Data Processing Addendum

Unique AG

Version 2.0 (Jul 2025)

This Data Processing Addendum (“DPA”) forms part of the Contract / Main Agreement, Unique Terms of Service (accessible via Terms of Service), the Privacy Policy (Privacy Policy), or other agreement governing the use of Unique’s service (collectively, the “Agreement”) entered by and between you (“you”, “your”, “Customer“, “Client”), and Unique AG (“Unique”, “provider”).

This DPA sets out the terms that apply with regard to the Processing of Personal Data (as defined below) by Unique, on behalf of Customer, in the course of providing the Unique Service to Customer under the Agreement.

All capitalized terms not defined herein will have the meaning outlined in the Terms of Service and the Main Agreement.

By clicking the "I agree" button/box on the Unique website, accessing the Unique website, utilizing the Service (e.g. Unique AI), or signing the DPA, you accept this DPA, you agree to be bound by this DPA and you represent and warrant that you have full authority to bind the Customer to this DPA.

1

DEFINITIONS

“Affiliate” means any entity that directly or indirectly controls is controlled by or is under common control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

1.1 “Authorized Affiliate” means any of Customer’s Affiliate(s) which (a) is subject to the Data Protection Laws and Regulations, and (b) is permitted to use the Service pursuant to the Agreement between the Customer and Unique and is not a “Customer” as defined under the Agreement.

1.2 “Authorized User” means any individual authorized or otherwise enabled by Customer to use the Service through Customer’s account.

1.3 “Controller” means the entity which determines the purposes and means of the Processing of Personal Data.

1.4 “Customer Data” means what is defined in the Agreement as “Customer Data”.

1.5 "Data Protection Laws" means all privacy and data protection laws and regulations applicable to the processing of personal data under the Agreement in the jurisdiction(s) specified in the MSA.

1.6 “Data Subject” means an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

1.7 “Deployment options” means the three different deployment models Unique is currently offering: 1. Multi-tenant on Unique cloud, 2. Single tenant on Unique cloud and 3. Customer-managed tenant on customer cloud.

1.8 “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

1.9 “Personal Data” or “Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to or with a particular Data Subject or household, which is included in Customer Data Processed by Unique on behalf of Customer under the Agreement.

1.10 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed by Unique on behalf of Customer under the Agreement.

1.11 “Personnel” means persons authorized by Unique to Process Customer’s Personal Data.

1.12 “Process” or “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, blocking, erasure or destruction.

1.13 “Processor” means the entity that processes Personal Data on behalf of the Controller.

2

PARTIES AND ROLES

Details on the identities of the parties can be found in the main agreement. In this context and for the purposes of relevant Data Protection Laws, the Customer is the Data Controller, and Unique is the Data Processor (for multi-tenant and single-tenant deployment options on Unique cloud).

3

DATA PROCESSING

3.1 This DPA applies when Personal Data is Processed by Unique strictly on behalf of the Customer, as part of Unique’s provision of the Service.

3.2

Subject Matter

Unique Processes Customer’s Personal Data as part of providing Customer with the Service, pursuant to the specifications under the Agreement.

3.3

Processing by Subprocessors

Unique may engage third-party service providers to Process Personal Data on behalf of the Customer (“Sub-Processors“). The Sub-Processors are listed in Appendix A.

3.4 Technical and organizational measures are listed in Appendix B.

3.5 Insofar as a data processing operation falls within the scope of the GDPR, the competent authority in the EEA/EU is the authority according to art. 77 GDPR. A list of competent national data protection authorities in the EEA/EU can be found at EDPB.

3.6 Insofar as persons in Switzerland are affected or the data is processed in or from Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC). The contact details of the FDPIC can be found at FDPIC.

3.7 Insofar as a data processing operation falls within the scope of the UK GDPR, the competent supervisory authority is the Information Commissioner's Office (ICO) in the United Kingdom.

3.8 Insofar as a data processing operation falls within the scope of applicable US federal or state privacy laws, the competent authority varies by jurisdiction and may include the Federal Trade Commission (FTC) at the federal level, state attorneys general, or other designated regulatory bodies as specified under the relevant state privacy legislation.

