Introduction

Protecting your private information is our priority. This privacy policy applies to the collection, use, and disclosure of personal information we receive from users of the EPS website and our accounts payable systems services offered through the website application (collectively called the “Website”).

What Information EPS Collects and How We Use It

We collect and use the following data:

Account Information

When you sign up for our Services, our Website asks you to choose a username and password and to provide various types of information, some related to your corporate entity, some personal. This includes:

• Your Personal Information: Includes your name, email address, phone number, and billing address.
• Your Company’s Information: Includes your company’s name, number of employees, accounting system(s), business address, phone and fax number, LinkedIn and Twitter profiles, and contact persons.
• Employee Information: The names, work phone numbers, departments, titles, and work email addresses of your employees who will be using the Website and Services.
• Supplier Information: Name, title, email, phone number, billing address, and for those using the payment application, Bank Account information.
• Subscription Information: A credit card to pay for your subscription to EPS.

EPS uses this contact information to provide you with updated information and service your account. We may also use this information to contact you about additional products or services that may interest you. You will have an opportunity to “opt-out” of such offers upon request.

Security Policy and Practices

Encryption of Personal Data

• Data in Transit: Encrypted using 256-bit encryption (TLS/SSL).
• Data at Rest: Encrypted using AES-256.
• Sensitive Data: Further encrypted with AES-256 and a separate private key.
• Passwords: Hashed with unique per-user salts.

Ongoing Security Measures

• Security Policies: Comprehensive and frequently updated security policies.
• Training: Annual Security and Awareness training for all employees.
• Firewalls: Web application and network firewalls, AWS DDoS prevention defenses.
• SDLC Security: Secure Software Development Lifecycle (SDLC) with static code analysis and human reviews.
• Incident Response: Predefined security incident response processes.
• Vulnerability Assessment: Regular vulnerability assessments and third-party penetration testing.

Data Restoration and Disaster Recovery

• Data Storage: Databases stored on AWS in multiple availability zones.
• Backups: Daily backups and periodic restore testing.

Regular Testing and Evaluation

• System Testing: Functional and security tests before deployment.
• Change Management: Processes for addressing identified deficiencies.

User Identification and Authorization

• Passwords: Strong password policies and rate-limited login attempts.
• Authentication: Optional 2FA and SSO using SAML protocol.

Physical Security

• Hosting: Software hosted in AWS facilities with compliance and regulatory assurances (SOC 1-3, ISO 27001).
• Security Groups: VPC with restricted security groups.

Event Logging

• Logs: Maintained for three months in internal systems and customer-accessible audit logs.
• Ticketing System: Customer requests are logged in a ticketing system.

IT and Security Governance

• Governance: Executive management oversees security governance and risk mitigation.
• Risk Management: Ongoing risk management, employee training, and coordination to prevent data breaches.
• Incident Response: Documented processes and procedures for cybersecurity incidents.

Certification and Assurance

• Certifications: SOC 1, 2, and 3 certified with annual reviews, PCI DSS compliant (SAQ-D Attestation of Compliance).

Data Management Principles

• Data Minimization: Data collected is necessary to provide services.
• Data Quality: Maintained through customer review and updates.
• Data Retention: Policies aligned with business requirements and legal obligations.

Accountability

• Reviews and Training: Third-party reviews and training to enhance data protection awareness.
• Policies: Comprehensive policies and record-keeping on security matters.

Security Bounty

• Bug Reporting: Bug or vulnerability assessments can be submitted to bugbounty@Elitepayables.com.

Portability and Data Disposal

• Requests: Data portability and disposal requests via privacy@Elitepayables.com.
• Policies: Internal policies and training for handling these requests.

Cookies on EPS Websites

Necessary Cookies

Necessary cookies are required to enable basic site features, such as secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data.

Functional Cookies

Functional cookies help perform functionalities like sharing website content on social media, collecting feedback, and other third-party features.

Analytical Cookies

Analytical cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.

Performance Cookies

Performance cookies help understand and analyze key performance indexes to deliver a better user experience.

Advertisement Cookies

Advertisement cookies provide customized advertisements based on previous page visits and analyze ad campaign effectiveness.

Advertisement cookies provide customized advertisements based on previous page visits and analyze ad campaign effectiveness.

User Rights with Respect to Personal Data

You have the following rights with respect to your personal data:

• Access: Request access to the data we process about you.
• Objection: Object to the processing of your data.
• Data Overview: Request an overview of the data we process about you.
• Correction/Deletion: Request correction or deletion of incorrect or irrelevant data.
• Restriction: Request to restrict the processing of your data.

Important Information for Residents:

California Residents:

• The information transferred to service providers via “Functional Cookies” and “Marketing Cookies” might constitute a “sale” under the California Consumer Privacy Act (CCPA). To opt out, turn off these cookies and save settings.

Canadian Residents:

• Request correction or deletion of incorrect or irrelevant data.
• Right to withdraw consent at any time, subject to legal or contractual restrictions.
• Right to address non-compliance challenges to Canada’s Office of the Privacy Commissioner.

UK and EU Residents:

• Right to know why personal data is needed, how it will be used, and retention duration.
• Access: Right to access your personal data.
• Rectification: Right to supplement, correct, delete, or block personal data.
• Consent Withdrawal: Right to revoke consent and have personal data deleted.
• Data Transfer: Right to request all your data and transfer it to another controller.
• Objection: Right to object to data processing unless justified grounds exist.

Enabling/Disabling and Deleting Cookies

You can manage cookies via your browser settings. Links for guides on adjusting/deleting cookies in common browsers are provided below. Note that disabling cookies may affect website functionality.

• Browsers: Internet Explorer, Google Chrome, Mozilla Firefox, Opera, Safari, Microsoft Edge, Samsung Browser.
• Canada: Indicate preferences on youradchoices.ca.
• UK/EU: Note that the website may not work properly if all cookies are disabled. Deleting cookies will place them again after consent on subsequent visits.

Contact Us

For questions or comments about our privacy and cookies policy, contact us:

EPS, Inc.

Email: privacy@elitepayables.com

This privacy policy ensures transparency and security in handling your personal data. Please review it regularly for updates. If you disagree with any changes, terminate your services and contact us to exercise your rights described in this Privacy Policy.