Data processing agreement

Controller: the business customer named in the signature block ("Customer").

Processor: Eckhardt Media Solutions S.R.L., Strada Harmanului 24h, Tarlungeni, Romania, fiscal code (CUI) 50306295, operating Unfictive ("Unfictive").

Unfictive processes personal data to provide the Unfictive service under the terms of service, for as long as the Customer uses the service and until the data is deleted or returned under this agreement.

Nature and purpose: storing and structuring briefs and files, AI-assisted processing, preparing supplier requests, supplier outreach at the Customer's instruction, and presenting quotes, samples and orders.

Types of personal data: names, business contact details and other personal data contained in briefs, uploaded files, messages, quotes and order records.

Data subjects: the Customer's employees and contacts, and supplier contacts named in the Customer's material.

Unfictive processes personal data only on the Customer's documented instructions, including releasing a supplier request the Customer has approved. People authorised to process the data are bound to confidentiality. Unfictive implements the technical and organisational measures in the annex, assists the Customer with data subject requests and with its obligations under Art. 32 to 36 GDPR, and notifies the Customer of a personal data breach without undue delay.

The Customer authorises the subprocessors listed on the Unfictive subprocessors page. Unfictive informs the Customer before adding or replacing a subprocessor, and the Customer may object on reasonable grounds. Unfictive imposes data protection obligations on each subprocessor equivalent to this agreement.

Supplier requests are sent to factories in China at the Customer's instruction. Unfictive team members in Shanghai, China, access submitted projects to run outreach and verification. Transfers to US-based subprocessors are covered by the Standard Contractual Clauses in their data processing agreements and, where the provider is certified, the EU-US Data Privacy Framework. Supplier requests go to China at the Customer's instruction, because this is necessary for the service the Customer requested (Art. 49(1)(b) GDPR). Team members in China act for Unfictive, on its instructions and under confidentiality obligations; their access is limited as set out in the annex.

When the service ends, Unfictive deletes or returns the personal data at the Customer's choice, unless law requires it to be kept. Unfictive makes available the information needed to demonstrate compliance and allows reasonable audits with prior notice. Liability follows the terms of service.

• Data in transit is encrypted with TLS; project data and files are stored in private storage in Frankfurt, Germany.
• Customers can read only their own company's data; database functions run only through the server and recheck access on every call.
• Unfictive staff access requires an individual staff account on an allowlist and covers only projects with a submitted request.
• Fields marked private, such as target prices, are withheld from suppliers by default; releases are frozen, authorised snapshots.
• Supplier quotes and updates are reviewed and published explicitly before customers see them.
• Abuse protection on public forms stores only hashed network identifiers.
• Product usage events contain no customer content and expire after twelve months.

Customer: name, address, signatory, date.

Unfictive: Eckhardt Media Solutions S.R.L., represented by Vincent Eckhardt, Managing Director, date.