Rally procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| Data retention | All applicable tiers | unknown | “ retained longer to meet legal obligations or legitimate business needs . For example, financial transaction records and associated personal data might be kept for a number of years as required by tax law, anti-money laundering regulations, or accounting rules. These laws often mandate retaining data for a fixed period (for instance, financial records might be kept for 7 years under some regulations). During this retention, your data will remain subject to strict access controls and will only be used for compliance or legitimate internal purposes.” | Captured 2026-08-11Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ it. Please note that due to legal requirements (such as financial regulations)” | Captured 2026-08-11Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ In summary, Rally does not keep personal data indefinitely . We aim to store data for the shortest time necessary , taking into account our legal obligations and the needs of our services. If you have specific questions about our data retention periods for different types of data, you can contact us for more detailed information.” | Captured 2026-08-11Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ we might need to retain some information despite your request, but we will inform you if that is the case.” | Captured 2026-08-11Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Right to Erasure (Right to be Forgotten): You may ask us to delete your personal data in certain circumstances. For example, if the data is no longer necessary for the purposes it was collected, or if you have withdrawn your consent and we have no other legal basis to continue processing. Upon a valid request, we will erase your data, provided there is no legal obligation or overriding legitimate interest that requires us to keep” | Captured 2026-08-11Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ terminate accounts that have been inactive for an extended period. If your account has no activity (such as no logins, transactions, or card use) for a continuous period of time (e.g., 12 months or more), we may designate the account as inactive. Prior to terminating an inactive account, we will provide notice to you (for instance, by email) to inform you that your account is at risk of closure due to inactivity. If you do not respond or reactivate your account by logging in or making a transaction within the time specified in the notice, we may proceed to close your account. After termination for inactivity, any remaining funds in your account will be handled according to applicable law – for example, we may attempt to return funds to you or, if law requires, escheat unclaimed funds to a governmental authority after a certain period. No fees will be charged solely for inactivity-based termination, but monthly maintenance fees (if applicable) may continue to be deducted until the account is closed.” | Captured 2026-08-11Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Active Account: If you have an active account with Rally, we will retain your personal information for as long as your account is in use or as needed to provide you with our services. This allows us to provide the service continuously (e.g., to maintain your expense history and account settings).” | Captured 2026-08-11Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with applicable legal and regulatory requirements. This means:” | Captured 2026-08-11Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ (whether by you or by Rally), your rights to use the Services will immediately cease. This means you must stop using any Rally cards (which will be deactivated), and you will no longer have access to the Rally platform or any stored data in your account (we recommend you export any needed reports before termination). We may, at our discretion, delete or disable access to your expense data after termination, except to the extent we are obliged to retain it for legal reasons. Any funds remaining in a payment account or card balance will be returned to you as per your instructions (provided compliance checks allow us to return the money) or via the original funding source, subject to legal requirements. However, Rally may offset any funds against amounts you owe us (for example, deducting unpaid fees from a remaining balance) to the extent permitted by law.” | Captured 2026-08-11Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ procedures to safeguard data (for example, policies on device security, incident response plans, and least-privilege data access). We ensure that any third-party contractors or service providers we use are also required to uphold robust security standards. Before engaging a new vendor, we assess their security practices and continue to monitor their compliance.” | Captured 2026-08-11Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ services and expense management, we may work with banking institutions, payment processors, card networks, or financial infrastructure partners. Your personal and financial data may be shared with such partners as necessary to process payments, execute transactions, or issue cards . For example, when you perform a card transaction, details of that transaction and your identity must be shared with the payment processor or bank that handles the payment. These partners are also subject to strict privacy and security obligations.” | Captured 2026-08-11Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ do not sell or rent your information to third parties for their own commercial purposes. However, to run our business and provide our services, we sometimes need to share data with trusted third parties. We only share the minimum necessary data and only for the purposes described in this policy. The types of third parties with whom we may share personal data are:” | Captured 2026-08-11Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ with regulatory authorities, law enforcement agencies, or auditors . This sharing will only occur to the extent that we are legally obligated to do so – for instance, responding to a lawful request from law enforcement, or providing data to regulators like the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or financial oversight authorities. We may also disclose information to enforce our terms of service or to protect our rights (or the rights of our users or others) in cases of security incidents or violations – but only in accordance with applicable laws.” | Captured 2026-08-11Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ minimize the data shared and ensure