ReportGarden Data Processing Addendum
[Date Effective: May 25, 2018]

Last updated: October 1, 2026

‍

Please read the Data Processing Addendum (“DPA”) carefully as they form a contract between You (“Customer”) and Us (“ReportGarden”). As referenced in the ReportGarden Terms of Service (“Terms”), this DPA will apply where We and Our Group Companies are processors of personal data protected by Applicable Data Protection Law. The capitalized terms used in this DPA but not defined herein shall have the same meaning as defined in the Terms. In the event of a conflict between this DPA and the Terms, this DPA shall prevail.

THIS DPA INCLUDES:
The Standard Contractual Clauses (Module Two) and the UK Addendum, incorporated by reference in EXHIBIT 1.

• Appendix 1 to the Standard Contractual Clauses, which includes specifics on the Personal Data transferred by the data exporter to the data importer.
• Appendix 2 to the Standard Contractual Clauses, which includes a description of the technical and organizational security measures implemented by the data importer as referenced.
• Appendix 3 to the Standard Contractual Clauses, which includes details of REPORT GARDEN, Inc’s EU Representative.

1. Definitions
In this DPA, the following terms shall have the following meanings:
a) “controller”, “processor”, “data subject”, “personal data”, “processing” (and “process”), and “special categories of personal data” shall have the meanings given in Applicable Data Protection Law;
b) “Applicable Data Protection Law” means, as applicable to the processing of the Data under this DPA: (i) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”); (ii) the GDPR as incorporated into the law of the United Kingdom (“UK GDPR”) and the UK Data Protection Act 2018; and (iii) the Swiss Federal Act on Data Protection (“FADP”);
c) “ReportGarden” means REPORT GARDEN, Inc.; and
d) “Standard Contractual Clauses” or “2021 SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (transfer controller to processor), as incorporated into this DPA by Exhibit 1; and “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, as incorporated into this DPA by Exhibit 1.

2. Relationship of the parties.

Customer (the controller) appoints ReportGarden as a processor to process the personal data forming part of the Service Data (the “Data”) for the purposes described in the Terms (or as otherwise agreed in writing by the parties) (the “Permitted Purpose”). Each party shall comply with the obligations that apply to it under Applicable Data Protection Law.

3. Prohibited data.
Customer shall not disclose (and shall not permit any data subject to disclose) any special categories of personal data to ReportGarden for processing.

4. International transfers.
ReportGarden will transfer the Data outside of the European Economic Area (“EEA”), the United Kingdom or Switzerland only in compliance with the Standard Contractual Clauses and, where applicable, the UK Addendum and the Swiss provisions set out in Exhibit 1.

5. Confidentiality of processing.
ReportGarden shall ensure that any person it authorizes to process the Data (an “Authorised Person”) shall protect the Data in accordance with ReportGarden’s confidentiality obligations under the Terms.

6. Subprocessors.
Customer consents to ReportGarden engaging third-party subprocessors to process the Data for the Permitted Purpose provided that:

• ReportGarden maintains an up-to-date list of its subprocessors (click here to view), which it shall update with details of any change in subprocessors at least thirty (30) days prior to any such change;
• Where personal data is shared with the subprocessors, ReportGarden engages with only GDPR compliant tools; and
• ReportGarden remains liable for any breach of this Clause that is caused by an act, error or omission of its subprocessor.

Subprocessors include providers of the AI models used to deliver AI Features, as described in Section 6A.

Customer may object to ReportGarden’s appointment or replacement of a subprocessor prior to its appointment or replacement, provided such objection is based on reasonable grounds relating to data protection. In such event, ReportGarden will either not appoint or replace the subprocessor or, if this is not possible, Customer may suspend or terminate the Terms (without prejudice to any fees incurred by Customer prior to suspension or termination).

6A. AI Features.
Where Customer chooses to use AI Features, as defined in the ReportGarden AI Terms of Use, ReportGarden processes the Data through AI Features for the Permitted Purpose, subject to the following:
AI providers engaged by ReportGarden to deliver AI Features, currently OpenAI and Anthropic, are subprocessors under Section 6.
Neither ReportGarden nor its subprocessors will use the Data to train AI models.
AI Features process only Data within Customer’s account that the relevant user is permitted to access.
ReportGarden retains AI conversation data for up to thirty (30) days, unless a longer period is required by law. AI providers may retain such data for a limited period solely for abuse and security monitoring.
Where Customer authorizes an MCP Connection, the Data is disclosed to the third-party AI tool selected by Customer, at Customer’s instruction. Such third-party AI tool is not a subprocessor of ReportGarden, and Customer is responsible for that disclosure and for the third party’s processing of the Data.

