Prisma for Business Privacy Policy

Last update: July 9, 2026

This Privacy Policy explains how data is processed in Prisma for Business (Prisma Empresas), a version or service line oriented to companies, teams, staffing agencies, organizations, worker platforms, delivery rider applications, employees, collaborators, freelancers, or professional groups. Prisma for Business allows organizations to offer financial control tools, income and expense tracking, budgets, advances, reports, financial habits, financial education, analysis, or financial wellbeing to users linked to a company or entity.

1. Scope of Application

This policy applies to Prisma for Business and any associated B2B service, including:

Administration panels and corporate accounts.
Users invited by a company.
Web dashboards and aggregated reports.
Financial wellbeing programs.
Analysis features, alerts, financial education, or economic organization.
Technical integrations with companies or platforms.

Prisma's general Privacy Policy may also apply when a user uses the application on an individual or personal basis.

2. Privacy Roles

Depending on the case, Prisma may act as:

2.1 Data Controller

Prisma will be the data controller when it decides the purposes and means of processing, for example: management of Prisma's own accounts, service security, technical support, commercial management, billing, product improvement, own communications, and legal compliance.

2.2 Data Processor

Prisma may act as a data processor when it processes personal data following instructions from a client company, for example: users created or invited by a company, data associated with a corporate program, information managed within a business space, or reports or configurations defined by the contracting organization.

In those cases, the client company will be the data controller and Prisma will process the data in accordance with the contract, data processing agreement, or documented instructions.

3. Data Processed by Prisma for Business

Prisma for Business may process the following categories of data, depending on the configuration of the contracted service:

3.1 Identifying and Contact Data

First and last name.
Email address.
User ID.
Company, team, center, department, or group.
Role within the platform and invitation, activation, or access status.

3.2 Professional or Company Relationship Data

Depending on the contracted service, data may be processed such as: user type (employee, collaborator, freelancer, rider, temporary worker, etc.), associated company or entity, group, team, or segment, configuration assigned by the company, and participation status in internal programs.

Using Prisma, its metrics, outcomes or any inference for employment decisions is prohibited.

3.3 Financial Data Entered by the User

The user may enter information such as: expenses, income, budgets, goals, debts, net worth, subscriptions, categories, alerts, and receipts, invoices, or documents.

The company never receives users’ detailed personal financial data. It receives only aggregated usage and outcome metrics; protected metrics are suppressed for cohorts of fewer than 20 people.

3.4 Aggregated or Statistical Data

Prisma for Business may generate aggregated reports for the organization, such as: general platform usage, user activation, program participation, aggregated financial wellbeing metrics, global non-individualized trends, and statistical segments when a sufficient basis exists to prevent identification.

Reports must not reveal individual personal financial information or cross-sponsor membership information.

3.5 Technical Data

Data may be processed such as: device, operating system, application version, IP address, date and time of access, technical events, errors, security logs, session identifiers, and performance information.

4. Purposes of Processing

Prisma for Business may process data for the following purposes:

Creating and administering corporate accounts and inviting/managing users.
Providing the contracted service and allowing access to the dashboard or business panel.
Displaying personal financial information to the user themselves.
Generating aggregated reports for the company.
Managing technical support.
Maintaining security and preventing abuse.
Measuring service usage and performance and detecting errors.
Managing billing and the commercial relationship.
Complying with legal obligations.
Improving functionalities and developing new features (preferably with aggregated/anonymized data).

5. Legal Basis

The legal basis will depend on the context and Prisma's role.

When Prisma acts as controller, processing may be based on: performance of contract, user consent, legitimate interest, and compliance with legal obligations.

When Prisma acts as processor, the primary legal basis will be determined by the client company as data controller.

6. Company Access to User Data

The contracting organization may access license, billing and operational statuses and aggregated usage and outcome metrics needed to administer the service. Protected metrics are suppressed for cohorts of fewer than 20 people.

The company does not receive personal financial records, amounts, user text, UID or employee email, or cross-sponsor membership information.

7. Confidentiality and Separation of Data

Prisma will apply reasonable measures to separate personal data, company data, and aggregated data.

Internal access will be limited to personnel or providers who need to process the information to provide, maintain, or protect the service.

8. Providers

Prisma for Business may use technical providers for cloud infrastructure, authentication, database, hosting, technical analytics, monitoring, security, payments and billing, and support.

These providers may include Google Firebase, Google Cloud, Stripe, or equivalent services. When necessary, Prisma will formalize data processing agreements with providers acting as processors.

9. International Transfers

Some providers may process data outside the European Economic Area. In that case, appropriate safeguards will be applied in accordance with current regulations, such as standard contractual clauses or other legally recognized mechanisms.

10. Retention

Data will be retained as long as a contractual relationship, active account, or operational need exists.

Subsequently, they may be retained for the periods necessary to comply with legal obligations, address claims, prevent fraud, maintain security, manage billing, and accredit contractual compliance.

Aggregated or anonymized data may be retained for analysis, product improvement, or statistics, provided they do not allow the identification of specific users.

11. Users' Rights

Users can exercise their rights of access, rectification, erasure, objection, restriction, portability, and withdrawal of consent where appropriate.

If processing depends on a client company, Prisma may forward the request to that company or act following its instructions.

To exercise rights you can contact at: contact@prismfinance.eu. You can also address the company or organization that invited you to use Prisma for Business.

12. Security

Prisma for Business will apply reasonable technical and organizational measures to protect data against unauthorized access, loss, alteration, or disclosure.

These measures may include access controls, authentication, technical logs, logical separation, encryption where appropriate, permission reviews, and secure development best practices.

13. Use of Artificial Intelligence

Prisma for Business may incorporate artificial intelligence features to generate analysis, alerts, reports, data classification, or recommendations.

AI results are advisory and may contain errors. They should not be used as the sole basis for relevant decisions regarding people, employment, working conditions, performance evaluation, creditworthiness, credit, or individual economic situation.

Any business use of AI that could significantly affect users must be previously evaluated by the responsible company and comply with applicable regulations.

14. Contractual and Technical Prohibition on Employment Decisions

Using Prisma for Business, its metrics, outcomes, or any inference to make or support hiring, dismissal, promotion, pay, evaluation, discipline, opportunity allocation, or any other employment decision is prohibited. This prohibition forms part of the service terms, the DPA, and the notice every administrator must accept.

As a technical safeguard, the administration dashboard exposes no personal financial records, amounts, text, UID, or employee email. Usage and outcome metrics are generated in aggregate and suppressed when a cohort contains fewer than 20 people.

15. Changes to This Policy

We may update this Prisma for Business Privacy Policy to reflect legal, technical, contractual, or functional changes.

When changes are relevant, they will be communicated to client companies or affected users through the corresponding channels.

16. Contact

For inquiries regarding privacy in Prisma for Business, you can contact at: contact@prismfinance.eu