Terms of Service

These Terms of Service (the Terms) govern access to and use of Ledger Bridge, including the website at ledgerbridge.si, the web application, the Ledger Bridge API and all related services (the Service). Please read them carefully, in particular clause 10 (No advice), clause 11 (Inputs, outputs and your review), clause 20 (Disclaimers), clause 21 (Limitation of liability), clause 22 (Indemnity) and clause 25 (Governing law and disputes).

1. About these Terms

1.1 Ledger Bridge is operated by the sole proprietor identified in the operator details at the end of these Terms (Ledger Bridge, we, us, our).

1.2 These Terms form a binding agreement between Ledger Bridge and the business, firm or other organisation that creates an account or uses the Service (Customer, you, your). By creating an account, clicking to accept, purchasing a Year-File or using the Service, you agree to these Terms.

1.3 If you accept these Terms on behalf of a firm or other organisation, you confirm that you have authority to bind it, and “you” means that organisation. If you do not have that authority, or do not agree to these Terms, you must not use the Service.

1.4 These Terms incorporate the Privacy Policy and the Data Processing Agreement in Schedule 1 (the DPA).

2. Definitions

In these Terms:

“API” means the Ledger Bridge application programming interface and related documentation, through which the Service can be accessed programmatically.

“API Key” means any API key, access token or other credential issued for access to the API.

“Authorised User” means an individual (such as an employee or contractor of the Customer) whom the Customer permits to access the Service under its account.

“Client” means any person or entity on whose behalf, or in respect of whose books and records, the Customer uses the Service.

“Customer Data” means all data, files and information that you or your Authorised Users upload, submit or make available to the Service, including Source Files and Client data.

“Customer Rules” means the counterparty maps, hash rules, account mappings and similar rules and settings that you create in the Service, including any mapping file exported for later periods.

“Export” means the generation and download of journal files, chart of accounts files or other Outputs from a Year-File.

“Fees” means the amounts payable for the Service as shown on the Pricing Page or at checkout.

“Outputs” means the journals, journal CSV files, chart of accounts import files, mapping files, exception lists, reports and other results that the Service produces from Customer Data.

“Pack” means a prepaid bundle of Year-Files purchased together, as described on the Pricing Page.

“Pricing Page” means the pricing page at ledgerbridge.si/pricing, as updated from time to time.

“Service” means the Ledger Bridge website, web application, API, Outputs functionality, support and related services.

“Source File” means a transaction, capital gains or similar file exported from tax or other software (such as Koinly or Summ) or a generic CSV file that you upload.

“Third-Party Service” means any product, platform or service not provided by Ledger Bridge, including Koinly, Summ, Awaken, Xero, QuickBooks Online (Intuit), Stripe, Google and any exchange, wallet or blockchain.

“Year-File” means the right to Export for one company (or other entity) for one tax year or review period.

3. The Service

3.1 Ledger Bridge is a software tool for accounting firms, bookkeepers and businesses. It imports Source Files from Koinly, Summ or a generic CSV format; classifies and maps transactions using Customer Rules; reconciles them; and produces balanced, traceable journal files designed for import into Xero and QuickBooks Online, together with related chart of accounts and mapping files.

3.2 The Service is available through the web application and, where enabled for your account, through the API. Outputs are provided as files for you to review and import yourself. Unless a feature expressly states otherwise, the Service does not post entries into your or your Client’s accounting system.

3.3 The Service reproduces, maps and checks figures contained in the Source Files. It does not create cost basis, proceeds or gains that are not in the Source Files. Where a figure is missing or a transaction cannot be mapped on the basis of Customer Rules, the Service flags it or places it in suspense for your review.

3.4 We may update, improve or change features of the Service from time to time. Features that are described as beta, preview, parked or not yet certified (for example, support for Awaken files) are provided for evaluation only, on an “as is” basis, and may be changed or withdrawn at any time.

4. Business use only

4.1 The Service is provided only for professional and business purposes. It is not intended for personal, household or consumer use, and you confirm that you are acquiring the Service for the purposes of a business.

