Data Processing Addendum

Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement. In this DPA, the following terms shall have the meanings set out below:

“Aggregate Data” means information that relates to a group or category of individuals, from which individual identities have been removed, and that is not linked or reasonably linkable to any individual or household.

“Customer Personal Information” means any Personal Information Processed by Unprompted or Unprompted’s Subprocessor, solely on behalf of Customer, in connection with the Unprompted Products provided pursuant to the Agreement and an applicable Order Form.

“Data Protection Assessment” means an assessment of the impact of processing operations on the protection of Personal Information and the rights of Data Subjects, which may also be called a “Data Protection Assessment,” “Data Protection Impact Assessment,” or “Risk Assessment” by applicable Data Protection Laws.

“Data Protection Laws” means any and all applicable U.S. data protection, security, or privacy-related laws, statutes, directives, or regulations, including but not limited to: (a) the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq. (“CCPA”), together with any amending or replacement legislation, including the California Privacy Rights Act of 2020 and any regulations promulgated thereunder; (b) the Virginia Consumer Data Protection Act of 2021, Va. Code Ann. § 59.1-571 to -581; (c) the Colorado Privacy Act of 2021, Co. Rev. Stat. § 6-1-1301 et seq.; (d) Connecticut Public Act No. 22-15, “An Act Concerning Personal Data Privacy and Online Monitoring”; (e) the Utah Consumer Privacy Act of 2022, Utah Code Ann. § 13-61-101 et seq.; (f) the Texas Data Privacy and Security Act, 11 Tex. Bus. & Com. Code § 541.001 et seq.; (g) the Oregon Consumer Privacy Act, Or. Rev. Stat. § 646A.570 et seq.; (h) the Montana Consumer Data Privacy Act, Mont. Code Ann. § 30-14-2801 et seq.; (i) the Iowa Consumer Data Protection Act, Ia. Code Ch. 715D; (j) the New Hampshire Data Privacy Act, N.H. Rev. Stat. Ann. 507-H; (k) the Nebraska Data Privacy Act, Neb. Rev. Stat. § 87-1101 et seq.; (l) the Delaware Personal Data Privacy Act, Del. Code § 12D-101 et seq.; (m) the New Jersey Data Privacy Act, N.J. Rev. Stat. § 56:8-166.4 et seq.; (n) the Tennessee Information Protection Act, Tenn. Code Ann. § 47-18-3201 et seq.; (o) the Minnesota Consumer Data Privacy Act, Minn. Stat. § 325O.01 et seq.; (p) the Maryland Online Data Privacy Act of 2024, Md. Code Ann., Com. Law § 14-4601 et seq.; (q) the Kentucky Consumer Data Protection Act, Ky. Rev. Stat. § 367.3611 et seq.; (r) the Indiana Consumer Data Protection Act, Ind. Code § 24-15; (s) the Rhode Island Data Transparency and Privacy Protection Act, R.I. Gen. Laws § 6-48.1-1 et seq.; (t) the Washington “My Health My Data” Act, Wash. Rev. Code § 19.373.005 et seq., and Nev. Rev. Stat. § 603A, as amended by Nevada S.B. 370 (“Washington and Nevada Consumer Health Data Laws”); and (u) all other equivalent or similar laws and regulations in the United States relating to Personal Information and privacy, and as each may be amended, extended or re-enacted from time to time.

“Data Subject” means an identified or identifiable natural person whose Personal Information is being Processed. The term “Data Subject” shall refer to a “Consumer” as that term is defined under Data Protection Laws.

“Deidentified Data” means information that cannot reasonably identify, relate to, describe, be capable of being associated with, be linked directly or indirectly with, or be reasonably be used to infer information about an identifiable natural person.

“Personal Information” means information that is protected by applicable Data Protection Laws or that otherwise that identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a particular individual or household.

“Personnel” means officers, directors, employees, Subprocessors, agents and representatives.

“Regulatory Authority” means the applicable public authority or government agency responsible for supervising compliance with Data Protection Laws, including, but not limited to: the California Privacy Protection Agency; and U.S. state attorneys general.

“Security Breach” means any security incident that adversely impacts the security of Customer Personal Information.

“Subprocessor” means any third party, including any Subcontractor (as defined in the Agreement) or provider of Third Party Materials, appointed by Unprompted to Process Customer Personal Information as a Processor or Service Provider on behalf of Customer in connection with the Agreement.

The terms “Business,” “Business Purpose,” “Controller,” “Process,” “Processor,” “Sell,” “Service Provider,” and “Share” shall have the same meaning as in the Data Protection Laws, and their cognate terms shall be construed accordingly.

The Parties acknowledge and agree that with regard to the Processing of Customer Personal Information, Customer is the Controller or Business (as applicable), Unprompted is the Processor or Service Provider (as applicable), and that Unprompted will engage Subprocessors pursuant to the requirements set forth in Section 5 below. The Parties acknowledge and agree that neither Party has reason to believe that the other Party is unable to comply with the provisions of this DPA or otherwise that such Party is in violation of any Data Protection Law. For clarity, Unprompted is not responsible for compliance with any Data Protection Laws applicable to Customer or Customer’s industry that are not otherwise generally applicable to Unprompted.

