Data Protection Addendum (DPA)

This Data Protection Addendum ("DPA") forms part of the agreement (the "Agreement") between Uncapped Acquisition B.V., trading as Uncapped Acquisition ("Processor", "we"), and the client that signs or accepts it ("Client", "Controller"). It applies whenever we process personal data on the Client's behalf while delivering our services, and replaces any earlier data processing terms between us. It takes effect on the date the Client signs the Agreement or accepts this DPA.

By accepting this DPA on behalf of a company, you confirm you have authority to bind it.

1. Definitions

Terms such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meanings given in the GDPR (Regulation (EU) 2016/679). In addition:

• Client Personal Data: personal data that the Client provides to us, or that we process for the Client, under the Agreement.
• Data Protection Laws: the GDPR, applicable national laws implementing or supplementing it, and, where relevant, the UK GDPR and Swiss data protection law.
• Sub-processor: any third party we engage to process Client Personal Data.
• SCCs: the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, and any UK addendum where applicable.

2. Roles

The Client is the controller and we are the processor of Client Personal Data. The Client is responsible for having a lawful basis for the processing it instructs, including any prospect lists or CRM data it shares with us, and for giving data subjects the required information.

3. Details of processing

Item	Description
Subject matter	Delivery of Uncapped Acquisition's coaching, consulting and done-with-you client acquisition services
Duration	Term of the Agreement, plus the period until deletion under section 10
Nature and purpose	Reviewing, organising and storing data to build, run and optimise the Client's outreach, sales and onboarding systems
Data subjects	Client's prospects, leads, customers, employees and contractors
Data categories	Names, business contact details, job titles, company data, CRM records, call recordings and notes, message history
Special categories	None expected; Client must not share them unless agreed in writing

4. Our obligations

We will:

• process Client Personal Data only on the Client's documented instructions, including the Agreement and this DPA, unless the law requires otherwise (in which case we will tell the Client first, if allowed);
• tell the Client if we believe an instruction breaks Data Protection Laws;
• make sure everyone authorised to process the data is bound by confidentiality;
• never sell Client Personal Data or use it for our own purposes, other than creating anonymised, aggregated statistics that identify neither the Client nor any individual.

5. Security

We maintain appropriate technical and organisational measures, considering the state of the art, cost and risk. These include access controls, two-factor authentication, encryption in transit, least-privilege access, staff confidentiality, and secure deletion. We may update these measures as long as overall protection does not decrease.

6. Sub-processors

The Client gives general authorisation for us to use sub-processors. We will:

• impose data protection terms on each that are no less protective than this DPA;
• remain liable to the Client for their performance;
• keep a current list available on request at help@uncappedacquisition.com;
• notify the Client at least 14 days before adding or replacing a sub-processor. The Client may object on reasonable data protection grounds; if we cannot resolve it, the Client may terminate the affected service.

7. International transfers

We or our sub-processors may process Client Personal Data outside the EEA only where an adequacy decision applies or appropriate safeguards are in place, such as the SCCs. Where the SCCs are needed between the Client and us, they are incorporated by reference, with the Client as data exporter and us as data importer (Module 2, or Module 3 for onward transfers).

8. Assistance

Taking into account the nature of the processing, we will reasonably assist the Client with:

• data subject requests (access, rectification, erasure, restriction, portability, objection). If a request reaches us directly, we will forward it to the Client and not respond ourselves unless instructed or legally required;
• security, breach notification, data protection impact assessments and prior consultations with supervisory authorities.

Assistance beyond what is reasonable or caused by the Client's own instructions may be charged at our standard rates.

9. Personal data breaches

We will notify the Client without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data. The notice will describe, as far as known: what happened and when; the categories and approximate number of people and records affected; likely consequences; and the measures we have taken or propose. We will take reasonable steps to contain and remedy the breach.

10. Return and deletion

Within 30 days after the Agreement ends, we will, at the Client's choice, return or delete Client Personal Data, and confirm deletion in writing on request. We may keep copies where the law requires it; those stay protected under this DPA.

11. Audits

We will make available the information reasonably needed to demonstrate compliance with this DPA, including answering security questionnaires within 30 days. If that is not sufficient, the Client may conduct an audit, or appoint an independent auditor bound by confidentiality, no more than once a year, with at least 30 days' notice, during business hours and at the Client's cost. Audits will not cover other clients' data or our providers' facilities.

12. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws do not allow this. If this DPA conflicts with the Agreement on data protection, this DPA prevails. If it conflicts with the SCCs, the SCCs prevail.

13. Term and governing law

This DPA lasts as long as we process Client Personal Data under the Agreement. It is governed by the law and courts specified in the Agreement, unless Data Protection Laws require otherwise.