4.2 You and each Authorised User must have legal capacity to enter into contracts in your jurisdiction.

5. Accounts, Authorised Users and security

5.1 You must provide accurate and complete account information and keep it up to date.

5.2 You decide who your Authorised Users are and which companies and workspaces they can access. You are responsible for all acts and omissions of your Authorised Users, and for all activity under your account, as if they were your own.

5.3 You must keep passwords, two-factor authentication methods and API Keys confidential, must not share log-in credentials between individuals, and must notify us promptly at team@ledgerbridge.si if you become aware of any unauthorised access to your account. We strongly recommend that all Authorised Users enable two-factor authentication.

5.4 We are not liable for any loss arising from unauthorised use of your account or credentials, except to the extent caused by our breach of these Terms.

6. Acting for your Clients

6.1 Where you use the Service for a Client, you represent, warrant and undertake that:

1. you have a valid engagement with, or other lawful authority from, that Client to process its data and to produce accounting entries for it;
2. you have given all notices and obtained all consents and authorisations required by law, professional rules or contract to upload the Client’s data (including any personal data) to the Service and to have it processed as described in these Terms, the Privacy Policy and the DPA; and
3. your use of the Service complies with the professional, ethical and regulatory obligations that apply to you, including any confidentiality obligations you owe to the Client.

6.2 The relationship with your Clients is yours alone. We have no contract with, and owe no duty of care to, your Clients. Your Clients are not third-party beneficiaries of these Terms and may not enforce them. You are solely responsible for the advice, deliverables and entries you provide to your Clients.

7. Year-Files and Packs

7.1 Reviewing a file in the Service is free. A Year-File must be purchased before you can Export for that company and that tax year or review period.

7.2 A Year-File covers one company (or other entity) and one tax year or review period. Re-imports and re-exports of the same company and period are included at no extra charge until the file is posted. A new period, or a new company, requires a separate Year-File.

7.3 Pack Year-Files may be applied to any company or period. Unused Year-Files in a Pack do not expire while your account remains active and we continue to offer the Service.

7.4 Row limits, support levels, workshops and other plan features are as described on the Pricing Page at the time of purchase.

7.5 Subject to these Terms and payment of the applicable Fees, we grant you a non-exclusive, non-transferable, non-sublicensable right during the term of these Terms for your Authorised Users to access and use the Service for your internal business purposes, including to provide services to your Clients.

8. Fees, payment and taxes

8.1 Fees are set out on the Pricing Page and confirmed at checkout. At the date of these Terms, the Pricing Page offers a single Year-File (Close) at USD 490, a Pack of three Year-Files (Practice) at USD 390 per file and a Pack of ten Year-Files (Desk) at USD 290 per file. If the Pricing Page and the checkout differ, the checkout price applies to your purchase.

8.2 Purchases are one-time purchases, not subscriptions, and do not renew automatically.

8.3 All Fees are stated and payable in United States dollars (USD) and are exclusive of taxes. Where applicable, goods and services tax (GST), value added tax (VAT), sales tax or similar taxes will be added to the Fees and are payable by you. If you are required by law to withhold any tax from a payment, you must gross up the payment so that we receive the full amount of the Fees.

8.4 Payments are processed by Stripe or another payment processor we select, subject to its own terms. We do not receive or store your full card details.

8.5 We may change our prices at any time. A price change does not affect Year-Files or Packs already purchased.

9. Refunds

9.1 Because you can import and review your own file free of charge before purchase, Fees for a Year-File are non-refundable once Export has been unlocked for that Year-File.

9.2 Nothing in these Terms excludes or limits any right to a refund or other remedy that you have under applicable law and that cannot lawfully be excluded or limited.

10. No tax, legal or accounting advice

10.1 Ledger Bridge is a software tool. It is not a tax adviser, accountant, auditor, lawyer, broker or financial adviser, and the Service and Outputs do not constitute tax, legal, accounting, audit, investment or other professional advice.

10.2 The Service does not set accounting policies, determine fair value or other measurement bases, decide how any transaction should be treated for tax or accounting purposes, or verify the correctness of calculations made by Koinly, Summ or any other Third-Party Service.

