Issued August 12, 2025
Overview
Modu respects your privacy. While Modu’s Services are designed for use by business customers, we may process information about you when providing our services and operating our business. This Privacy Policy (the "Policy") provides a comprehensive description of how Modu collects, uses, and discloses information about you, as well as your rights and choices. For purposes of this Policy, "Modu", "we", "our", and "us" refers to Modu Technologies LLP and its affiliates, and "you" or "your" refers to the individual interacting with us.
When you access or use our Services, you acknowledge that you have read this Privacy Policy and understand its contents. Please read this Policy carefully, as it applies when you use our Services or Products, visit our Website, or use the Modu mobile app. Capitalized terms that are not defined in this Policy have the definitions provided in the Platform Agreement.
In connection with the provision of specific Services, we may provide additional "just-in-time" disclosures or additional information about our data processing practices. These notices may supplement this Privacy Policy, clarify Modu’s privacy practices in the circumstances described or may provide you with additional choices about how Modu processes your personal information.
1. Applicability of this Privacy PolicyThis Privacy Policy applies to the personal information we collect and process, when you:
- visit, interact with, or use any Modu website, and/or Modu Services;
- create or administer your Modu account;
- receive communications from, or otherwise interact or communicate with us, including via email, phone or mail, or using our branded social media pages;
- register or take part in our marketing, learning, or training events; and/or
- offer or integrate your application, content, product, or services on or through Modu Services.
This Privacy Policy does not apply to the following:
Company Data. Company Data includes any personal information that you submit to us for processing to provide the Modu Services, such as when you provide your bank account information for payroll processing, or demographic information for benefits enrollment purposes. Company Data does not include the account information about you that you provide to us in connection with the creation or administration of your Modu account. For more information on how Modu handles Company Data, please see our Data Processing Addendum.
Modu as an employer. Any personal information we collect or process in our capacity as an employer, co-employer, or employer of record. For information we collect as part of the applicant process, please see our Applicant Privacy Policy.
Third Party Service Partners and Providers (“Service Providers”). Any products, services, websites or content that are offered by third parties through integrations with Modu Services, which are governed by their own respective privacy policies.
2. Personal Information We CollectThe personal information we collect depends on the context of your interactions with Modu and the choices you make, the Services and features you use, your location, and applicable laws. If you provide us with information about another individual, you represent you have the authority to do so and have delivered any required notices and obtained all necessary rights and consents to provide such information to us for processing in accordance with this Privacy Policy.
A. Information Provided to ModuModu Services are intended for use by business customers and their administrators, employees and other authorized users ("Authorized Users"). When applying for a Modu Account, we may receive information about you, your Company, and individuals associated with your Company. Such information includes, but is not limited to:
- Business Contact Information, such as your name, address, phone number, email address, employer, and job title.
- Account information, such as usernames, credit card and bank account information, Business Identification Number (BIN), Individual Identification Number (IIN), tax identifiers, and other authentication and security credential information.
- Identification Information, such as ИИН, passport or other government-issued identification documents to comply with our verification process, anti-money laundering (AML) and know your customer (KYC) obligations under the laws of the Republic of Kazakhstan.
- Communications, including when contacting sales, implementation, or support, asking a question, providing product feedback or corresponding with our business teams.
- Content, including any documentation, files or information you provide, which may include information about you or your business.
- Third-Party Information, including information you provide about any co-workers, contractors, vendors or potential referrals, such as their Business Contact Information.
- Other information, such as when you fill in a form on our website, respond to surveys, provide feedback, make a support inquiry, participate in promotions, or otherwise communicate with us.
Providing your personal information is optional, but it may be necessary for certain Services, such as account registration. In such cases, if you do not provide your personal information, we may not be able to provide you with the requested Services.
In connection with providing Services, we receive additional information submitted by, on behalf of and relating to a Company and its Authorized Users, such as:
- Authorized User Data, including your Business Contact Information, login credentials, and other information used by your company to invite and manage Authorized Users.