that appropriate safeguards are in place. We require any third party receiving personal data to provide sufficient guarantees that your data will be kept secure and used only for the intended purpose. Rally never shares your personal data with third parties for their marketing purposes or any use not described in this Privacy Policy. If we ever need to share your data for any other reason, we will obtain your consent or inform you clearly of the reason and legal basis.” | Captured 2026-08-11Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ companies that perform services on our behalf, such as cloud hosting providers, data storage services, email and communication platforms, customer support tools, analytics services, and other IT support. We share data with these providers only to the extent needed for them to perform their tasks (for example, storing data on a secure cloud server, or sending an email notification). All our service providers are bound by data processing agreements that require them to handle personal data in compliance with GDPR and to use it solely for providing services to Rally. They are not permitted to use your data for their own purposes.” | Captured 2026-08-11Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Business Transfers: In the event that Rally Europe B.V. undergoes a business transaction such as a merger, acquisition, corporate reorganization, or sale of assets, your personal data might be part of the assets transferred or shared with involved parties (e.g., a due diligence review). If such a transfer occurs, we will ensure that the recipient of the data is bound by privacy obligations at least as strict as those in this policy, and we will inform you of any significant changes in ownership or data handling.” | Captured 2026-08-11Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ No Unlawful Fees: Rally will not charge any fees that are not allowed by Dutch or EU regulations. For example, we comply with the EU” | Captured 2026-08-11Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ By using the Services, you agree to pay the fees and charges applicable to your account. Failure to pay may result in suspension or termination of Services as outlined below.” | Captured 2026-08-11Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ payment of all fees and charges associated with your use of the Services. This includes any fees for Rally-issued cards, subscription fees for the spend management platform, and reimbursement of any transactional taxes or costs that Rally is required to collect. You must maintain an active payment method or sufficient account balance to allow us to collect payments when due. If you believe any charge is incorrect, you should contact us promptly to dispute the charge; otherwise, we will assume the amount is correct and due.” | Captured 2026-08-11Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Unless otherwise agreed in a separate written contract, the following terms apply to fees and payment for Rally’s Services:” | Captured 2026-08-11Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ UK. We do not offer accounts or services to entities or individuals outside” | Captured 2026-08-11Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ users and businesses located in the European Union (EU) and the United Kingdom (UK) . By registering for our Services, you represent that your primary place of business or residence is within the EU or” | Captured 2026-08-11Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ under a transparent fee policy . We will clearly communicate any fees or charges applicable to the Services before you incur them. All service fees, usage charges, or applicable taxes will be disclosed via our website, mobile app, or in a fee schedule provided to you, in accordance with Dutch and EU law. We do not charge any fees beyond those that are legally permitted and justified for the service provided. For example, we do not impose unjustified surcharges on transactions; any fees (such as card issuance fees, account subscription fees, or transaction fees) will comply with EU regulations and caps. If certain services are legally required to be offered for free or at cost (for instance, basic payment services under EU rules), we will adhere to those requirements. Rally will also include any mandatory government taxes or levies in the fees we charge (such as VAT), and those will be indicated to you as part of the total cost.” | Captured 2026-08-11Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ may be charged on a periodic basis or per usage, depending on the nature of the service. For example, a monthly platform fee may be billed in regular cycles, while transaction fees or card usage fees might be deducted at the time of each transaction or billed monthly in arrears. We will inform you of the billing cycle and payment method when you sign up for a particular service. Payment Terms: If we issue invoices (for instance, for a monthly subscription or consolidated expense billing), you agree to pay the invoiced amounts by the due date stated on the invoice. The standard payment term for invoices, unless otherwise specified, is 30 days from the invoice date in accordance with Dutch Civil Code Article 6:119a. If fees are deducted automatically (e.g. from a Rally balance or via direct debit), you must ensure you have sufficient funds available to cover the charges on the due date.” | Captured 2026-08-11Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ promptly. If you are incorrectly charged a fee or if a transaction is processed in error, we will correct the mistake and refund any amount that was not due. We do not offer refunds for fees or charges that were properly incurred under these Terms (for example, if you voluntarily cancel the service mid-term, any prepaid fees may only be refunded at our discretion or as required by applicable law). However, if you terminate your account or services and have paid fees for a period you will not use, Rally will review and issue pro-rata refunds for the unused portion if required by law or our own refund policy . Any specific refund terms for certain services (e.g. a money-back guarantee or trial period) will be communicated to you in the relevant service documentation.” | Captured 2026-08-11Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ surcharges are applied to payment transactions. If any law or regulation caps or limits a fee we intended to charge, we will adhere to the lower permitted amount. Our goal is to maintain fair and transparent pricing in line with all legal requirements.” | Captured 2026-08-11Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.