10.3 You remain solely responsible for all professional judgements, accounting policies, tax positions, filings and sign-offs, and for the work you deliver to your Clients. A suitably qualified professional at your firm must review and approve all Outputs before they are relied on.

10.4 No professional engagement, fiduciary relationship or duty of care arises between you (or your Clients) and Ledger Bridge or its personnel from use of the Service, support, workshops or any communication with us, regardless of any professional qualification that our personnel may hold.

11. Inputs, outputs and your review

11.1 The accuracy and completeness of Outputs depend on the Source Files, Customer Rules, chart of accounts and other inputs you provide. You are solely responsible for those inputs.

11.2 We do not warrant that Outputs are complete, accurate or free of errors, that they comply with any accounting standard or tax law, or that they will be accepted by Xero, QuickBooks Online or any other system.

11.3 You must review, reconcile and tie out all Outputs before importing or posting them to any accounting system, filing any return or providing them to a Client. You are responsible for checking the result of any import, including how the importing system treats journal dates and groupings.

11.4 Any loss arising from posting, filing or relying on Outputs that you have not reviewed and approved is your responsibility.

12. API access

12.1 Where API access is enabled for your account, you may use the API only in accordance with these Terms and any API documentation we publish. API access is part of the Service and is subject to all of these Terms.

12.2 API Keys. API Keys are confidential and are your responsibility. You must store them securely, must not embed them in public code or share them outside your organisation, and must revoke and replace any API Key you believe may have been compromised. All activity using your API Keys is treated as activity by you. You must not use an API Key to exceed the access scope granted to it.

12.3 Rate limits. We may set and change rate limits, quotas and other usage limits for the API at any time, as described in the documentation or notified to you. You must not attempt to circumvent them.

12.4 Connected applications. If you connect a third-party application or AI client to the Service using an API Key, that application is a Third-Party Service acting on your instructions. You are responsible for its actions within your account and for its handling of any data it receives, and we are not responsible for its outputs.

12.5 Suspension. We may suspend, throttle or revoke API access or any API Key immediately and without liability if we reasonably believe it is necessary to protect the Service, other customers or any data, if usage exceeds applicable limits, or if you breach these Terms.

12.6 Availability. The API is provided “as is” and “as available”. We do not warrant that the API will be available, uninterrupted, error-free or backward compatible, and we may modify or discontinue API endpoints or versions.

13. Third-Party Services

13.1 Koinly, Summ, Awaken, Xero, QuickBooks Online, Intuit, Stripe, Google and other Third-Party Services are not affiliated with, endorsed by or sponsored by Ledger Bridge, and Ledger Bridge is not affiliated with, endorsed by or sponsored by them. All product names, trademarks and logos are the property of their respective owners and are used only to describe compatibility.

13.2 Your use of any Third-Party Service is governed by that provider’s own terms and privacy policy. We are not responsible for the availability, accuracy, security, data handling or conduct of any Third-Party Service, or for any changes a provider makes to its export formats, import tools or APIs that affect the Service.

13.3 Where you choose to connect a Third-Party Service to the Service, you authorise us to exchange data with it on your behalf to the extent needed for that connection. You may disconnect at any time. Data already transferred to a Third-Party Service is subject to that provider’s terms.

14. Acceptable use

You must not, and must ensure that your Authorised Users and connected applications do not:

1. use the Service for any unlawful, fraudulent or misleading purpose, including to conceal the source of funds, facilitate money laundering or evade tax;
2. upload data that you do not have the right to upload, or that infringes the rights of any person;
3. upload viruses, malicious code or anything designed to disrupt, damage or gain unauthorised access to the Service or any system;
4. interfere with, overload or disrupt the Service, or probe, scan or test its vulnerability without our written consent;
5. copy, modify, decompile, disassemble or reverse engineer the Service, except to the extent this restriction is prohibited by law;
6. scrape the Service, or access it by automated means other than through the API in accordance with these Terms;
7. use the Service, its Outputs or its documentation to build or benchmark a competing product or service;
8. resell, sublicense or provide the Service on a stand-alone basis to third parties, other than delivering Outputs to your own Clients as part of your services; or
9. use the Service in breach of applicable sanctions or export control laws, or for the benefit of any person subject to such sanctions.

