This Addendum is part of the agreement between LEDGESPACE PRIVATE LIMITED (CIN U58202KA2026PTC221276), 725/9, G. Floor, 3rd Cross, Near Ashraya Mane, Bogadi, Mysore, Mysore - 570026, Karnataka, India ("LedgeSpace", the processor) and the agency that accepted our Terms of Service ("Customer", the controller). It applies automatically whenever LedgeSpace processes personal data on the Customer's behalf, and it forms part of the Terms.
1. Roles
The Customer decides why and how personal data is processed. LedgeSpace processes it only to provide the service.
2. Instructions
LedgeSpace processes personal data only on the Customer's documented instructions, which are the Terms, this Addendum and the Customer's use of the product. If an instruction would break the law, we will say so.
3. The Customer's Duties
The Customer confirms it has a lawful basis for the data it connects, and permission from its own clients to connect their accounts and email them reports.
4. Confidentiality
People who can access the data are bound by confidentiality duties.
5. Security
LedgeSpace applies the measures in Annex II.
6. Sub-processors
The Customer authorises the sub-processors listed on our sub-processors page. LedgeSpace has written terms with them that require equivalent data protection, and remains responsible for them. We will give notice before changing the list. If the Customer objects on reasonable data-protection grounds and we cannot resolve it, the Customer may cancel.
7. Requests From Individuals
If LedgeSpace receives a request from someone about the Customer's data, we will pass it to the Customer without undue delay, and help the Customer respond using the tools in the product.
8. Breaches
LedgeSpace will tell the Customer without undue delay, and within 48 hours of becoming aware, of a personal-data breach that affects the Customer's data, with the information we have, so the Customer can meet its own deadlines.
9. Help With Compliance
LedgeSpace will give reasonable help with impact assessments and consultations with regulators.
10. Return and Deletion
When the subscription ends, the account is read-only for 15 days and then locks (see the Terms). The Customer can ask us at any time to delete its data, and we do so within 30 days (see our Data Deletion page). Invoices and tax records are kept as the law requires. Until the Customer asks for deletion, data is retained so the Customer can return.
11. Information and Audits
LedgeSpace will give the Customer the information needed to show compliance with this Addendum, and will allow a reasonable audit once a year with 30 days' written notice, at the Customer's cost.
12. International Transfers
LedgeSpace is in India, the application runs in Singapore, and the database is in India. For personal data that is covered by the EU or UK GDPR, the Standard Contractual Clauses (Module Two, controller to processor) approved by the European Commission, and the UK International Data Transfer Addendum, are incorporated into this Addendum. The Customer is the data exporter and LedgeSpace is the data importer. Annex I and Annex II complete them. The governing law and courts for the Standard Contractual Clauses are those of Ireland.
13. Liability and Law
Liability under this Addendum is subject to the limits in the Terms. Indian law governs, except where the Standard Contractual Clauses require otherwise.
14. Duration
This Addendum lasts as long as LedgeSpace processes the Customer's personal data.
Annex I: Details of Processing
- Subject and purpose: automated reporting, dashboards and AI insights for the Customer's agency work.
- Duration: the subscription, plus the period described in section 10.
- Whose data: the Customer's own users; the people the Customer sends reports to (its clients' contacts); and individuals in the aggregated platform data the Customer connects.
- Types of data: names and work email addresses; report-recipient email addresses; usage and report-link activity; and aggregated marketing, advertising, analytics and CRM metrics.
- Sensitive data: none is intended, and the Customer must not upload any.
- Frequency: continuous while the account is active.
Annex II: Security Measures
- Connection tokens and email passwords are encrypted with AES-256-GCM.
- Account sign-in uses Google; passwords for optional client history pages are hashed.
- The service uses TLS (HTTPS), and the database provider encrypts stored data at rest.
- Each agency's data is kept separate from other agencies' data, and access is limited to authorised staff.
- OAuth access to connected platforms is read-only.
- Errors and activity are logged and monitored.
Contact
Questions about this Addendum: hello@ledgespacehq.com.
