Money Made Intelligent.This Data Processing Agreement ("DPA") applies to the processing of personal data subject to the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection (together, "Data Protection Laws") in connection with Milli's Services. It forms part of the Terms of Service and, for business partners, any services agreement that references it.
1. Roles of the Parties
- Milli as controller. For individual users of the Milli apps and website, Milli acts as an independent controller of personal data and processes it as described in our Privacy Policy.
- Milli as processor. Where Milli processes personal data on behalf of a business customer or partner (for example, an accounting firm or platform that provides Milli to its workers), the business is the controller and Milli acts as a processor, processing personal data only on the controller's documented instructions.
2. Details of Processing (Processor Role)
| Subject matter | Provision of the Milli Services |
| Duration | The term of the services agreement plus any retention period required by law |
| Nature and purpose | Hosting, storage, analysis, tax reserve and estimate calculations, mileage logging, reporting, AI-assisted insights, and support |
| Categories of data | Identifiers, contact details, financial account and transaction data, income data, location data, and support communications |
| Data subjects | The controller's workers, contractors, and end users |
| Special categories | None intended. Milli does not process biometric data. |
3. Processor Obligations
When acting as processor, Milli will: 1. process personal data only on documented instructions from the controller, unless required by law; 2. ensure personnel authorized to process personal data are bound by confidentiality; 3. implement appropriate technical and organizational measures under Article 32 GDPR, as described in our Data Security Policy; 4. engage subprocessors only as described in Section 4; 5. assist the controller in responding to data subject requests; 6. assist the controller with security, breach notification, data protection impact assessments, and prior consultations; 7. delete or return personal data at the end of the services, unless retention is required by law; and 8. make available information necessary to demonstrate compliance and allow for and contribute to audits, including through independent audit reports once Milli's certifications in process are completed.
4. Subprocessors
The controller provides general authorization for Milli to engage subprocessors. Milli imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains liable for their performance. Current subprocessor categories:
| Subprocessor | Purpose | Location |
|---|---|---|
| Plaid Inc. | Financial account connectivity and data retrieval | United States |
| Cloud infrastructure provider | Application hosting, databases, and encrypted storage | United States |
| Identity verification provider | KYC verification for Milli Elite Card features | United States |
| Card issuing bank and processor | Milli Elite Card issuance and transaction processing | United States |
| AI infrastructure provider | Processing Milli AI requests under zero-retention, no-training terms | United States |
| Email and communications provider | Transactional email and notifications | United States |
| Website hosting provider | Website hosting for drivemilli.com | United States |
| Apple Inc. and Google LLC | App distribution and subscription billing | United States |
The full list of subprocessor entity names is available on request at support@drivemilli.com. Milli will notify controllers at least 30 days before adding or replacing a subprocessor, and the controller may object on reasonable data protection grounds.
5. International Data Transfers
Personal data may be transferred to and processed in the United States. Such transfers are made under the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module One (controller to controller) or Module Two (controller to processor) as applicable, the UK International Data Transfer Addendum, and the Swiss amendments to the Standard Contractual Clauses, which are incorporated into this DPA by reference. Milli conducts transfer impact assessments and applies supplementary measures such as encryption.
6. Personal Data Breach
Milli will notify the controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the controller's personal data, so that the controller can meet its 72-hour notification obligation under Article 33 GDPR. Where Milli is controller, Milli will notify the competent supervisory authority within 72 hours and affected individuals without undue delay where required. Notifications will describe the nature of the breach, categories and approximate numbers affected, likely consequences, and measures taken.
7. Data Subject Rights
Individuals may exercise rights of access, rectification, erasure, restriction, portability, and objection by contacting support@drivemilli.com. Where Milli is a processor, it will forward requests to the controller and assist as needed.
8. EU and UK Representative
Where required under Article 27 GDPR or the UK GDPR, Milli will appoint a representative and publish its contact details on this page.
9. Order of Precedence
If there is a conflict between this DPA and any other agreement, this DPA controls with respect to the processing of personal data. If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses control.
10. Contact
Data protection inquiries: support@drivemilli.com, subject line "Data Protection."
© 2026 Milli. All rights reserved. Questions about this document can be sent to support@drivemilli.com.