15. Customer Data and ownership

15.1 As between you and us, you own the Customer Data and the Outputs generated from it, and you own your Customer Rules.

15.2 You grant us a worldwide, non-exclusive, royalty-free licence to host, store, copy, process, transmit and display Customer Data, Customer Rules and Outputs to the extent necessary to provide, secure, support and maintain the Service, and as otherwise described in these Terms, the Privacy Policy and the DPA.

15.3 No AI training. We do not use Customer Data to train, fine-tune or improve artificial intelligence or machine learning models unless you give us explicit opt-in permission to do so. You may withdraw that permission at any time for future use.

15.4 Usage statistics. We may collect and derive anonymised and aggregated statistics about the use and performance of the Service, which do not identify you, your Clients or any individual, and use them to operate, secure and improve the Service. Such statistics are not Customer Data.

15.5 Support access. Our support personnel access a workspace only where you explicitly grant temporary support access. Such access uses an isolated copy of the relevant workspace, no change is made to your records unless you review and approve it, and the copy is deleted automatically when the grant expires or you revoke it.

15.6 You are responsible for maintaining your own copies of Source Files and Outputs. We are not a backup or archiving service.

15.7 We may access, preserve or disclose Customer Data where required by law or by a binding order of a competent authority, and will, where legally permitted, notify you.

16. Data protection

16.1 Customer Data is stored on servers located in the European Union. The Service is hosted and deployed using Hostinger as our hosting provider.

16.2 In respect of personal data contained in Customer Data, you are the controller (or, where you act for a Client, a processor on behalf of that Client) and Ledger Bridge is your processor (or sub-processor). The DPA in Schedule 1 applies to that processing and forms part of these Terms.

16.3 Our handling of the personal data of account holders and Authorised Users for our own purposes (such as account management, security and billing) is described in our Privacy Policy.

17. Confidentiality

17.1 Each party will keep confidential all non-public information received from the other party that is marked as confidential or would reasonably be understood to be confidential (Confidential Information), will use it only for the purposes of these Terms, and will disclose it only to its personnel, contractors and professional advisers who need to know it and are bound by equivalent obligations. Customer Data is your Confidential Information.

17.2 These obligations do not apply to information that is or becomes public through no breach of these Terms, was lawfully known to the recipient before disclosure, is independently developed, or is lawfully received from a third party without restriction. A party may disclose Confidential Information where required by law, after giving the other party notice where legally permitted.

18. Intellectual property and feedback

18.1 Ledger Bridge and its licensors own all rights, title and interest, including all intellectual property rights, in the Service, the software, the API, the documentation, the posting method, the built-in chart of accounts and CSV templates, and all improvements to them. No rights are granted to you except as expressly set out in these Terms.

18.2 If you provide suggestions or feedback about the Service, we may use them freely and without any obligation to you.

19. Availability and support

19.1 We aim to keep the Service available but do not guarantee any level of availability or uptime. The Service may be unavailable during maintenance, updates or events outside our reasonable control.

19.2 Support is provided through the channels and within the response times described for your plan on the Pricing Page. Response times are targets, not guarantees.

20. Disclaimers

20.1 TO THE FULLEST EXTENT PERMITTED BY LAW, THE SERVICE, THE API AND ALL OUTPUTS ARE PROVIDED “AS IS” AND “AS AVAILABLE”, WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND.

20.2 TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, CONDITIONS AND REPRESENTATIONS, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING ANY WARRANTY OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, NON-INFRINGEMENT, AND ANY WARRANTY THAT THE SERVICE WILL BE UNINTERRUPTED, SECURE OR ERROR-FREE OR THAT OUTPUTS WILL BE CORRECT, COMPLETE OR ACCEPTED BY ANY THIRD-PARTY SYSTEM.