Unprompted shall treat Customer Personal Information as confidential and shall only Process Customer Personal Information as necessary to perform its obligations on behalf of and in accordance with Customer’s documented instructions for the following permitted purposes: (i) in accordance with the Agreement and applicable Order Form and applicable Data Protection Laws (including without limitation, the CCPA); and/or (ii) as applicable, if initiated by Data Subjects in their use of the Unprompted Products. Unprompted shall not (A) Sell, Share, or otherwise make available Customer Personal Information to any third party in exchange for monetary or other valuable consideration, and (B) retain, use or disclose Customer Personal Information outside of the direct business relationship with the Customer or for any other purpose than what is specified in the Agreement and/or this DPA. When acting as a Service Provider under the CCPA, Unprompted shall not combine Customer Personal Information with Personal Information it receives from, or on behalf of, another person or persons, or that it processes as a Business, except as expressly permitted by Data Protection Laws. Unprompted shall promptly notify Customer after it makes a determination that it can no longer meet its obligations under applicable Data Protection Laws. To the extent Resultant Data (as defined in the Agreement) is derived from Customer Personal Information, Unprompted shall only use such Resultant Data in the form of Aggregate Data and/or Deidentified Data, or otherwise as a permitted Business Purpose under Data Protection Laws (including to improve, operate, or develop the Unprompted Products). Nothing herein shall limit or restrict Unprompted’s right to use Aggregate Data and/or Deidentified Data or limit Unprompted’s right to use Customer Personal Information in any manner that is not restricted by specific Data Protection Laws.

Customer shall, in its use of the Unprompted Products, Process Personal Information in accordance with the requirements of Data Protection Laws. Customer’s instructions to Unprompted related to the Processing of Customer Personal Information shall comply with Data Protection Laws. Customer instructs Unprompted (and authorizes Unprompted to instruct each Subprocessor) to Process Customer Personal Information, and in particular, transfer Customer Personal Information to any jurisdiction, as necessary for the provision of the Unprompted Products and consistent with the Agreement and this DPA. Customer represents and warrants that it shall (i) not provide Unprompted with (or instruct Unprompted to Process) any Personal Information unless it shall first have given and received the necessary notices and consents (and honored any opt-out rights) under Data Protection Laws; (ii) not provide Unprompted with Personal Data of Data Subjects outside the United States; and (iii) comply with any other requirements under applicable Data Protection Laws.

The subject matter of Processing, the duration of the Processing, the nature and purpose of the Processing, the types of Customer Personal Information, and categories of Data Subjects Processed under this DPA are specified in Annex I attached hereto.

Customer shall not disclose, transfer, or otherwise make available to Unprompted any of the following categories of information:

• Any information that constitutes “sensitive personal information,” “sensitive data,” “sensitive data inferences,” or “special categories of personal data” as those terms are defined under Data Protection Laws;
• Any information that constitutes “consumer health data” under the CTDPA or the Washington and Nevada Consumer Health Data Laws;
• Any information that constitutes “protected health information” under the Health Insurance Portability and Accountability Act of 1996, 5 U.S.C. § 553 et seq., together with any amending legislation and any regulations promulgated thereunder; and
• Any Personal Information that is deemed by Regulatory Authorities as meriting sensitive or other heightened treatment under applicable Data Protection Laws or U.S. state or federal consumer protection laws.

The Parties shall reasonably cooperate in responding to Data Subject rights requests (“Data Subject Request”) and complying with requirements of Data Protection Laws in relation thereto.

If a Data Subject Request is made directly to Unprompted, Unprompted will promptly inform Customer and will advise the Data Subject to submit the request to Customer. Customer will be solely responsible for responding substantively to any such Data Subject Requests or other communications involving Personal Information.

Unprompted shall ensure that its Personnel engaged in the Processing of Customer Personal Information are informed of the confidential nature of the Customer Personal Information, and have received appropriate training regarding the Processing of Customer Personal Information.

Unprompted shall endeavor, in the exercise of its reasonable business discretion, to ensure the reliability of any Personnel engaged in the Processing of Customer Personal Information.

Unprompted shall ensure that Unprompted’s access to Customer Personal Information is limited to those Personnel providing the Unprompted Products in accordance with the Agreement.

With respect to the Processing of Customer Personal Information, Customer authorizes Unprompted’s engagement of Subprocessors from the list provided in Annex II to Process Customer Personal Information for a business purpose on behalf of Customer, and consistent with the business purpose set forth herein, pursuant to a written contract that includes obligations that are at least as protective as those set out in this DPA and as required by Data Protection Laws.

Unprompted shall maintain appropriate physical, technical and organizational measures designed to protect the security, confidentiality, and integrity of Customer Personal Information. In the event of any (i) unauthorized acquisition, alteration, or disclosure of Customer Personal Information that requires notification to an individual, government or regulatory body, or law enforcement authority under Data Protection Laws, or (ii) breach of Data Protection Laws with respect to Customer Personal Information, Unprompted shall notify Customer promptly.