‍

7. Cooperation and data subjects’ rights.
ReportGarden shall provide reasonable and timely assistance to Customer (at Customer’s expense) to enable Customer to respond to:

• any request from a data subject to exercise any of its rights under Applicable Data Protection Law (including its rights of access, correction, erasure and data portability, as applicable); and
• any other correspondence, enquiry or complaint received from a data subject, regulator or other third party in connection with the processing of the Data.

In the event that any such request, correspondence, enquiry or complaint is made directly to ReportGarden, ReportGarden shall promptly inform Customer providing full details of the same.

8. Data Protection Impact Assessment.
If ReportGarden believes or becomes aware that its processing of the Data is likely to result in a high risk to the data protection rights and freedoms of data subjects, it shall inform Customer and provide reasonable cooperation to Customer (at Customer’s expense) in connection with any data protection impact assessment that may be required under Applicable Data Protection Law.

9. Security.
The processor shall implement technical and organizational measures to protect the Data (i) from accidental or unlawful destruction, and (ii) loss, alteration, unauthorized disclosure of, or access to the Data (a “Security Incident”).

10. Security incidents and Data Breach.
If ReportGarden becomes aware of a confirmed Security Incident, it shall inform Customer without undue delay and shall provide reasonable information and cooperation to Customer so that Customer can fulfill any data breach reporting obligations it may have under (and in accordance with the timescales required by) Applicable Data Protection Law. ReportGarden shall further take reasonably necessary measures and actions to remedy or mitigate the effects of the Security Incident and shall keep Customer informed of all material developments in connection with the Security Incident.

11. Disposal of Customer Data.
Upon the termination of Customers’ access to and use of the Service, ReportGarden will up to fifteen (15) days following such termination permit the customer to export its Service Data, at customers’ expense, in accordance with the capabilities of the Service. Following such period, ReportGarden shall destroy all Service Data stored or processed by ReportGarden on behalf of the customer. In case the customer requires ReportGarden to delete the Personal Data, this will be done in accordance with ReportGarden’s data retention and disposal policies and procedures. Customer expressly consents to such deletion.

This requirement shall not apply to the extent that ReportGarden is required by applicable law to retain some or all of the Data, or to Data it has archived on backup systems, which Data ReportGarden shall securely protect from any further processing except to the extent required by such law.

12. Audit.
Customer acknowledges that ReportGarden may be audited for technical, legal or taxation purposes. This may require ReportGarden to share some personal data with the auditor, which will be bound by confidentiality clauses.

EXHIBIT 1
STANDARD CONTRACTUAL CLAUSES

Date Effective:  May 25, 2018

Incorporation. Where the processing of the Data by ReportGarden involves a transfer of personal data from the EEA to a country that has not received an adequacy decision, the parties agree that the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (transfer controller to processor), available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj, are incorporated into this DPA by reference and form an integral part of it. Customer is the data exporter and ReportGarden is the data importer. Customer’s acceptance of the Terms, or its continued use of the Service after this DPA is made available, constitutes each party’s execution of the Standard Contractual Clauses, including their Annexes.

‍
Selected options. For the purposes of the Standard Contractual Clauses: Clause 7 (Docking clause) applies; under Clause 9(a), Option 2 (general written authorisation) applies, and ReportGarden shall inform Customer of any intended addition or replacement of subprocessors at least thirty (30) days in advance by updating its subprocessor list, with Customer entitled to object as set out in Section 6 of this DPA; the optional language in Clause 11(a) does not apply; under Clause 13, the supervisory authority with responsibility for ensuring compliance by the data exporter with the GDPR shall act as the competent supervisory authority; under Clause 17, Option 1 applies and the Standard Contractual Clauses shall be governed by the laws of Ireland; and under Clause 18(b), disputes shall be resolved before the courts of Ireland.

‍
Annexes. Annex I.A (List of parties) is completed as follows: the data exporter is the Customer, as identified in its ReportGarden account, acting as controller; the data importer is REPORT GARDEN, Inc., 1013 Centre Road, Suite 403-B, Wilmington, Delaware 19805, USA (contact: support@reportgarden.com), acting as processor; the activities relevant to the transfer are the provision of the Service under the Terms; and each party’s signature and date are given by the Customer’s acceptance of the Terms. Annex I.B (Description of transfer) is set out in Appendix 1 to this DPA. Annex I.C (Competent supervisory authority) is as set out above under Clause 13. Annex II (Technical and organisational measures) is set out in Appendix 2 to this DPA. Annex III (List of subprocessors) is available at https://reportgarden.com/sub-processors.