20.3 Each party warrants that it has the right and authority to enter into these Terms.

21. Limitation of liability

21.1 TO THE FULLEST EXTENT PERMITTED BY LAW, LEDGER BRIDGE (INCLUDING ITS OPERATOR, PERSONNEL, CONTRACTORS AND SUPPLIERS) WILL NOT BE LIABLE TO YOU OR ANY THIRD PARTY, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), BREACH OF STATUTORY DUTY OR OTHERWISE, FOR ANY:

1. indirect, incidental, special, consequential, exemplary or punitive loss or damage;
2. loss of profits, revenue, business, contracts, goodwill, reputation or anticipated savings;
3. loss, corruption or unavailability of data, or costs of restoring data;
4. tax, interest, penalties, fines, surcharges or assessments imposed by any authority, or costs of amending any return, filing or set of accounts;
5. loss arising from any posting, filing or decision made in reliance on Outputs, whether or not reviewed;
6. loss caused by Source Files, Customer Rules or other inputs, or by any Third-Party Service; or
7. claims made against you by your Clients or any other third party,

in each case even if we were advised of the possibility of such loss.

21.2 TO THE FULLEST EXTENT PERMITTED BY LAW, OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR IN CONNECTION WITH THESE TERMS, THE DPA AND THE SERVICE, FOR ALL CLAIMS TAKEN TOGETHER, WILL NOT EXCEED THE TOTAL FEES PAID BY YOU TO US IN THE THREE (3) MONTHS IMMEDIATELY BEFORE THE EVENT GIVING RISE TO THE FIRST CLAIM OR, IF YOU PAID NO FEES IN THAT PERIOD, USD 100.

21.3 Nothing in these Terms excludes or limits any liability that cannot be excluded or limited under applicable law, including liability for fraud or for death or personal injury caused by negligence. Where applicable law implies a guarantee or right that cannot be excluded but can be limited, our liability is limited, at our option, to supplying the relevant Service again or paying the cost of having it supplied again.

21.4 The limitations in this clause 21 reflect the allocation of risk between the parties and the Fees charged, and apply even if a limited remedy fails of its essential purpose.

22. Indemnity

22.1 You will defend, indemnify and hold harmless Ledger Bridge, its operator, personnel, contractors and suppliers from and against all claims, demands, proceedings, losses, damages, liabilities, fines, penalties, costs and expenses (including reasonable legal fees) arising out of or in connection with:

1. Customer Data, Customer Rules or any other inputs you provide, including any claim that their upload or processing infringes the rights of any person or breaches any law;
2. any lack of engagement, authority, notice or consent required under clause 6 or the DPA;
3. any claim by a Client or other third party relating to services, advice, entries, filings or deliverables you provide, including any made using Outputs;
4. your or your Authorised Users’ breach of these Terms or of applicable law, including data protection, professional and sanctions laws; or
5. the use of your account, credentials or API Keys, or of any application you connect to the Service.

22.2 We will notify you of any claim for which we seek indemnity and may, at our option, conduct the defence of that claim. You will not settle any claim that imposes an obligation or admission on us without our prior written consent.

23. Suspension and termination

23.1 You may stop using the Service at any time and may request closure of your account by contacting us.

23.2 We may suspend or terminate your access to all or part of the Service, with or without notice and without liability, if you breach these Terms, fail to pay any Fees, create a security or legal risk for us or other customers, or if required by law. Where reasonably practicable, we will give you notice and an opportunity to remedy a breach before termination.

23.3 We may discontinue the Service by giving you reasonable advance notice. If we discontinue the Service for reasons other than your breach, we will refund the Fees paid for any unused Year-Files in a Pack.

23.4 On termination or closure, your right to use the Service ends. We will give you a reasonable period to download your Outputs and Customer Rules where your account was not terminated for breach, after which we will delete Customer Data in accordance with the DPA, except where retention is required by law. Security and activity logs may be retained for audit and security purposes.

23.5 Clauses 6, 9, 10, 11, 15, 17, 18, 20, 21, 22, 25, 26 and Schedule 1 (to the extent relevant), and any other provision that by its nature should survive, survive termination.

24. Changes to these Terms

24.1 We may amend these Terms from time to time. We will update the effective date and, for material changes, give you reasonable advance notice by email or in the Service.

24.2 If you continue to use the Service after the changes take effect, you accept the amended Terms. If you do not agree, you must stop using the Service. Changes do not affect Year-Files already exported before the change takes effect.

