ScoreBoostPro

Legal

Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Terms of Service between RANGLEZ ANALYTICS, LLC ("Processor", "we") and the agency customer ("Controller", "you"). Effective September 29, 2026.

Version v2-2026-09-29 · Effective September 29, 2026

This is the current version of our Data Processing Addendum, and it supplements the Terms of Service. If we change it, we will post the updated version here under a new version number and effective date. Questions can be sent to hello@scoreboost.pro.

1. Definitions

  • "Personal Data" — information relating to an identified or identifiable person processed under the Services, including End Clients' credit-report data, Social Security numbers, and contact details.
  • "Controller" — the agency that determines why and how End Client data is processed.
  • "Processor" — us, processing Personal Data only on the Controller's documented instructions.
  • "Subprocessor" — a third party we engage to help process Personal Data (for example hosting, payments, email, SMS).

2. Roles

  • 2.1 As between the parties, the Controller (agency) determines the purposes of processing End Client data and is responsible for having a lawful basis and all necessary consents.
  • 2.2 The Processor (us) processes Personal Data only to provide the Services and per the Controller's instructions and the Terms.

3. Our Obligations

We will:

  • (a) process Personal Data only on documented instructions;
  • (b) ensure personnel are bound by confidentiality;
  • (c) implement appropriate technical and organizational security measures (see section 5);
  • (d) assist the Controller with data-subject requests and security incidents as reasonably needed;
  • (e) delete Personal Data at the end of the Services, except as legally required to retain.

4. Subprocessors

  • 4.1 You authorize us to use Subprocessors to provide the Services (for example cloud hosting, payments, email, SMS).
  • 4.2 We remain responsible for our Subprocessors' performance and will impose data-protection terms on them at least as protective as this DPA.
  • 4.3 A current list of the functions our Subprocessors support is published at /legal/subprocessors, and the providers themselves are available on request; we will give notice of material changes.

5. Security Measures

We maintain safeguards appropriate to the sensitivity of the data, including: encryption in transit; access controls and least-privilege credentials; database-level tenant isolation (Row-Level Security) so that one agency's data is not accessible to another; and application and platform event logging. We maintain these safeguards consistent with our obligations under the Gramm-Leach-Bliley Act (GLBA) and its Safeguards Rule.

6. Security Incidents

We will notify the Controller without undue delay after becoming aware of a confirmed breach of Personal Data we process, and provide the information reasonably needed for the Controller to meet its own notification obligations.

7. Data Subject Requests

If an End Client contacts us directly, we will refer them to the relevant agency (the Controller). We will reasonably assist the Controller in responding to access, deletion, and correction requests.

8. International Transfers / Location

Personal Data is processed in the United States. Any transfer is subject to appropriate safeguards as required by applicable law.

9. Term & Deletion

This DPA lasts as long as we process Personal Data for you. On termination, we delete Personal Data within 60 days, except where retention is legally required. Export your own records before termination — while the account is active you can reach your data in the platform; once it is deleted we cannot return it.

Questions

Questions about this DPA? Email hello@scoreboost.pro.