‍
United Kingdom. For transfers of personal data subject to UK data protection law, the UK Addendum (version B1.0, in force from 21 March 2022) is incorporated into this DPA by reference and applies to the Standard Contractual Clauses as set out in this Exhibit. Tables 1 to 3 of the UK Addendum are completed with the information in this Exhibit and Appendices 1 to 3 to this DPA, and for Table 4, neither party may end the UK Addendum as set out in its Section 19.

‍
Switzerland. For transfers of personal data subject to the FADP, the Standard Contractual Clauses apply with the following changes: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for such transfers; and the term “Member State” shall not be interpreted to prevent data subjects in Switzerland from bringing claims in their place of habitual residence.

‍
Order of precedence. In the event of any conflict between the Standard Contractual Clauses (or the UK Addendum) and the rest of this DPA or the Terms, the Standard Contractual Clauses (or the UK Addendum, as applicable) shall prevail.

Appendix 1 to the Standard Contractual Clauses

Details of Processing

This Appendix forms part of the Clauses and is deemed completed and signed by the parties upon the Customer’s acceptance of the Terms.

A. Data exporter
Data exporter is the Data controller. The data exporter is the Customer, as defined in the ReportGarden Customer Terms of Service (“Agreement”). Data exporter is the Data controller.
B. Data importer
Data importer is the Data processor. The data importer is ReportGarden, a digital marketing agency platform that helps online advertisement agencies create performance reports, invoices, manage campaign budgets, site audits and various other features that are provided on the application.

C. Data subjects

The personal data transferred concern the following categories of data subjects:

• Users (data exporters), and
• Customers of users (as input by users)

D. Subject-Matter and Nature of the Processing

The subject-matter of Processing of Personal Data by Processor is the provision of the services to the Controller that involves the Processing of Personal Data. Personal Data will be subject to those Processing activities as may be specified in the Agreement.

E. Categories of data

The personal data transferred concern the following categories of data:

• Contact Details: First Name, Last Name, Phone number, Profile picture
• Transactional Data: Card details, Shipping address, Billing address
• Digital Data: Email address, IP Address, Browse Information, Cookies and tracking pixels
• Client-contact Details: First name, Last name, email, phone number, job title
• Requestor data: Name, email, phone number and the details as provided by the requestor
• Email conversations: User details, company details, attachments, location, contact details as provided by the customer via emails
• Call and Screen recordings: Any information provided on calls with internal teams such as user’s profile information, company information
• Integration-specific Application data: Account Number, Account Token, Account User ID
• Social content: Facebook/Instagram user id and email, posts, personal information from instagram profile personal information
• AI Feature data: Questions and instructions submitted to AI Features, AI-generated responses, and account data processed to generate them

F. Special categories of data (if appropriate)

The personal data transferred concern the following special categories of data: N/A

G. Processing operations

The personal data transferred will be subject to basic processing activities for the following activities:

• Billing and Invoices – To maintain a record of all the transactions and the deal details between the customer and ReportGarden
• User Experience and Design – Screen recordings to visualize the user experience while customers use the application for our learning on user onboarding and experience and to improve their experience.
• Marketing – To show advertisements and send marketing materials to the customers for services and/or features they have expressed interest in.
• Presales and Sales – To contact the customer for sharing product details, scheduling demos, reminders, etc.
• After-sales Support – To support customer onboarding, training, troubleshooting and issue resolution
• AI Features – To answer users’ questions about their reporting data, generate summaries and insights, and enable MCP Connections at the Customer’s direction
• Any data processing required to offer the services and provide product and new feature updates

H. Frequency of transfer

Continuous, for the duration of the Customer’s use of the Service.

I. Retention period

Personal data is retained for the duration of the Customer’s use of the Service and deleted as described in Section 11 of this DPA. AI conversation data is retained as described in Section 6A of this DPA.

J. Transfers to subprocessors

Subprocessors process personal data for the same subject matter, nature and duration as set out in this Appendix, as listed at https://reportgarden.com/sub-processors

K. Competent supervisory authority

Determined in accordance with Clause 13 of the Standard Contractual Clauses, as set out in Exhibit 1.

‍

Appendix 2 to the Standard Contractual Clauses

Security Measures

This Appendix forms part of the Clauses and is deemed completed and signed by the parties upon the Customer’s acceptance of the Terms. ReportGarden considers protection of Customer Data a top priority. As further described in these Security Measures, ReportGarden uses commercially reasonable organizational and technical measures designed to prevent unauthorized access, use, alteration or disclosure of Customer Data stored on systems under ReportGarden’s control.

