Data processing addendum (DPA)

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Ledgerly, Inc. (“Ledgerly”) and the customer identified in the account (“Customer”). It applies when Ledgerly processes Customer Personal Data on Customer’s behalf in providing the Services. If there is a conflict between this DPA and the Terms of Service regarding Customer Personal Data, this DPA controls.

1. Definitions

“Customer Personal Data” means personal data or personal information contained in Customer Data that Ledgerly processes on behalf of Customer. “Data Protection Laws” means all privacy and data protection laws that apply to the processing, including the California Consumer Privacy Act as amended and other United States state privacy laws, and, where applicable, the laws of other jurisdictions. “Subprocessor” means any third party engaged by Ledgerly to process Customer Personal Data. Other capitalized terms have the meanings given in the Terms of Service or the Data Protection Laws.

2. Roles of the parties

For Customer Personal Data such as information about Customer’s employees, contractors, customers and suppliers that Customer enters into the Services, Customer is the business or controller and Ledgerly is the service provider or processor. Ledgerly acts independently as a controller of personal data it must collect and keep to meet its own legal obligations, such as identity verification and anti-money laundering records, and that processing is governed by Ledgerly’s Privacy Policy.

3. Processing instructions

Ledgerly will process Customer Personal Data only to provide, secure and support the Services, in accordance with Customer’s documented instructions, which consist of the Terms of Service, this DPA and Customer’s use and configuration of the Services. Ledgerly will not sell or share Customer Personal Data, retain, use or disclose it for any purpose other than providing the Services, or combine it with personal data received from other sources except as permitted by Data Protection Laws. Ledgerly will inform Customer if it believes an instruction infringes those laws.

4. Details of processing

• Subject matter: business finance software and related support

• Duration: the term of the Terms of Service, plus the period until deletion

• Categories of data subjects: Customer’s authorized users, cardholders, employees, contractors, customers and suppliers

• Categories of data: names, contact details, job titles, payment and bank details, transaction records, receipts and invoice contents

• Sensitive data: Customer should not submit sensitive personal data other than what is required to use the Services

5. Confidentiality

Ledgerly will ensure that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations and receive appropriate privacy and security training.

6. Security

Ledgerly will maintain appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration and unauthorized disclosure or access. These measures include encryption of data in transit and at rest, role-based access controls, multi-factor authentication for personnel, logging and monitoring, vulnerability management and business continuity planning, as described further in our Security Overview. Ledgerly may update these measures provided the overall level of protection is not reduced.

7. Subprocessors

Customer authorizes Ledgerly to engage Subprocessors to support the Services. Ledgerly maintains a list of current Subprocessors, available on request from privacy@ledgerly.com, and will notify Customer at least 30 days before adding a new Subprocessor. Customer may object on reasonable data protection grounds within that period, and the parties will work in good faith to resolve the objection. Ledgerly will impose data protection terms on each Subprocessor that are no less protective than this DPA and remains responsible for their performance.

8. Data subject requests

Ledgerly will promptly forward to Customer any request it receives from a data subject relating to Customer Personal Data and will not respond except to direct the individual to Customer, unless required by law. Taking into account the nature of the processing, Ledgerly will provide reasonable assistance to help Customer respond to such requests and to carry out data protection assessments where required.

9. Security incidents

Ledgerly will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of or access to Customer Personal Data. The notice will describe the nature of the incident, the likely consequences and the measures taken or proposed. Ledgerly will take reasonable steps to contain the incident and will cooperate with Customer’s investigation.

10. Return and deletion

Customer may export Customer Data at any time while the account is open. Within 90 days after the account closes, Ledgerly will delete Customer Personal Data from its production systems, except where retention is required by law, including financial recordkeeping laws, in which case Ledgerly will continue to protect it under this DPA and delete it when the retention period ends.

11. Audits

On written request no more than once a year, Ledgerly will provide Customer with its most recent SOC 2 Type II report and reasonable responses to security questionnaires, subject to confidentiality. If these do not reasonably demonstrate compliance, the parties will agree on the scope, timing and cost of any further audit.

12. International transfers

Ledgerly processes Customer Personal Data primarily in the United States. Where Data Protection Laws require a transfer mechanism, the parties agree to use the appropriate standard contractual clauses or other approved safeguards for that transfer.