data processing addendum

The terms "personal data", "data subject", "processing", "controller", "processor", "transmission", "transfer", "sensitive data" and "security incident" have the meaning given by applicable law. "Subprocessor" is a third party Unbound engages for part of the processing. "Applicable law" means, as the case may be, Law 1581 of 2012 and its regulatory decrees in Colombia, the Mexican federal law on protection of personal data held by private parties and its regulations, the GDPR and the UK GDPR, and any other data protection rule that applies to the processing.

Unbound processes Customer Personal Data only on behalf of the Customer and on its documented instructions. The Customer gives its instructions through these documents, the configuration of its workspace and the use that it, its users and the agents it connects make of the Platform. The description of the processing is in annex 1.

Unbound will not process Customer Personal Data for its own purposes, will not sell it, will not use it for advertising or to train artificial intelligence models, and will not disclose it to third parties except to its subprocessors under this Addendum, or when a law or competent authority requires it. In that last case it will tell the Customer first, unless the law prohibits it.

If Unbound considers that an instruction breaches applicable law, it will tell the Customer and may refrain from following it.

The Customer is responsible for:

• having the prior, express and informed authorization of data subjects, or another valid legal basis, for the processing it carries out with the Platform, and keeping proof of it;
• informing data subjects through its own privacy notice and its own processing policy;
• obtaining the consent the law requires before sending commercial messages, and honoring unsubscribe requests;
• not loading sensitive data or data of children and adolescents, unless it has the special authorization the law requires and the processing is necessary;
• handling the queries, claims and ARCO rights of data subjects, with the assistance from Unbound set out in this Addendum;
• meeting its own registration duties, such as registering databases in the Colombian National Database Registry when it applies.

Unbound undertakes to:

1. process the data in line with the principles of applicable law, in particular purpose limitation, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality;
2. process the data only for the activities described in annex 1 and on the Customer's instructions, applying the Customer's processing policy and only for the purposes the data subjects authorized;
3. apply the technical, human and administrative security measures in annex 2 to prevent tampering, loss, unauthorized or fraudulent consultation, use or access;
4. ensure that persons authorized to process the data are bound by confidentiality, including after their relationship with Unbound ends;
5. give access to the data only to those who need it to provide the service, support it or keep it secure, and record support access;
6. update, correct or delete the data when the Customer instructs it or does so in the Platform;
7. refrain from circulating data under dispute by a data subject claim, when the Customer tells it so;
8. inform the Customer of security incidents under the incidents section;
9. delete or return the data at the end of the service, under the return and deletion section;
10. not transfer or remit the data to third parties other than authorized subprocessors;
11. comply with the instructions and requirements of the Colombian Superintendence of Industry and Commerce, the Mexican Secretariat of Anti-Corruption and Good Governance and any other data protection authority that applies to it.

The Customer gives Unbound general authorization to engage the subprocessors on the published list. Unbound will sign with each a written agreement imposing data protection obligations at least equivalent to those of this Addendum, and remains liable to the Customer for its subprocessors.

Unbound will give at least 30 days notice before adding or replacing a subprocessor, by publishing the change on the list and writing to the workspace owner. The Customer may object on reasonable data protection grounds by writing to hello@withunbound.com within that period. If the parties find no solution, the Customer may end the affected service and receive a pro rata refund of the prepaid unused period.

Integrations the Customer decides to connect (for example Google Calendar, Meta, its own Stripe account or the AI model provider it connects over MCP) are not Unbound subprocessors: the Customer contracts them directly and data reaches them on its instruction.

Customer Personal Data is hosted in the United States (annex 3). By subscribing, the Customer instructs and authorizes Unbound to process it there and in the countries of its subprocessors.

Colombia. Communication of Customer data to Unbound and from Unbound to its subprocessors is an international transmission, because Unbound processes the data on behalf of the Customer. Under article 2.2.2.25.5.2 of Decree 1074 of 2015, this Addendum is the transmission contract and sets out the scope of the processing, the activities Unbound carries out for the Customer and Unbound obligations toward the Customer and data subjects. Under that contract, the transmission does not require the Customer to inform the data subject or obtain specific authorization for it.

Mexico. Communication of Customer data to Unbound, as processor, is not a transfer (article 35 of the law) and does not require the data subject's consent. Unbound makes no transfers of Customer Personal Data to third parties on its own account.

European Union, European Economic Area and United Kingdom. Where the GDPR or the UK GDPR applies to the data and it is processed outside those jurisdictions, the parties enter into the standard contractual clauses of Implementing Decision (EU) 2021/914 (module 2, controller to processor, or module 3, processor to processor) and, for the United Kingdom, the International Data Transfer Addendum, incorporated by reference with the options in annex 4. Unbound is not certified under the EU-US Data Privacy Framework. For onward transfers to its subprocessors, Unbound relies on the subprocessor certification under that Framework where it exists, or on the standard contractual clauses.

