LedgerLink Data Processing Agreement

Effective date: 19 October 2026

This Data Processing Agreement (the "Agreement") forms an integral part of the LedgerLink Terms and Conditions (https://ledgerlink.nl/terms). It is entered into between the business customer subscribing to LedgerLink (the "Customer") and VoltStation B.V., trading as LedgerLink, Straatweg 29, 8535 WG Follega, Netherlands Chamber of Commerce number 97250325 ("LedgerLink").

For personal data processed through the service on the Customer's instructions, the Customer is generally the controller and LedgerLink is the processor. Where the Customer itself acts as a processor for a third party, this Agreement applies to the relationship between the Customer as processor and LedgerLink as sub-processor, insofar as the activities so require. The Customer warrants that the controller has provided the necessary engagement, instructions and authorisation for further subcontracting. For its own account, security, support and payment purposes, VoltStation B.V. separately acts as controller, as explained in the Privacy Notice (https://ledgerlink.nl/privacy).

1. Subject matter, duration and instructions

1. LedgerLink processes the personal data described in Annex 1 solely to provide the accounting assistant service authorised by the Customer. Processing continues during provision of the service and the necessary subsequent erasure, security-related handling and transfer of data.
2. The Terms and Conditions, this Agreement, the authorised connection and specific actions or instructions of authorised Users constitute the Customer's documented instructions. A Moneybird OAuth authorisation does not in itself confer general permission to modify accounting data. A specific change requires a separate and expressly approved Proposal.
3. LedgerLink processes the data solely on those documented instructions, including in relation to transfers outside the EEA, unless European Union or Dutch law requires other processing. In that event, LedgerLink will inform the Customer before processing unless the law prohibits such notification on important grounds of public interest.
4. If LedgerLink considers that an instruction infringes the GDPR or other applicable data protection law, it will inform the Customer without undue delay unless prohibited by law. LedgerLink may refuse unsafe or unauthorised actions.
5. The Customer remains responsible for the lawfulness of its purposes and instructions, the legal basis for processing, information provided to data subjects and its authority to make the data and administration available.

2. Confidentiality and security

1. LedgerLink ensures that persons authorised to access personal data under its authority are bound by confidentiality and have access only insofar as necessary. Access is restricted by role and recorded where possible.
2. LedgerLink implements appropriate technical and organisational measures within the meaning of Article 32 GDPR, taking into account the nature of the personal data, the state of the art, implementation costs and relevant risks. The measures actually described are set out in Annex 2. They may be modified provided that an appropriate level of protection is maintained.
3. LedgerLink ensures that security measures are also designed to prevent unauthorised access, incorrect or unauthorised changes, data loss, unsafe repetition of operations with uncertain outcomes and failures in incident recovery.
4. The Customer manages the permissions of its own Users, uses the available security settings and promptly reports suspected compromise of accounts or Moneybird authorisations.

3. Sub-processors

1. The Customer grants general written authorisation to engage those parties that actually process data on the Customer's instructions as sub-processors and are identified in that capacity in the list of Sub-processors and Other Recipients (https://ledgerlink.nl/sub-processors). Not every party listed is a sub-processor for every data flow.
2. LedgerLink will notify the Customer at least thirty days in advance of a planned addition or replacement of a relevant sub-processor through an appropriate direct customer contact channel. Only where mandatory law or a demonstrably urgent security need does not allow that period to elapse may a necessary change take effect sooner, subject to notification as soon as possible and appropriate safeguards.
3. During the notice period, the Customer may raise a reasoned objection based on specific data protection risks by writing to support@ledgerlink.nl. The parties will seek an appropriate resolution. If a justified objection cannot be resolved and the processing concerned is necessary for the service, the Customer may terminate the affected use before the change, without prejudice to applicable statutory rights.
4. LedgerLink will impose on each sub-processor, in writing, essentially equivalent data protection obligations for the relevant processing on instructions and will remain responsible to the Customer for the sub-processor's performance of its obligations in accordance with Article 28 GDPR.
5. The date of notification, the proposed change, any objections and their handling will be recorded in an appropriately limited form insofar as necessary to fulfil contractual and statutory obligations.

4. Transfers outside the EEA

1. LedgerLink preferably processes its core service in the regions identified in the provider list. The location of a database or model endpoint does not mean that identity management, payment processing, support or other provider activities take place exclusively within the EEA.
2. Where personal data under this Agreement are transferred outside the EEA, this will occur only insofar as there is a valid transfer basis, for example an adequacy decision or applicable EU standard contractual clauses with supplementary measures where necessary.
3. LedgerLink will make information about relevant recipients, countries and applicable safeguards available on request insofar as legally and contractually permissible. Any new transfer that entails a materially different risk will be assessed before activation. A public provider statement does not replace the agreement applicable to LedgerLink.

