you, at your request, with access to SAP CONCUR Partners. SAP CONCUR processes Personal Data prior to entering into a contract with you pursuant to Article 6(1) lit. b GDPR or the equivalent article under other national laws, when applicable.

Processing to ensure compliance: SAP CONCUR and its products, technologies, and services are subject to the export laws of various countries including, without limitation, those of the European Union and its member states, and of the United States of America. You acknowledge that, pursuant to the applicable export laws, trade sanctions, and embargoes issued by these countries, SAP CONCUR is required to take measures to prevent entities, organizations, and parties listed on government-issued sanctioned-party lists from accessing certain products, technologies, and services through SAP CONCUR’s websites or other delivery channels controlled by SAP CONCUR. This could include (i) automated checks of any user registration data as set out herein and other information a user provides about his or her identity against applicable sanctioned-party lists; (ii) regular repetition of such checks whenever a sanctioned-party list is updated or when a user updates his or her information; (iii) blocking of access to SAP CONCUR’s services and systems in case of a potential match; and (iv) contacting a user to confirm his or her identity in case of a potential match. Any such use of your Personal Data is based on the permission to process Personal Data in order to comply with statutory obligations (Article 6 para. 1 lit. c GDPR or the equivalent articles under other national laws, when applicable) and SAP CONCUR‘s legitimate interest (Article 6 para. 1 lit. f GDPR or the equivalent articles under other national laws, when applicable).

Processing based on SAP CONCUR’s legitimate interest: SAP CONCUR can use your Personal Data based on its legitimate interest (Article 6 para. 1 lit. f GDPR or the equivalent article under other national laws, when applicable) as follows:

  • Share your Personal Data with SAP CONCUR Partners. SAP CONCUR will process your personal data to share your request to be contacted with the SAP CONCUR Partner of your choosing.
  • Fraud and Legal Claims. If required, SAP CONCUR will use your Personal Data for the purposes of preventing or prosecuting criminal activities such as fraud and to assert or defend against legal claims.
  • Questionnaires and survey. SAP CONCUR could invite you to participate in questionnaires and surveys. These questionnaires and surveys will be generally designed in a way that they can be answered without any data that can be used to identify you. If you nonetheless enter such data in a questionnaire or survey, SAP CONCUR will use this personal data to improve its offerings.

You can at any time object to SAP CONCUR’s use of your Personal Data as set forth in this section by sending an email to privacy@sap.com. In this case, SAP CONCUR will carefully review your objection and cease further use of the relevant information, subject to SAP CONCUR’s compelling legitimate grounds for continued use of the information, which override your interest in objecting, or if SAP CONCUR requires the information for the establishment, exercise or defense of legal claims.

Processing under applicable national laws: If the applicable national law allows SAP CONCUR to do so, SAP CONCUR will use information about you for a business purpose, some of which is Personal Data

  • to contact you to discuss further your interest in SAP CONCUR services and offerings
  • to verify your identity and determine appropriate services
  • to assert or defend against legal claims


C. Additional Country-Specific Provisions

Where SAP CONCUR is subject to certain privacy requirements in the United States, the following also applies:

U.S. Children’s Privacy. SAP CONCUR does not knowingly collect the Personal Data of children under the age of 13. If you are a parent or guardian and believe SAP CONCUR collected information about a child, please contact SAP CONCUR as described in this Privacy Statement. SAP CONCUR will take steps to delete the information as soon as possible. Given that SAP CONCUR Partner Finder is not directed to users under 16 years of age and in accordance with the disclosure requirements of the CCPA, SAP CONCUR does not sell the Personal Data of any minors under 16 years of age.

Where SAP CONCUR is subject to certain privacy requirements in the United States in the State of California, the following also applies:

Do Not Track. Your browser may allow you to set a “Do not track” preference. Unless otherwise stated, our sites do not honor “Do not track” requests. However, you may elect not to accept cookies by changing the designated settings on your web browser or, where available, by referring to our Cookie Statement. Cookies are small text files placed on your computer while visiting certain sites on the Internet used to identify your computer. Please note that if you do not accept cookies, you may not be able to use certain functions and features of our site. This site does not allow third parties to gather information about you over time and across sites.

You have the right:

  • to request from SAP CONCUR access to your Personal Data that SAP CONCUR collects, uses, or discloses about you;
  • to request that SAP CONCUR delete Personal Data about you;
  • to non-discriminatory treatment for exercise of any of your data protection rights;
  • in case of request from SAP CONCUR for access to your Personal Data, for such information to be portable, if possible, in a readily usable format that allows you to transmit this information to another recipient without hindrance; and

In accordance with the disclosure requirements under the California Consumer Privacy Act (“CCPA”), SAP CONCUR does not and will not sell your Personal Data. In accordance with the verification process set forth in the CCPA, SAP CONCUR will require a more stringent verification process for deletion requests, or for Personal Data that is considered sensitive or valuable, to minimize the harm that might be posed to you by unauthorized access or deletion of your Personal Data. If SAP CONCUR must request additional information from you outside of information that is already maintained by SAP CONCUR, SAP CONCUR will only use it to verify your identity so you can exercise your data protection rights, or for security and fraud-prevention purposes.

In addition to contacting SAP CONCUR at Privacy-Request@Concur.com, you may also exercise your rights as follows:

You can call toll-free to submit a request using the numbers provided here. You can also designate an authorized agent to submit requests to exercise your data protection rights to SAP CONCUR. Such authorized agent must be registered with the California Secretary of State and submit proof that you have given authorization for the agent to act on your behalf.

Where SAP CONCUR is subject to certain privacy requirements in the Philippines, the following also applies:

For individuals within the Philippines, you may also exercise your rights as follows:

You can call or write to SAP CONCUR to submit a request at:

Phone: +632-8705-2500

Address: SAP CONCUR Philippines, Inc.

Attn: Data Protection Officer

27F Nac Tower, Taguig City 1632, Philippines

The following two provisions apply to citizens of the Philippines:

  • You may claim compensation as finally awarded by the National Privacy Commission or the courts if you suffered damages due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data, considering any violation of your rights and freedoms as data subject;

If you are the subject of a privacy violation or personal data breach, or are otherwise personally affected by a violation of the Data Privacy Act, you may file a complaint with the National Privacy Commission.

Russian-Specific Provisions apply to citizens of the Russian Federation.