This Data Processing Agreement ("Agreement") forms part of the Service Agreement between Up Dog, Inc. ("Company"), which provides services under the brand name LedgerUp ("LedgerUp" or "Data Processor"), and the customer entity that accepts this Agreement ("Customer" or "Data Controller"). By using LedgerUp’s services, the Customer agrees to be bound by the terms of this Data Processing Agreement.

For questions regarding this Agreement or to exercise any rights hereunder, please contact us at support@ledgerup.ai.

1. Definitions

"Personal Data": Any information relating to an identified or identifiable natural person.

"Customer Personal Data": Any Personal Data processed by LedgerUp or its Sub-processors on behalf of the Company to perform the Services.

"Processing": Any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion.

"Data Subject": An individual whose Personal Data is processed.

"Sub-processor": Any third party engaged by LedgerUp to process Personal Data on behalf of the Company.

"Data Protection Laws": EU Data Protection Laws, GDPR, and, where applicable, U.S. Privacy Laws including the California Consumer Privacy Act (CCPA).

"EU SCCs": The Standard Contractual Clauses approved by the European Commission for cross-border transfers.

"UK Addendum": The International Data Transfer Addendum to the EU SCCs issued by the UK ICO.

"Personal Data Breach": A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

2. Subject Matter and Duration

LedgerUp shall process Personal Data on behalf of the Company as necessary to provide its billing automation and accounts receivable services. This Agreement remains in effect for the duration of the Service Agreement.

3. Nature and Purpose of Processing

Processing activities include collection, storage, analysis, reporting, and transmission of billing, invoicing, and financial data as required to deliver the Services.

The Company acts as the Data Controller; LedgerUp acts as the Data Processor.

For U.S. Personal Data, the Company acts as a "business" and LedgerUp as a "service provider" under the CCPA.

4. Obligations of LedgerUp (Data Processor)

LedgerUp agrees to:

a. Process Personal Data only on documented instructions from the Company.

b. Ensure personnel authorized to process Personal Data are subject to confidentiality obligations.

c. Implement appropriate technical and organizational security measures, including encryption in transit and at rest, access controls, incident response procedures, and regular security testing.

d. Assist the Company in responding to Data Subject rights requests under GDPR and U.S. Privacy Laws.

e. Notify the Company without undue delay (and within 72 hours where feasible) after becoming aware of a Personal Data Breach.

f. Upon termination, delete or return all Personal Data, unless retention is required by law.

g. Make available information necessary to demonstrate compliance and allow for audits subject to reasonable notice.

5. Sub-processing

LedgerUp may engage Sub-processors for hosting, infrastructure, and ancillary services.

A current list of Sub-processors is available upon request at support@ledgerup.ai.

LedgerUp will notify the Company of changes to Sub-processors and give the Company the opportunity to reasonably object.

6. International Data Transfers

LedgerUp may transfer Personal Data outside the EEA/UK where adequate safeguards (such as EU SCCs and the UK Addendum) are in place.

LedgerUp shall not transfer Personal Data without such safeguards.

7. Data Retention

Customer Personal Data will be retained only for as long as necessary to provide the Services or as required by applicable laws.

After termination, data will be deleted or returned in accordance with Section 4(f).

8. Governing Law and Jurisdiction

This Agreement shall be governed by and construed in accordance with the laws of California, USA, and any disputes shall be subject to the exclusive jurisdiction of the courts of California.

By using LedgerUp’s services, the Company agrees to the terms of this Data Processing Agreement.