- Transaction Data, including information associated with your payments and card transactions made through your company's Modu Account, whether online or in store, such as the purchase details, payment mechanism, amount, location, and any annotations or coding you provide. Transactions can be made through a variety of domestic and international payment mechanisms, such as sending or receiving funds via bank transfer, QR payment systems, card payments, or other payment networks available in Kazakhstan (e.g., Kaspi, Halyk, Bank RBK).
- Linked Data, including information and documentation relating to you and your company made available by Third-Party Services connected to the Services. Linked Data may be made available to Modu during the application process and after a Modu Account is opened for your company. For example, if you link business bank accounts during or after the application process, or link your bank account to receive or provide expense reimbursements, we will receive Bank Account Information about the linked account, like the bank routing and account numbers and account balance. In addition, some Third-Party Services (e.g. accounting systems and business bank accounts) will provide us with information about activities outside of the Services, like your business expenses and your company's external transactions, finances and revenue. Other third party services, like your company's HRIS, may disclose your Authorized User Data, and if your company connects its email service, we may receive your email communications and attachments for processing. We may continue to access and receive Linked Data from a Third-Party Service until it is disconnected by you or your company.
- Spend and Workflow Data, including your company's spend limits and policies, approval hierarchies, and finance workflows.
- Travel Data, including your business travel booking and itinerary. This may include imprecise location information, such as when your travel itinerary indicates you have booked a flight to or hotel in a location.
- Receipt and Invoice Data, including information you submit to us to pay company invoices and process your receipts, such as photos, PDFs, e-mails and SMS messages if you opt-in to text messages, along with associated metadata.
- Vendor Data, including the identity of your Company's vendors and their Business Contact Information, payment details, contracts and purchase orders, and information to complete tax documentation (e.g., the vendor's BIN).
B. Information We Collect AutomaticallyWe automatically collect certain types of information when you interact with our Services, such as when you visit our website or log into your account. We use common information gathering tools, such as tools for collecting usage data, cookies, web beacons and similar technologies to automatically collect information that may contain personal information from your computer or mobile device as you navigate our Services or interact with emails we have sent you. This information includes:
- Usage and interaction information. The full Uniform Resource Locators (URL) clickstream to, through, and from our website (including date and time) and Services, content you viewed or searched for, page response times, download errors, length of visits to certain pages, and page interaction information (such as scrolling, clicks, and mouse-overs).
- Log data and device Information, such as IP address, information about your Internet service provider, computer and device information including device, application, or browser type and version, browser plug-in type and version, operating system, or time zone setting, authentication and security credential information, access dates and times, occurrences of technical errors, diagnostic reports, your settings preferences, backup information, API calls, and other logs.
- Inferred location information. We may look up your IP address to determine your general location.
- Other identifiers and information contained in cookies and similar tracking technologies as described in our Cookie Notice regarding the cookies we use, why we use them, and how you can control and in some cases, disable cookies and other tracking technology in connection with our Website and Services. If you have access to a Modu Dashboard, this information is also available in the Cookie Preferences section of your Settings.
C. Information We Collect from Other SourcesWe collect information about you from other sources, including partners and service providers from whom we receive demographic and business contact information, or who provide us with publicly available information which may contain personal information, as well as customers from whom we receive vendor information. We may combine this information with personal information that you provide. We treat the information obtained from other sources in accordance with any laws or contractual obligations applicable to us. Other sources of information include:
- Financial Institution Partners such as banks (e.g., the bank issuing your Company's card or originating loans to finance Company expenses), card networks, payment processors, money transmitters, or other entities that provide or support delivery of financial services in Kazakhstan.
- Identity Verification, Fraud and Compliance Monitoring, and Financial and Business Information Providers, which may help us supplement our understanding of your business and its personnel, maintain security, prevent fraud and comply with regulation and contractual obligations.