3.9 Insofar as a data processing operation falls within the scope of the Personal Data Protection Act (PDPA) in Singapore, the competent authority is the Personal Data Protection Commission (PDPC). The contact details of the PDPC can be found at PDPC.

3.10

Categories of data subjects whose personal data is processed

Customer may submit Personal Data to the Services, the extent of which is determined and controlled by the Customer in its sole discretion, and which may include, but is not limited to Personal Data relating to the following Categories of Data Subjects:

a) Prospects, customers, business partners, and vendors of Customers (who are natural persons)

b) Employees or contact persons of Customer's prospects, customers, business partners, and vendors

c) Employees, agents, advisors, and freelancers of Customers (who are natural persons)

d) Customer’s Users authorized by Customer to use the Services

3.11

Categories of personal data processed

Unique collects information that alone or in combination with other information could be used to identify (“Personal Information”). Customer may submit Personal Data to the Services, the extent of which is determined and controlled by the Customer in its sole discretion, and which may include, but is not limited to the following Categories of Personal Data:

a) First and last name

b) Title

c) Position

d) Employer

e) Contact information (company, email, phone, physical business address)

f) ID data

g) Professional life data

h) Personal life data

i) Localization data

The processor may collect further categories of Personal Data depending on how end users use Unique Services:

j) Account Information: When a Controller’s End User creates an account with Unique, Unique may collect information associated with an End User account, including the End User’s name and email address (collectively, “Account Information”).

k) User Content: When the Controller uses Unique Services, Unique may collect Personal Information that is included in the input, file uploads, output, or feedback that the Controller provides to Unique’s Services (“Content”).

l) Communication Information: If the Controller’s End Users communicate with Unique via a support channel, Unique may collect the Controller’s End User name, contact information, and the contents of any messages you send (“Communication Information”).

3.12

Sensitive categories of data processed

Customer may submit Special Categories of Data to the Services, the extent of which is determined and controlled by the Customer in its sole discretion, and which is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of Uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

3.13

Nature of processing

The nature of data processing is the collection and processing of the information of the persons involved during a recording.

3.14

Purposes for Processing Personal Data on behalf of the Controller

Recording use case:

The Processor will process contact information (company, email, phone, physical business address), start time of the recording, end time of the recording, and language in which conversations are held. The Processor stores and processes the voice and transcript of the conversations during a video call or an offline meeting via the Unique app. If video call services such as Zoom and MS Teams are used, video footage may be recorded if enabled.

The purpose of the data processing is to analyze and evaluate the conversation (e.g. generate GPT-based summaries, and follow-up emails) and to provide advice to the customer on the improvement of their sales process. All participants who have consent to the recording, transcription, and analyses of meetings and subsequent conversations and the transfer of respective data from the customers to the Processor are entitled to withdraw the given consent at any time with effect for the future. The withdrawal can be given without reason. To do so, these data subjects can contact us by email at privacy@unique.ch. As a consequence of the revocation, neither the customers nor Unique may continue to process the data based on this consent in the future.

Chat use case:

The Processor will store and process

a) internal documents and document texts that have been uploaded or connected to the Service by the Controller.

b) Account information provided by the Controller’s End Users

c) prompts and answers of the Controller’s end users.

Further, the Processor uses the Customer's personal data and metadata for the following purposes:

d) To facilitate, operate, enhance, and provide the Services;

e) To provide the Customers and users with assistance and support;

f) To gain a better understanding on how individuals use and interact with our Sites and Services, and how we could improve their and others’ user experience, and continue improving our products, offerings and the overall performance of our Services;

g) To contact the Customers with general service-related messages,

h) To support and enhance the Processor’s data security measures, including for the purposes of preventing and mitigating the risks of fraud, error, or any illegal or prohibited activity;

i) To comply, and maintain compliance, with applicable laws, regulations, and standards.