25. Governing law and disputes

25.1 These Terms, the DPA and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with them or the Service are governed by the laws of India.

25.2 The parties will first attempt to resolve any dispute through good-faith negotiation, which either party may start by written notice to the other.

25.3 If the dispute is not resolved by negotiation, either party may refer it to arbitration under the Arbitration and Conciliation Act, 1996. The arbitration will be conducted by a sole arbitrator appointed by agreement of the parties or, failing agreement, in accordance with that Act. The seat and venue of arbitration will be Surat, Gujarat, the language of the arbitration will be English, and the award will be final and binding on the parties.

25.4 Subject to clause 25.3, the courts at Surat, Gujarat have exclusive jurisdiction over any dispute arising out of or in connection with these Terms, including any application in support of arbitration. Nothing in this clause prevents us from seeking urgent injunctive or equitable relief, or from recovering unpaid Fees, in any court of competent jurisdiction.

25.5 The United Nations Convention on Contracts for the International Sale of Goods does not apply to these Terms.

26. General

26.1 Entire agreement. These Terms, the Privacy Policy, the DPA and any order confirmation are the entire agreement between the parties about the Service and supersede all prior understandings. If there is a conflict, the DPA prevails in relation to the processing of personal data, and otherwise these Terms prevail.

26.2 Assignment and subcontracting. You may not assign or transfer these Terms without our prior written consent. We may assign or transfer these Terms, and may use subcontractors and service providers to provide the Service.

26.3 Force majeure. We are not liable for any failure or delay caused by events beyond our reasonable control, including failures of hosting providers, networks, power or Third-Party Services.

26.4 Severability and waiver. If any provision is held invalid or unenforceable, it will be enforced to the maximum extent permissible and the remaining provisions remain in effect. A failure or delay in enforcing any right is not a waiver of it.

26.5 Relationship. The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, employment or fiduciary relationship.

26.6 Third parties. No person other than you and Ledger Bridge has any right to enforce these Terms.

26.7 Notices. We may give notices to the email address on your account or through the Service. You must give legal notices to us by email to legal@ledgerbridge.si. These Terms are made in English, and any translation is for convenience only.

26.8 Export and sanctions. You will comply with all export control and sanctions laws that apply to your use of the Service.

27. Contact

General and support questions: team@ledgerbridge.si

Legal notices: legal@ledgerbridge.si

Operator details

[PLACEHOLDER: the sole proprietor’s legal name and registered address that clause 1.1 and Annex 1 of the DPA refer to — pending from the operator. Nothing invented until confirmed.]

1. Definitions

“Data Protection Laws” means all laws relating to data protection and privacy that apply to the processing of Customer Personal Data under the Terms, which may include the EU General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR), the GDPR as retained in UK law (UK GDPR) and the Data Protection Act 2018, the Digital Personal Data Protection Act, 2023 (India), the Australian Privacy Act 1988, the New Zealand Privacy Act 2020, the Canadian Personal Information Protection and Electronic Documents Act and applicable United States state privacy laws.

“Customer Personal Data” means personal data contained in Customer Data that Ledger Bridge processes on behalf of the Customer in providing the Service.

“controller, processor, data subject, personal data, processing and supervisory authority” have the meanings given in the GDPR or the equivalent terms in other Data Protection Laws.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by Ledger Bridge.

“SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission in Implementing Decision (EU) 2021/914, and, for transfers subject to UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner.

“Sub-processor” means any third party engaged by Ledger Bridge to process Customer Personal Data.

2. Roles and scope

2.1 The Customer is the controller of Customer Personal Data, and Ledger Bridge is its processor. Where the Customer processes Customer Personal Data as a processor on behalf of a Client, Ledger Bridge is the Customer’s sub-processor, and the Customer warrants that it has its controller’s authorisation to appoint Ledger Bridge on the terms of this DPA.

2.2 The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are described in Annex 1.

2.3 This DPA does not apply to personal data that Ledger Bridge processes as a controller for its own purposes, such as account administration, billing, security and legal compliance, which is governed by the Privacy Policy.