- Vendors transacting with or supporting our business customers (e.g., merchants and accounting firms). For example, a merchant might supply us with their payment details and tax identification number (БИН/ИИН) so our business customers can make bill payments and report on their tax obligations.
- Service Providers, which help us operate our business.
- Social Networks and Advertising Providers, including to help us identify or enrich our understanding of prospective customers, and to serve and measure advertising.
- Joint Marketing, Business Partnership, Referrals, and Rewards Partners that we engage for joint marketing activities and our referrals and rewards programs.
- Other Data Suppliers that provide information about industries, business trends, organizations and other matters related to our business.
- Publicly Available Sources, including information in the public domain that helps us identify potential customers and partners or conduct due diligence and risk management for potential and existing customers.
3. How We Use Your Personal InformationWe use information for business and commercial purposes in accordance with the practices described in this Policy. Purposes for using personal information include:
- Providing and Maintaining Our Services. To provide and deliver, operate, and manage our Services, perform customer validation and enable you to use Modu cards and other payment tools, verify financial information to establish spend limits, process transactions related to our Services, including registrations, purchases, and payments.
- Communicating with you. To communicate with you about our Services via different channels (e.g., by phone or email), send you notices, updates, security alerts, information regarding changes to our policies and terms, and to respond to your requests.
- Measuring, Troubleshooting, and Improving our Services. To provide, maintain, improve and develop our Services, including by measuring their use, analyzing their performance, and preventing or addressing technical issues and disruptions. Improving and expanding our products and operations. For example, we may develop or improve Services by analyzing how you use features, the documentation you submit or information associated with your transactions.
- Preventing and investigating security and fraud issues. To prevent, detect, mitigate, and investigate potential risk, security issues, suspicious activity, as well as fraudulent or unauthorized transactions and breaches of policies and terms, and threats of harm, including in an automated fashion.
- Recommendations and Personalization. To recommend Modu Services that might be of interest to you, identify your preferences, and personalize your experience with Modu Services.
- Rewards. If your Company chooses to participate in our rewards program, to determine eligibility and to facilitate the rewards program effectively.
- Advertising and marketing. To develop, send, and measure advertising, marketing, communications about our products, offers, promotions, rewards, events, Services, and other information based on your preferences. We may also use personal information to administer referral programs, rewards, surveys, sweepstakes, contests, or other promotional activities or events sponsored or managed by Modu or its third-party partners, and to invite you to events and relevant opportunities. For more information about your choices relating to our marketing activities, see “Your Rights and Choices” section below.
- Complying with Legal Obligations. In certain cases, we may have a legal obligation to collect, use, or retain your personal information to fulfill legal, regulatory and contractual obligations, including when cooperating with government authorities, courts and regulators in accordance with applicable law, maintaining records to demonstrate compliance with applicable law and regulation, protecting our legal rights and pursuing remedies available to us.
- Generating Aggregate or De-identified Information. To develop de-identified information by removing or masking information that could be used to identify you and by aggregating or combining information with other information.
- At Your Direction. To fulfill any other purpose at your direction, including as expressed through your or your Company's use of Services functionality. For example, if you direct us to connect your Modu Account to a Third-Party Service, such as Slack or Uber, we will process that request accordingly.
- With Notice to You and Your Consent. We may otherwise use the information we collect after providing notice to you and obtaining your consent for specific purposes communicated to you.
Notwithstanding the above, we may use information that does not identify you for purposes permitted by law or contractual obligation applicable to us. For information on your rights and choices regarding how we use your Personal Information, please see the "Your Rights and Choices" section below.