The Platform lets the Customer view, correct, export and delete the data of its data subjects. If a data subject contacts Unbound to exercise rights over Customer Personal Data, Unbound will pass the request to the Customer within 5 business days and will not answer it on the merits except on the Customer's instruction or a legal duty.

Unbound will give the Customer the reasonable assistance it needs to answer within the legal deadlines: in Colombia, 10 business days for queries and 15 business days for claims; in Mexico, 20 business days to answer ARCO requests and 15 business days to give effect to the decision (article 31 of the law); and in the European Union, one month.

If Unbound becomes aware of a security incident affecting Customer Personal Data, it will notify the workspace owner without undue delay and in any case within 48 hours of becoming aware of it. The notice will include, as far as known: the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed and a contact point. Information not known at once will be provided in phases.

Unbound will at once take reasonable steps to contain the incident and mitigate its effects, and will cooperate with the Customer so it can meet its duties to notify authorities and data subjects, such as reporting incidents to the Colombian Superintendence of Industry and Commerce within 15 business days after detection, the immediate notice to data subjects required by article 19 of the Mexican law or the notice under article 33 of the GDPR. Notifying an incident does not mean Unbound accepts liability.

Unbound will provide the reasonable information the Customer needs to assess the data protection impact of the processing, consult an authority or demonstrate its own compliance, and will keep a record of the processing activities it carries out on behalf of its customers.

When the subscription ends, the schedule in the Terms applies: the workspace stays open 14 more days with nothing deleted, then it is suspended and the data is kept for the retention period after suspension. During that time the Customer may export its data or ask Unbound for a complete export in a structured, commonly used format.

After that period, or earlier if the Customer asks in writing, Unbound will delete Customer Personal Data from its active systems within the following 30 days, and from backups when they are replaced in their normal rotation cycle. While it exists in a backup, the data remains protected by this Addendum and is not processed for any other purpose. Unbound may keep what the law requires it to keep, with the same level of protection. On request, Unbound will certify the deletion.

Unbound will make available to the Customer the information needed to demonstrate compliance with this Addendum, first by answering reasonable written security and privacy questionnaires. If that is not enough, or an authority requires it, the Customer may carry out or commission an audit, with at least 30 days notice, no more than once every 12 months except after an incident, during business hours, without access to data of other customers, at its own cost and through an auditor bound by confidentiality. Unbound currently holds no third party security certifications, such as SOC 2 or ISO 27001.

Each party's liability under this Addendum is subject to the limitation of liability section of the Terms, except where applicable law does not allow it to be limited toward data subjects or authorities. This Addendum applies while Unbound processes Customer Personal Data, including after the Terms end.

• Isolation between customers. Every database query goes through a client that filters reads and stamps writes with the workspace of the request. Business tables carry the workspace identifier and a guard trigger. Automated tests check isolation between workspaces.
• Database access control. Row level security on every table, with no public policies. The browser never queries the database directly: every read and write goes through server routes.
• Authentication. Sign in with a one time code or link sent by email, with a password stored as a bcrypt hash, or with Google when enabled. Sessions in signed, httpOnly cookies limited to the application domain. Sessions never contain the sign in code.
• Permissions. Roles and permissions per person and per module. Agents connected over MCP act only with the permissions of whoever connected them, and the workspace can require human review of their actions.
• Encryption. Traffic encrypted with HTTPS. Third party credentials and integration tokens the Platform stores are encrypted with AES-256-GCM under a dedicated key, separate from all others. The database and storage use the provider infrastructure's encryption at rest, as documented by the provider.
• Secrets. Service and integration keys live only in server environment variables, never in code or logs.
• Abuse. Request limits per IP address and per email on public endpoints, and honeypot fields against automated submissions.
• Logging. Audit log of support entries, workspace status changes and agent actions.
• Backups. Full database copy before every schema change, with a restore drill. The 10 most recent are kept on equipment controlled by Unbound, outside the code repository, taken with a read only database role. [SEED: confirm encryption at rest of the disk holding the backups]
• People. Access to production data limited to those who need it, under a duty of confidentiality.
• Development. Versioned, idempotent, reviewed schema changes, with automated tests before each deployment.

The current list, with the function and location of each subprocessor, is on the subprocessors page, which is part of this Addendum.

• Module 2 when the Customer is a controller, and module 3 when the Customer is itself a processor for a third party.
• Clause 7 (docking clause): does not apply.
• Clause 9: general authorization of subprocessors, with the 30 day notice of this Addendum.
• Clause 11: the independent dispute resolution body option does not apply.
• Clauses 17 and 18: law and courts of Ireland. [SEED: confirm the Member State chosen for the standard clauses]
• Annex I of the clauses: the parties and annex 1 of this Addendum. Annex II: annex 2. Annex III: annex 3.
• For the United Kingdom, the ICO International Data Transfer Addendum, with the parties and options above.