1. Trusted Infrastructure

ReportGarden is a unified software for marketing agencies. Our application allows agencies to focus on their marketing strategies while ReportGarden focuses on Client Reporting & Management, Prospects Management, Lead generation, Budgets monitoring and many more. This Page gives an overview of application performance and how security is designed into the ReportGarden software. ReportGarden hosts its services on Heroku which is a network isolated, dedicated runtime environments for enhanced privacy, power, and performance. This infrastructure provides secure integration of clients accounts, secure storage of data with end-user privacy safeguards, secure encryption of passwords and two-factor authentication, secure and private communication with customers, and safe operation by administrators.

We will describe the security of this application in progressive layers starting from the physical and network security, continuing on to how the hardware and software that underlie the infrastructure are secured, and finally, describing the technical constraints and processes in place to support the performance of the application.

2. Reliability

ReportGarden’s computing platform assumes ongoing hardware failure, and it uses robust software failover to withstand disruption. All ReportGarden systems are inherently redundant by design, and each subsystem is not dependent on any particular physical or logical server for ongoing operation. Data is replicated multiple times across Heroku dynos(third party) so that, in the case of a machine failure, data will still be accessible through another system. We also replicate data to secondary data centers in different seismic and geographic zones to ensure protection from data center failures.

ReportGarden’s services are designed to scale to hundreds of thousands of users. We run multiple different performance tests, including load testing our applications under high load over a long period, to observe effects on factors, such as memory use and response time. ReportGarden also performs stress testing to examine system performance in unusual situations, including system functional testing while under unusually heavy loads, heavy repetition of certain actions or inputs, or input of large numerical values and large, complex queries to a database system.

3. Privacy

We do everything in our power to protect agencies from attempts to compromise their data. We vigorously resist any unlawful attempt to access or block access to our customers’ data, whether it be from a hacker or any malicious software. Whether it is an integration or client’s contact, ReportGarden does not own that data.

That means two key things:

• We use your information for the purposes specified in the policy, such as delivering you the service for which you pay.
• You have control over your data. We provide you with options to delete and export your data so that you can take your data with you at any time.

ReportGarden may only access data in your account in strict compliance with our Privacy Policy and customer agreement. For purposes of providing technical support, an administrator from your domain may choose to grant the ReportGarden Support team permission to access accounts in order to resolve a specified issue.

4. Application Security

SECURE ACCESS

ReportGarden servers can be accessed only via HTTPS using Comodo SSL Certificate. We use industry-standard encryption for data traversing to and from the application servers.

XSS

All user inputs are properly encoded when displayed to ensure XSS vulnerabilities are avoided.

CSRF

All POST requests are checked for CSRF token before processing the request.

SQL INJECTION

ReportGarden interacts with a database through ActiveRecord. The default and convenient Object Relational Mapping (ORM) layer which provides abstraction, safety and allow developers to avoid manually building SQL queries.

ReportGarden also uses Brakeman which is an open source static analysis tool which checks Ruby on Rails applications for security vulnerabilities.

ENCRYPTED DATA STORAGE

ReportGarden does not store any sensitive details on its network. We store sensitive details in our database in an encrypted form.

5. Physical and Network Security

We use Heroku, Amazon’s AWS platform and infrastructure for ReportGarden. Here are more details about security setup of AWS, Heroku.

CLOUDFLARE

We use Cloudflare for increasing internet pressures. Cloudflare is a web performance and security company. Cloudflare’s WAF, DDoS protection, and SSL defend website owners and their visitors from all types of online threats.

a. CLOUDFLARE WAF

Cloudflare’s enterprise-grade web application firewall (WAF) detects and block common application layer vulnerabilities at the network edge, utilizing the OWASP Top 10, application-specific and custom rulesets. It has two-factor authentication so that the accounts get an added layer of login security, ultimately adding another layer of security to our website.

b. CLOUDFLARE IPF

Cloudflare IP Firewall avoids the most common security attacks which run over a public network, such as the Internet.

c. CLOUDFLARE RATE LIMITING

Rate Limiting protects critical resources by providing fine-grained control to block or qualify visitors with suspicious request rates.

d. CLOUDFLARE DDoS MITIGATION

DDos Mitigation resists the impact of distributed denial-of-service (DDoS) attacks on networks attached to the Internet by protecting the applications, websites, and APIs from malicious traffic targeting network and application layers and maintains the performance and availability.