4. How We Share Your Personal InformationMaintaining your trust over your personal information is a vital part of our relationship with you. We share information we collect in accordance with the practices described in this Privacy Policy. The categories of parties to whom we disclose information are:
Service Providers. We engage third party companies and individuals to perform certain functions on our behalf, for example cloud infrastructure, website hosting, analytics, collaboration and technical support. Depending on the service, we provide information on a continuous basis (e.g., fraud services) or on an as-needed basis. We contractually prohibit our service providers from retaining, using, or disclosing information about you for any purpose other than performing services for us, although we may permit them to use information that does not identify you (including information that has been aggregated or de-identified) for any purpose except as prohibited by applicable law or contractual obligation. Additional information about the subprocessors we use to support delivery of our Services is made available in our Trust Center.
Affiliates. We may share your personal information with our affiliates within the Modu corporate group, as well as companies we may acquire in the future when they become part of the Modu corporate group, in accordance with this Privacy Policy.
Business Customers. We disclose information to our business customers to provide Services on their behalf. For example, we may disclose information to your Company to process your payment transactions, provide Services, report on your use of your Company's Modu Account, respond to your and their questions, comply with your and their requests, and otherwise comply with the law. In addition, your Company can assign different roles to Authorized Users, which will have different associated capabilities and permissions. We will disclose information about your use of the Services to other Authorized Users who may include members of your Company's finance department, your manager, a Company service provider or other Company personnel. Business customers are independent entities and their processing of information is subject to their own policies and terms.
Third Party Services. We make available services and integrations to Third-Party Services and their providers if you or your Company use Third-Party Services in connection with the Services. For example, your Company Authorized User may request integration with third-party applications for payments. You can tell when a third party is involved in your transactions, and we share information related to those transactions with that third party.
Identity Verification and Validation Services. We disclose information as necessary to verify your identity (for example, using IIN/BIN validation in Kazakhstan) and perform other compliance functions in accordance with applicable laws.
Security, Fraud Detection and Compelled Disclosure. We disclose information to comply with the law, regulations, payment network rules, or legal process, investigate suspicious or potentially fraudulent activity, and where required in response to lawful requests by regulators, law enforcement, Financial Institution Partners and public authorities, including to meet national security, anti-money laundering (AML/KYC) or law enforcement requirements. We will also disclose information to protect the rights, property, life, health, security and safety of us, the Services, our Business, or anyone else.
Financial Institution Partners. We disclose information to Financial Institution Partners (for example, partner banks in Kazakhstan such as Bank RBK, Kaspi Bank, or Halyk Bank) to support their customer identification, risk and compliance programs, and so they can determine eligibility for, and provide, products and services to our business customers, either directly or through us. For example, we may disclose your Contact Information, Identifying Data and other Company information and documentation so a Financial Institution Partner can validate your Company's eligibility to receive, and deliver, card, payments, and international transfer capabilities through our Services.
Modu Rewards. We may share personal information about you and your Company's Modu Account as necessary to determine your Company's eligibility for rewards and to facilitate the rewards program effectively.
Marketing and Advertising. We disclose information to vendors, platforms, analytics providers and other parties for marketing and advertising related purposes. For more information on our online advertising practices, see the "Analytics and Advertising" section below. If you connect your bank account to your Company's Modu Account, we will not disclose your bank account Information to market our Business on advertising platforms.
Mergers and Acquisition. If Modu goes through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of its businesses, services, or assets, your personal information may be among the assets transferred. In accordance with applicable laws, we will use reasonable efforts to notify you of any transfer of personal information to an unaffiliated third party.
Referrals and Joint Marketing. We may share information about you and your Company's Modu Account to our partners in connection with facilitating referral partnerships or engaging in joint marketing activities. For example, if you or your Company were referred to us through a referral partner, we may disclose information with our referral partner to confirm the status of your application and to calculate the referral fee.
At Your Request. We may share personal information at your request or direction.
With Notice to You and Your Consent. We may otherwise disclose information after providing notice to you and obtaining your consent.
Notwithstanding the above, we may disclose information that does not identify you (including information that has been aggregated or de-identified) for any purpose except as prohibited by law or contractual obligation applicable to us. For information on your rights and choices regarding how we share information about you, please see the "Your Rights and Choices" section below.