3. Customer responsibilities

3.1 The Customer is solely responsible for:

1. establishing and maintaining a lawful basis for the processing of Customer Personal Data, and for giving all notices and obtaining all consents and authorisations required under Data Protection Laws, including from its Clients;
2. the accuracy, quality and legality of Customer Personal Data and the means by which it was obtained;
3. ensuring that its instructions comply with Data Protection Laws; and
4. minimising the personal data it uploads to what is necessary for use of the Service.

3.2 The Customer will not upload special categories of personal data, or data relating to criminal convictions or offences, to the Service.

4. Ledger Bridge obligations

4.1 Instructions. Ledger Bridge will process Customer Personal Data only on the Customer’s documented instructions, unless required to do so by applicable law, in which case it will inform the Customer of that requirement before processing unless the law prohibits this. The Terms, this DPA and the Customer’s use and configuration of the Service are the Customer’s complete instructions. Additional instructions require Ledger Bridge’s written agreement and may be subject to additional fees. Ledger Bridge will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws, but is not obliged to perform a legal review of instructions.

4.2 Confidentiality. Ledger Bridge will ensure that persons authorised to process Customer Personal Data are bound by appropriate obligations of confidentiality.

4.3 Security. Ledger Bridge will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, as described in Annex 2. Ledger Bridge may update those measures from time to time, provided the overall level of protection is not materially reduced.

4.4 Assistance. Taking into account the nature of the processing and the information available to it, Ledger Bridge will provide reasonable assistance to the Customer, at the Customer’s cost, in responding to data subject requests and in meeting its obligations relating to security, breach notification, data protection impact assessments and prior consultation. Ledger Bridge will promptly forward to the Customer any data subject request it receives relating to Customer Personal Data and will not respond to it except on the Customer’s instructions or as required by law.

5. Sub-processors

5.1 The Customer gives Ledger Bridge general authorisation to engage Sub-processors. The Sub-processors engaged at the date of this DPA are listed in Annex 3 below.

5.2 Ledger Bridge will give notice of any intended addition or replacement of a Sub-processor by updating Annex 3 and, where the Customer has subscribed to updates, by email, before the new Sub-processor processes Customer Personal Data. The Customer may object on reasonable data protection grounds by notice within a reasonable period after notice is given. If the parties cannot resolve the objection in good faith, the Customer’s sole remedy is to stop using the affected part of the Service and close its account.

5.3 Ledger Bridge will impose on each Sub-processor data protection obligations that provide a level of protection substantially equivalent to this DPA, and remains responsible to the Customer for the performance of each Sub-processor’s obligations, subject to clause 10.

6. International transfers

6.1 Customer Data is stored on servers located in the European Union. Customer Personal Data may be accessed from or transferred to countries outside the European Economic Area or the United Kingdom, including the country in which Ledger Bridge is established, and to the locations of Sub-processors, for the purposes of providing and supporting the Service.

6.2 Where such a transfer requires a transfer mechanism under Data Protection Laws, the SCCs are incorporated into this DPA by reference: Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor. For the purposes of the SCCs, the Customer is the data exporter and Ledger Bridge is the data importer; the optional docking clause and clause 9(a) option 2 (general written authorisation) apply; clause 17 option 1 applies and the governing law and courts are those of Ireland; Annex 1 of this DPA completes Annex I of the SCCs; Annex 2 completes Annex II; and Annex 3 completes Annex III. For transfers subject to UK GDPR, the UK International Data Transfer Addendum applies, completed with the information in this DPA. If there is a conflict between this DPA and the SCCs, the SCCs prevail.

7. Personal Data Breaches

7.1 Ledger Bridge will notify the Customer without undue delay after becoming aware of a Personal Data Breach, and will provide information reasonably available to it to help the Customer meet its own notification obligations.

7.2 Ledger Bridge will take reasonable steps to contain and mitigate the effects of a Personal Data Breach. Notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

7.3 The Customer is responsible for any notifications to supervisory authorities, Clients and data subjects that are required of a controller.

8. Audits

8.1 Ledger Bridge will make available to the Customer, on written request, information reasonably necessary to demonstrate compliance with this DPA, which may include written responses to security questionnaires, policies and summaries of its technical and organisational measures. The Customer will first rely on this documentation.