3.15

Duration of processing

Unique will retain the Customer's personal data for as long as is reasonably necessary to maintain and provide its services, to comply with its legal and contractual obligations, or to protect Unique from any potential disputes (i.e. as required by law for log-keeping, record keeping, and accounting purposes, and to have evidence and proof of its relationship with the Customer in the event that any legal issues arise after the Customer ceases to use the Services), all in accordance with Unique's Data Retention Policy. Please note that except as required by applicable law or the specific agreements between the Provider and the Customer, Unique will not be obligated to retain personal data for any particular period (except, audit logs will be kept for 10 years), and are free to securely delete it or restrict access to it for any reason and at any time, with or without notice to the client. Questions about the data retention policy of the client can be asked by email at privacy@unique.ch.

4

Data Protection

4.1 The Provider must, at all times, take all necessary security and protective measures against, in particular, destruction, loss, access by unauthorized third parties or alteration of or to data provided or administered by the Client or its subcontractors to which the Provider has access for the purposes of fulfilling its obligations under the Agreement.

4.2 The Provider undertakes to and shall ensure to report to Client any incident impacting the confidentiality, integrity, and availability of Client’s or its subcontractors’ data, promptly and without undue delay, but in no event later than 24 hours after becoming aware of any incident, by sending an email to Unique’s Enterprise address and by calling the contact person designated (from time to time) by the Client. The email must detail the known details of the incident, the implications, and the Provider’s actions undertaken in response to such an event.

5

Data Property

All Confidential Information is and shall remain the Client’s exclusive property, and shall be treated as the Client’s Confidential Information. Likewise, the information generated by the systems, such as application logs, tables, reports, accounts, and printed material of any and all types (account statements, etc.), is the Client’s exclusive property. The Provider shall acquire no rights over this information or data and only use the Confidential Information to the extent necessary for the performance of the Services. Unless written approval from the Client is given in advance, Confidential Information must not be, notably:

a) used by the Provider and/or its employees, agents, or representatives other than for the strict fulfillment of those obligations stipulated in the Agreement, which implies the data shall be rigorously physically and/or logically segregated from data of the Provider’s other users;

b) disclosed, sold, given, handed over, or made accessible in any other way by the Provider and/or by its employees, agents, or representatives to third parties.

6

Data Storage, Return, and Destruction

6.1 The Provider will accurately and completely collect and maintain information regarding the storage location, media, and method of storage of all Confidential Information on an ongoing basis. The storage shall remain in Switzerland. At the Client’s request and by the termination of the Agreement at the latest, the Provider undertakes, at its own costs,

a) to return to the Client, within a reasonable time and in its existing format, data which the Provider has knowledge of, and

b) to delete or destroy all or part of any such data that might remain in the Provider’s possession or of which the Provider might have retained a copy (especially in archived or backed-up files) which is subject to the applicable legal provisions, particularly record keeping.

6.2 Except in those cases where the Provider is using the Client’s material, the Provider shall guarantee a backup policy on its material to enable recovery of the data related to the Services in the event of data loss. Any associated costs shall be borne by the Provider.

7

GOVERNING LAW AND EXCLUSIVE COURTS

Unless the GDPR is mandatory or otherwise specified in the MSA, this Agreement shall be governed exclusively by Swiss substantive law, without regard to its choice of law or conflicts of law principles, Customer and Unique consent to the exclusive jurisdiction and venue in the courts in Zurich 1, Switzerland.

APPENDIX A – LIST OF THE SUB-PROCESSORS OF THE DPA

Details on sub-processors activities:

APPENDIX B - TECHNICAL AND ORGANIZATIONAL MEASURES (TOM) Unique AG

TECHNICAL AND ORGANIZATIONAL MEASURES

The following sections define Unique’s current security measures. Unique may change these at any time without notice so long as they maintain a comparable or better level of security.

Physical Access Control.

Unauthorized persons are prevented from gaining physical access to premises, buildings, or rooms where data processing systems that process and/or use Personal Data are located.

Measures:

• Unique protects its assets and facilities using the appropriate means based on a security classification conducted by an internal security department. • In general, buildings are secured through access control systems. • Access rights are granted to authorized persons on an individual basis.”} ```