6. Monitoring

Ensuring the availability of ReportGarden application is just as important as protecting them from malicious requests. We have a dedicated team working 24/7 for application monitoring. We use both internal and multiple external monitoring services to monitor ReportGarden. Our monitoring system will alert our team through emails and phone calls if there are any errors or abnormality in the request pattern. We take utmost care in picking the right external tools and here are the four tools which are woven together to monitor ReportGarden application 24 hours.

SCOUT

ReportGarden uses Scout which is a Rails monitoring app for serving: the performance metrics, a layer of analysis, and a generous helping of workflow improvements. These features reduce the stress on us in identifying the root cause of Rails app performance woes.

ROLLBAR

ReportGarden uses Rollbar which is a real-time, full-stack error monitoring and debugging tool for developers used to monitor the impact of our code changes and measures the performance, track errors and analyze our application. It integrates with GitHub to link stack traces to the underlying source code, correlate exceptions to code changes, and create GitHub issues allowing us to manage errors in the existing workflow.

INSTRUMENTAL

ReportGarden uses Instrumental for sending metrics and building graphs to monitoring servers and services. It serves us,

• System & Service Monitoring
• Application Monitoring

LIBRATO

ReportGarden uses Librato for monitoring and understanding the metrics that impact the software at all levels of the stack.

7. Vulnerability scanning and audits

Third party security testing of the Heroku application is performed by independent and reputable security consulting firms. Findings from each assessment are reviewed by the assessors, risk ranked and assigned to the responsible team.

ReportGarden undergoes penetration tests, vulnerability assessments, and source code reviews to assess the security of the application, architecture, and implementation. Our third-party security assessments cover all areas of our platform including testing for OWASP Top 10 web application vulnerabilities and customer application isolation. ReportGarden works closely with external security assessors to review the security of the platform and applications and applies the best practices. We also hold open bug bounty programs which allows the security researchers, report a vulnerability on ReportGarden application as long as the vulnerability is discovered without using intrusive testing techniques.

8. Performance

ReportGarden offers a 99.99% app uptime and 99.99% API uptime. Furthermore, ReportGarden hardly has downtime or maintenance windows. To minimize service interruption due to hardware failures, natural disasters or other incidents, ReportGarden, takes the data backup and save in a different server in a different and highly redundant availability zone. In case our server downs, we spin the server in an hour.

9. Indemnity Clauses

ReportGarden ensures that its platform and services do not inadvertently cause its customers to breach intellectual property rights and other laws. Our indemnification rules are governed by our Terms of Service and Privacy Policy which can be read on the given links.

10. Employee Screening and Policies

As a condition of employment, all ReportGarden employees undergo pre-employment background checks and agree to company policies including security and acceptable use policies.

11. Disclosure

We are working continuously to make our system secure. If you find any security issues, please submit it to support@reportgarden.com. We take security as our highest priority. We will make sure the issue is fixed and updated at the earliest.

12. AI Features

AI Features operate within the security controls described in this Appendix. AI Features access only data within the Customer’s account that the relevant user is permitted to view. MCP Connections are created only with user authorization and provide read-only access, unless otherwise stated in the product at the time of connection. AI providers are reviewed before engagement and are contractually bound to protect the Data and not use it to train AI models.

Appendix 3 to the Standard Contractual Clauses

EU Representative Contact Information

This Appendix forms part of the Clauses and is deemed completed and signed by the parties upon the Customer’s acceptance of the Terms. REPORT GARDEN, Inc. takes their clients’ (and the customers of their clients) data protection seriously, and has appointed DPR Group as their Data Protection Representative in the European Union so that you can contact them directly in your home country. DPR Group has locations in each EU Member State and in the United Kingdom, so that REPORT GARDEN, Inc.’s customers can always raise the questions they want with them.

To raise a question to the DPR Group on behalf of REPORT GARDEN, Inc., you may do so by mailing your inquiry to DPR Group at the most convenient of the addresses in the subsequent pages.

PLEASE NOTE: when mailing inquiries, it is ESSENTIAL that you mark your letters for ‘DPR Group’ and not ‘REPORT GARDEN, Inc.’, or your inquiry may not reach us. Please refer clearly to REPORT GARDEN, Inc. in your correspondence. On receiving your correspondence, REPORT GARDEN, Inc. is likely to request evidence of your identity, to ensure your personal data and information connected with it is not provided to anyone other than you.

Alternatively, you may reach out to ReportGarden by sending an email to support@reportgarden.com stating <Data Privacy Query / Data Subject Right> in the subject line.

‍