Effective Date: 10 September 2026
This Data Processing Addendum ("DPA") governs processing by UNPROMPTED PTE. LTD. ("UNPROMPTED") for the Business Customer through Wellknown. It forms part of the Terms and Conditions or other agreement governing the Service ("Agreement") and prevails for conflicts concerning data protection. Applicable Standard Contractual Clauses prevail over conflicting terms. Other capitalized terms have the meanings in the Agreement.
The customer acts as controller or an authorized processor for its controller; UNPROMPTED acts as processor, subprocessor or data intermediary for Personal Data. Processing for UNPROMPTED's own account administration, billing and business operations is described in the Privacy Policy.
Each party will comply with its applicable Data Protection Laws. The customer warrants that it has the necessary legal bases, notices, permissions and authorizations for its instructions, content and transfers, including authorization from its controller where applicable.
UNPROMPTED will process Business Customer Data only on documented customer instructions, including the Agreement, this DPA, authorized settings and requests through the Service, including MCP. If legally required to process otherwise, UNPROMPTED will inform the customer beforehand unless prohibited by law. UNPROMPTED will immediately inform the customer if, in its opinion, an instruction infringes applicable Data Protection Laws and may suspend that instruction pending clarification.
UNPROMPTED will keep Business Customer Data confidential and limit access to authorized personnel with a business need, including personnel providing authorized support. Such personnel must be bound by contractual or statutory confidentiality obligations.
UNPROMPTED will maintain technical and organizational measures appropriate to the processing risks, as described in Schedule 1. Measures may evolve provided they continue to meet applicable legal requirements. No particular certification or independently audited standard is promised unless expressly agreed in writing.
The customer may request deletion through available controls or support. At the end of processing, UNPROMPTED will, at the customer's choice, return or delete Business Customer Data and delete remaining copies, unless law requires retention. Return may use available export functionality or a standard electronic format; bespoke migration requires separate agreement. Without a return instruction, deletion is the default.
Active data will be deleted without undue delay and no later than 90 days after termination, subject to earlier deletion required by law or valid instructions. Backup copies will be put beyond ordinary use and deleted through normal documented retention cycles as soon as reasonably practicable, subject to applicable law. Any retained data remains protected under this DPA and is processed only for the permitted retention purpose. UNPROMPTED will require applicable deletion by its Subprocessors. Copies exported to customers or their separately contracted providers are managed by those parties.
UNPROMPTED will notify the customer without undue delay after becoming aware of a breach involving accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Business Customer Data. Notification does not depend on completion of an investigation.
UNPROMPTED will take appropriate steps to investigate, contain and mitigate the breach and provide available information and assistance required for the customer's applicable breach obligations. Information may be provided in phases as it becomes available. Notification is not an admission of liability.
The customer gives general written authorization for Subprocessors listed at our Subprocessor List. UNPROMPTED will impose written data protection obligations providing the protection required by this DPA and applicable law and remains responsible for their performance to the extent required by applicable law and the incorporated transfer clauses. Providers contracted separately by the customer are not our Subprocessors merely because they connect to the Service.
UNPROMPTED will contractually prohibit AI, embedding, search and LLM providers it engages to process Business Customer Data from using that data to train or improve their AI models. This does not prohibit processing needed to deliver the requested Service under customer instructions.
UNPROMPTED will maintain the online list and give at least ten (10) business days' advance written notice of added or replacement Subprocessors. Notices go to the address registered through the list's notification form or, if none, the customer's designated privacy or account email. The customer must keep its contact details current.
The customer may object on reasonable data protection grounds within five (5) business days after notice. The parties will consider a practicable resolution. Pending resolution, UNPROMPTED will not transfer the affected data to the objected-to Subprocessor and may suspend or discontinue the affected functionality if no resolution is available. This does not limit mandatory rights under applicable law or the transfer clauses.
Model versions and API changes within an existing Subprocessor do not require separate notice or a standstill period unless they change authorized processing or transfer arrangements in a way requiring notice or authorization under this DPA or applicable law.
Taking account of the processing and information available, UNPROMPTED will provide assistance required by applicable law with individual rights, security, breach obligations, data protection impact assessments and regulatory consultations. Assistance may use available Service controls and standard documentation. Additional work may be subject to reasonable agreed charges where lawful; charges will not prevent fulfillment of mandatory obligations.
UNPROMPTED will forward requests concerning customer-controlled Personal Data to the customer without undue delay and will not respond substantively unless authorized or legally required. The customer remains responsible for its decisions and responses.
UNPROMPTED will make available information necessary to demonstrate compliance and allow and contribute to audits, including inspections, as required by Data Protection Laws and applicable transfer clauses. Existing documentation and available audit summaries will be used first where sufficient.
Routine customer audits are limited to once per calendar year, on reasonable notice, during business hours and subject to confidentiality, security and reasonable scope controls protecting other customers. These limits do not restrict audits required by law, a competent authority or applicable transfer clauses. Additional assistance and audit costs may be allocated by agreement where lawful without obstructing mandatory rights.
Transfers must comply with applicable Data Protection Laws and agreed residency restrictions. Where a transfer requires safeguards beyond an adequacy decision, the clauses in Schedule 2 apply as appropriate, together with any supplementary measures required by law. The parties will provide information reasonably necessary for applicable transfer assessments.
Where applicable, the EU Standard Contractual Clauses (Decision 2021/914) are incorporated: Module Two where the customer is controller and Module Three where it is processor. Clause 7 is excluded; Clause 9 uses Option 2 with ten business days' notice; the optional language in Clause 11 is excluded. Clause 13 determines the competent supervisory authority. Clause 17 uses Option 1 and Irish law; Clause 18 selects the courts of Ireland.
For Annex I.A, the customer is exporter and UNPROMPTED PTE. LTD. is importer; their addresses, contacts and representatives are those recorded in the Agreement or associated account records, with importer privacy contact dpo@unprompted.app. Their activities and roles are described in this DPA. Acceptance of the Agreement constitutes signature and date. Schedule 1 completes Annex I.B and Annex II; Annex I.C is the authority determined by Clause 13. The parties must record any missing required identifying or transfer information before the relevant transfer. Information identifying relevant Subprocessors and their processing will be made available as required by the clauses.
For restricted UK transfers, the ICO's International Data Transfer Addendum, version B1.0, is incorporated, including its mandatory clauses as revised under their terms. Table 1 uses the parties and details above; Table 2 uses the EU clauses and selections above; Table 3 uses the annex information above. For Table 4, both parties may end the Addendum as permitted by Section 19.
For transfers governed by Swiss law, the clauses apply with references to the GDPR including the Swiss Federal Act on Data Protection as applicable, and the competent authority being the Swiss Federal Data Protection and Information Commissioner for Swiss processing. References to Member States include Switzerland to preserve Swiss individuals' rights to bring claims in Switzerland.
UNPROMPTED will comply with applicable PDPA obligations, including protection, retention and breach notification, and ensure overseas transfers subject to the PDPA receive the legally required comparable protection.
Designed for consulting firms