UNICORN PRIVATE Intelligence

Unicorn Intelligence: Data Processing Agreement

Version date: 29 October 2026

This Data Processing Agreement (the "DPA") forms part of the Terms of Service of Unicorn Intelligence (the "Terms") between the Customer and Unicorn Private LLC, 16192 Coastal Highway, Lewes, Delaware 19958, United States of America ("Unicorn Private"). It is accepted online together with the Terms and applies automatically. No separate signature is required.

1. Definitions

1.1 "Controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in Regulation (EU) 2016/679 (the "GDPR").

1.2 "Applicable Data Protection Law" means the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, United States privacy laws and any other data protection law that applies to the processing.

1.3 "Customer Personal Data" means personal data that the Customer uploads to the Service or that the Service processes on behalf of the Customer, as described in Annex 1.

1.4 "Sub-processor" means a third party engaged by Unicorn Private to process Customer Personal Data.

1.5 "SCCs" means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor), and, for transfers from the United Kingdom, the UK International Data Transfer Addendum.

2. Roles

2.1 For Customer Personal Data, the Customer is the controller and Unicorn Private is the processor.

2.2 For the data of the Customer's users and billing contacts (name, email, usage logs), Unicorn Private acts as an independent controller under its Privacy Notice.

3. Instructions

3.1 Unicorn Private processes Customer Personal Data only on documented instructions of the Customer. The Terms, this DPA and the configuration of the Service by the Customer (lists uploaded, profiles, alerts, webhooks) are the Customer's complete instructions.

3.2 Unicorn Private informs the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

3.3 The Customer is responsible for the lawfulness of the processing, including the legal basis for screening its counterparties and for any information it must give to data subjects.

4. Confidentiality

Persons authorised to process Customer Personal Data are bound by confidentiality.

5. Security

5.1 Unicorn Private implements the technical and organisational measures described in Annex 2.

5.2 Unicorn Private may update the measures provided that the overall level of security is not reduced.

6. Sub-processors

6.1 The Customer gives general authorisation to engage the sub-processors listed in Annex 3 and on intel.unicornprivate.com/trust.

6.2 Unicorn Private notifies changes on that page at least 30 days in advance. The Customer may object on reasonable data protection grounds by email within that period; if the parties cannot resolve the objection, the Customer may terminate the affected service and receive a refund of the prepaid amount for the remaining period.

6.3 Unicorn Private imposes on each sub-processor data protection obligations equivalent to this DPA and remains responsible for its sub-processors.

7. International transfers

7.1 Customer Personal Data may be processed in the United States and in other countries where the sub-processors operate.

7.2 For transfers of personal data from the European Economic Area, Switzerland or the United Kingdom to a country without an adequacy decision, the SCCs are incorporated into this DPA by reference, with the Customer as data exporter and Unicorn Private as data importer. Clause 7 (docking clause) applies; in Clause 9 option 2 applies with the notice period of section 6.2; in Clause 11 the optional language does not apply; in Clauses 17 and 18 the law and courts of Ireland apply. Annexes 1 to 3 of this DPA complete the annexes of the SCCs.

8. Assistance

8.1 Taking into account the nature of the processing, Unicorn Private assists the Customer with requests from data subjects, mainly through the functions of the Service (search, export and deletion of names).

8.2 Unicorn Private provides reasonable information to help the Customer with data protection impact assessments and consultations with supervisory authorities.

9. Personal data breaches

Unicorn Private notifies the Customer's admin users without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information available at the time.

10. Deletion and return

At the end of the Service, Unicorn Private deletes Customer Personal Data within 30 days, unless the law requires storage. Before that, the Customer can export its data from the dashboard and the API.

11. Audits

11.1 Unicorn Private makes available the information needed to demonstrate compliance with this DPA, including the security page and the filled-in security questionnaire published on intel.unicornprivate.com/trust.

11.2 Where this information is not sufficient and an audit is required by Applicable Data Protection Law or by a supervisory authority, the Customer may carry out an audit by written questionnaire, at its own cost, no more than once a year.

12. Liability and order of precedence

12.1 The limitations of liability of the Terms apply to this DPA, to the extent permitted by law.

12.2 In case of conflict, the SCCs prevail over this DPA, and this DPA prevails over the Terms.

Annex 1: Description of the processing

  • Subject matter and duration: provision of the Service for the duration of the Terms, plus up to 30 days for deletion.
  • Nature and purpose: storage of lists of names, automatic comparison with sanctions lists, lists of politically exposed persons, insolvency registers and news; preparation of dossiers; alerts and webhooks; audit log of review decisions.
  • Categories of data subjects: counterparties of the Customer (customers, suppliers, partners, their directors, shareholders and representatives) and persons named in dossiers requested by the Customer.
  • Categories of data: name, aliases, date of birth if provided, country, company identifiers (LEI, registration number, website), internal reference of the Customer, results of the comparison, notes of the reviewers.
  • Special categories: none are required by the Service. Information on sanctions or politically exposed status comes from public official sources. The Customer should not upload special categories of data or data on criminal convictions.
  • Frequency: continuous.

Annex 2: Technical and organisational measures

  • Encryption in transit with TLS 1.2 or higher; encryption at rest by the infrastructure provider.
  • Logical separation of the data of each customer by account identifier in every query.
  • Access to the dashboard with single-use email links and sessions; API keys, sign-in links and sessions stored only as SHA-256 hashes.
  • Roles (admin and member) inside each customer account; administrative access of Unicorn Private limited and protected by a secret token.
  • Webhooks signed with HMAC SHA-256; only public HTTPS endpoints accepted.
  • Audit log of review decisions with user, time and note.
  • Logs of the infrastructure kept for a limited period; backups by the infrastructure provider.
  • Deletion of customer data on request from the dashboard and within 30 days of the end of the Service.

Annex 3: Sub-processors

  • Cloudflare, Inc., United States: hosting, database, storage, email delivery, artificial intelligence models for summaries and translations.
  • Stripe, Inc., United States: payments and invoices (billing data only, not Customer Personal Data).

Accepted online at subscription. The English version prevails in case of differences between languages.