Data processing agreement

Last updated: 2026-11-14

1. Subject

This agreement governs the processing of personal data that Unicorn Private LLC (the "Processor") carries out on behalf of the Client (the "Controller") when providing Unicorn Contracts, in accordance with article 28 of Regulation (EU) 2016/679 (GDPR).

2. Data and data subjects

Data of the legal representative, of employees and of technical staff indicated in the bids (name, role, qualifications, curricula), data contained in references and in the documents provided by the Controller.

3. Instructions

The Processor processes the data only to prepare the bids requested and to provide the Service, following the documented instructions of the Controller, and informs the Controller if an instruction seems contrary to the law.

4. Security

The Processor applies appropriate technical and organisational measures: encryption in transit, access limited to authorised accounts, separation of the data of each client, records of access.

5. Sub processors

The Controller authorises the sub processors listed in the privacy policy. The Processor informs the Controller of new sub processors at least 30 days in advance; the Controller may object and cancel the Service.

6. Location of the data

The data are kept in the European Union. Any transfer outside the European Union takes place with the safeguards of chapter V of the GDPR, such as the standard contractual clauses.

7. Assistance and breaches

The Processor assists the Controller in responding to requests of data subjects and notifies personal data breaches without undue delay and in any case within 48 hours of becoming aware of them.

8. End of the processing

At the end of the Service the Processor deletes the data within 90 days, except for the data needed to manage the success bonus and those that must be kept by law, and on request returns them to the Controller in an open format.