5. Assistance, data subject rights and personal data breaches

1. Taking account of the nature of processing and the information available, LedgerLink will provide reasonable technical and organisational assistance so that the Customer can handle requests for access, rectification, erasure, restriction and data portability. A data subject's request concerning the Customer's administration will generally be referred to the Customer; LedgerLink will not act independently contrary to the Customer's instructions except where legally required.
2. LedgerLink will assist the Customer, as appropriate to the service, with obligations concerning security, notification of personal data breaches, data protection impact assessments and any prior consultation with supervisory authorities (Articles 32 to 36 GDPR).
3. Upon becoming aware of a personal data breach concerning data it processes on the Customer's behalf, LedgerLink will notify the Customer without undue delay through the available business contact details or an appropriate direct contact channel. The initial notice will describe the known nature of the incident, categories of data affected, possible consequences and measures taken insofar as known; further information will follow when available. Notification will not be postponed until the investigation is complete.
4. The Customer, as controller, decides whether notifications to the Dutch Data Protection Authority and data subjects are required. LedgerLink provides the assistance required by law. Where an incident concerns processing for which LedgerLink is itself the controller, LedgerLink's directly applicable GDPR obligations apply.
5. The Customer must maintain reachable contact details and report a suspected privacy or security incident to support@ledgerlink.nl. No continuously staffed or guaranteed 24-hour response service is promised.

6. Information, inspections and audits

1. LedgerLink will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR, including applicable security documentation, the list of sub-processors and relevant findings of internal or independent reviews, insofar as available and without compromising the security of other customers.
2. LedgerLink will allow and contribute to audits and inspections by the Customer or its mandated auditor to the extent required by Article 28 GDPR. The parties will agree on reasonable notice, confidentiality, scope and safe conduct. Where a documentary review is sufficient, it will normally precede a physical or intrusive inspection.
3. Reasonable costs for exceptional additional work may be agreed in advance, but cost arrangements may not effectively prevent the exercise of necessary statutory audit or access rights. Confidentiality and the rights of other customers remain protected.

7. Return, erasure and end of the services

1. At the end of processing on instructions, the Customer will choose, in accordance with Article 28(3)(g) GDPR, whether the personal data processed on its behalf are returned or erased. LedgerLink facilitates that choice through the available export and erasure procedures and, where required by law, through an appropriate separate request process. The Customer is advised to export available data before deleting its account, because data lawfully erased afterwards cannot be reconstructed.
2. After returning or erasing the data, LedgerLink will erase existing copies of data processed on instructions unless European Union or Member State law requires further storage. The original Moneybird administration and changes previously made in it are outside the scope of that erasure.
3. Any separate retention by VoltStation B.V. of personal data from an approved Proposal to substantiate a legal claim is not authorised merely by acceptance of this Agreement. Insofar as VoltStation intends to retain such data for an independent purpose, its role, legal basis, compatibility with the original processing, necessity, data minimisation, security and the applicable rights of data subjects must have been demonstrably assessed in advance. This does not override Article 28(3)(g) GDPR.
4. The intended policy is to retain strictly necessary encrypted approval and execution data for no longer than twelve calendar months after account deletion, solely after that assessment and technical activation. For minimal contract acceptance records, the policy objective is a maximum of five years after termination. These provisions do not constitute permission to retain complete AI Proposals or full accounting data without a separately justified necessity; the Privacy Notice distinguishes current practice from the policy objective.
5. Recovery history and backups may contain erased data during their technical recovery period. LedgerLink restricts access, allows copies to expire and ensures that relevant erasures are applied again after a restoration before the data are put back into use.
6. LedgerLink will explain the applicable erasure procedures and statutory exceptions on reasonable request, while protecting security interests and the rights of others.

8. Priority, amendments and contact

This Agreement applies together with the Terms and Conditions. In the event of a conflict concerning processing carried out on instructions, it takes precedence, subject to mandatory law. Changes to sub-processors will be notified in accordance with section 3; other material contractual amendments are subject to the thirty-day notice rule in section 10 of the Terms and Conditions, except for the necessary urgent changes specified there. Where required, renewed acceptance will be requested. The parties may contact support@ledgerlink.nl.

Annex 1 — Description of processing

Annex 2 — Technical and organisational measures

• Access and separation: authentication through an identity service, controlled accounts and roles, workspace/administration binding, checking granted Moneybird permissions and a recently verified additional authentication factor for sensitive account actions.
• Secrets and content: encryption of Moneybird access tokens and certain question, Proposal and result fields; TLS for data in transit. Identifying metadata and provider references are not necessarily encrypted in the same way.
• AI and safety: selected data fields and filters, separation between model-generated Proposals and code-controlled approval, a maximum of ten sequential operations per Proposal, verification of results and safeguards against automatically retrying operations with uncertain outcomes.
• Logging: limited operational log fields, security records and monitoring of failures; no assurance that every provider log has identical retention periods or locations.
• Recovery and erasure: database recovery history, bounded cleanup procedures, delayed removal from backups and reapplication of erasure obligations after restoration.
• Organisation: restricted administrative and support permissions, confidentiality, incident procedures, provider due diligence and change/release controls.

This Annex describes the service design. Only measures actually enabled and verified apply to a particular release; AI, write, email or file functions not yet activated are not represented here as active or independently certified.

Other documents: Terms and Conditions (https://ledgerlink.nl/terms) · Privacy Notice (https://ledgerlink.nl/privacy) · Sub-processors (https://ledgerlink.nl/sub-processors).