8.2 If the documentation is not sufficient to demonstrate compliance, or an audit is required by a supervisory authority, the Customer may conduct an audit, subject to the following conditions:

1. no more than once in any twelve (12) month period, except following a Personal Data Breach or where required by a supervisory authority;
2. on reasonable prior written notice, at a mutually agreed time, during business hours and without unreasonable disruption to Ledger Bridge’s operations;
3. by the Customer or an independent auditor bound by confidentiality obligations, who is not a competitor of Ledger Bridge;
4. limited to the processing of Customer Personal Data, and excluding access to other customers’ data or to Sub-processor facilities except as permitted by the Sub-processor; and
5. at the Customer’s sole cost, including reimbursement of Ledger Bridge’s reasonable costs of supporting the audit.

9. Return and deletion

9.1 Before closure of its account, the Customer may download its Outputs and Customer Rules using the Service. Following termination of the Terms, Ledger Bridge will delete Customer Personal Data within a reasonable period, unless retention is required by applicable law.

9.2 Customer Personal Data in backups will be deleted in the ordinary course of backup rotation and protected in accordance with this DPA until deleted.

10. Liability

10.1 Each party’s liability arising out of or in connection with this DPA and the SCCs, taken together with the Terms, is subject to the exclusions and limitations of liability in the Terms, including clause 21 of the Terms, and counts towards the aggregate cap set out there, except to the extent such limitation is prohibited by Data Protection Laws or the SCCs.

10.2 The Customer will indemnify Ledger Bridge against all losses, fines and costs arising from the Customer’s breach of this DPA or of Data Protection Laws, including any failure to have a lawful basis for processing or the authority of its Clients.

11. General

11.1 This DPA remains in effect for as long as Ledger Bridge processes Customer Personal Data on behalf of the Customer.

11.2 This DPA is governed by the law and dispute resolution provisions of the Terms, except where Data Protection Laws or the SCCs require otherwise.

Annex 1: Description of the processing

Data exporter

The Customer, as identified in its account.

Data importer

Ledger Bridge, as identified in the operator details above. Contact: legal@ledgerbridge.si.

Subject matter and purpose

Providing the Service: importing Source Files, classifying, mapping and reconciling transactions, generating Outputs, API access, support and related services.

Nature of processing

Collection by upload or API, storage, organisation, structuring, analysis, retrieval, use, transmission to Third-Party Services at the Customer’s direction, and deletion.

Duration

For the term of the Terms and until deletion in accordance with clause 9 of this DPA.

Categories of data subjects

Individuals whose personal data appears in Customer Data, which may include the Customer’s Clients and their owners, officers, employees and contractors, counterparties, vendors and payees, and the Customer’s Authorised Users.

Types of personal data

Names and contact details; wallet addresses; exchange and account identifiers; transaction hashes and identifiers; counterparty names; transaction dates, amounts, assets, values, cost basis and gains; comments and notes; and Authorised User account and activity data.

Special categories

None intended. The Customer must not upload special categories of data.

Frequency of transfer

Continuous, as the Customer uses the Service.

Annex 2: Technical and organisational measures

• Encryption of data in transit using HTTPS.
• Stored copies of uploaded original files encrypted at rest.
• OAuth tokens and two-factor authentication secrets encrypted at rest.
• Passwords, API Keys and two-factor backup codes stored only in hashed form.
• Support for two-factor authentication for user accounts.
• Workspace-level access controls, so that only Authorised Users assigned to a company can access it.
• API Keys limited to the read and write scopes chosen when they are created, and revocable at any time.
• Activity logging of security events, journal edits, exports and billing and membership changes.
• Support access only with the Customer’s explicit, time-limited grant, using an isolated copy of the workspace that is deleted when the grant expires or is revoked.
• Hosting on servers located in the European Union through an established hosting provider.

Annex 3: Sub-processors

Hostinger

Hosting and deployment of the Service and storage of Customer Data. Location: European Union.

Other Sub-processors

Any further Sub-processor we engage will be added here, with notice given in accordance with clause 5 of this DPA.