Unprompted shall maintain security incident management policies and procedures, and if at any time Unprompted determines that there has been a Security Breach, Unprompted shall promptly: (i) notify Customer in writing of such Security Breach; (ii) investigate and take steps to remediate the Security Breach, and (iii) provide information regarding the specific Customer Personal Information adversely impacted by the Security Breach as reasonably requested by Customer.

If required of Unprompted under applicable Data Protection Laws, Unprompted shall reasonably cooperate with Customer at Customer’s expense, in relation to any audit of Unprompted reasonably necessary to enable Customer to comply with its obligations under Data Protection Laws (“Audit”), and shall seek the equivalent cooperation from relevant Subprocessors. Any Audit shall be: (i) subject to a mutually agreed upon scope; (ii) conducted by an independent third party who has signed a nondisclosure agreement with Unprompted or the Subprocessor, as the case may be; and (iii) subject to the confidentiality obligations set forth in the Agreement. Customer shall use reasonable endeavours to minimize any disruption caused to Unprompted’s (or, Subprocessor’s, as the case may be) business activities as a result of an Audit. Audits shall take place no more than once in any calendar year except as otherwise required of Unprompted under applicable Data Protection Laws. In addition, if required of Unprompted under applicable Data Protection Laws, Unprompted shall allow Customer to take reasonable and appropriate steps to (a) ensure that Unprompted’s Use of Customer Personal Information is consistent with Customer’s obligations under applicable Data Protection Laws, and (b) stop and remediate unauthorized use of Customer Personal Information. Any information disclosed in connection with an Audit shall be the Confidential Information of Unprompted (and/or Subprocessor, as the case may be) and subject to Section 6(A) of the Agreement.

Upon Customer’s request and to the extent required of Unprompted under applicable Data Protection Laws, Unprompted shall provide Customer, at Customer’s reasonable expense with the reasonably necessary information needed for Customer to carry out a Data Protection Assessment related to Customer’s use of the Unprompted Products, to the extent that Customer does not otherwise have access to the relevant information and that such information is reasonably available to Unprompted.

Upon termination or expiration of the Agreement, or on the written request of Customer, Unprompted shall return all Customer Personal Information to Customer and/or at Customer’s request delete the same from its systems within thirty (30) days, except as otherwise required or permitted by applicable Data Protection Laws or as permitted under Section 10(C) of the Agreement.

This DPA is governed by the laws of the State of New York, and any disputes or claims howsoever arising under this DPA, including disputes regarding its existence, validity or termination, shall be brought exclusively in the courts specified in Section 11(F) of the Agreement.

SECTION 9(D) (LIMITATION OF LIABILITY) OF THE AGREEMENT SHALL APPLY TO ALL CLAIMS, DEMANDS, SUITS, CAUSES OF ACTION, AWARDS, JUDGMENTS AND LIABILITIES, INCLUDING REASONABLE ATTORNEYS’ FEES AND COSTS, ARISING OUT OF OR ALLEGED TO HAVE ARISEN OUT OF UNPROMPTED’S BREACH OF ITS OBLIGATIONS UNDER THIS DPA, INCLUDING WITH RESPECT TO LIABILITY RELATING TO A SECURITY BREACH OR ALLEGED OR ACTUAL VIOLATION OF DATA PROTECTION LAWS.

In the event of any change to or new Data Protection Law(s), the Parties shall mutually agree upon any reasonably necessary amendments or revisions to this DPA.

The subject matter of Processing of Personal Information is the provision of the Unprompted Products to Customer, including Unprompted’s agentic platform and “front desk agent” coordination and operational support agentic tool, and related software features and functionalities, as further described in the applicable Order Form.

The duration of Processing of Personal Information is as set forth in the Agreement.

Unprompted will Process Personal Information within the Unprompted Products (including any Dedicated Hardware), the systems of its Subprocessors, Customer’s connected third-party systems (such as booking or membership platforms), and the messaging channels used to deliver communications, solely to provide the Unprompted Products to Customer in accordance with Customer’s instructions, including standing instructions and configurations. This may include collecting, receiving, importing, storing, organizing, indexing, analyzing, and transcribing Personal Information; generating responses, drafts, summaries, and recommendations; sending messages to Customer’s members and contacts; maintaining member profiles reflecting preferences, activity, and relationships; and taking actions via Agents, such as making or updating bookings in Customer’s connected systems, as directed or authorized by Customer.

Personal Information will be Processed solely for the purposes expressly set forth in the Agreement.

Customer’s members, players, and contacts:

• Identifiers and contact details: name, preferred name, email, phone number, messaging handles (WhatsApp, iMessage), and member IDs from Customer’s booking or membership platform
• Membership information: membership type, status, and tags assigned by Customer
• Demographic information: gender and age (age is calculated from date of birth where Customer’s platform provides it)
• Activity and preference information: booking and attendance history, programs and events, skill ratings (e.g. DUPR, WPR, NTRP), play frequency and habits, scheduling preferences, and who members play with
• Communications: the content of messages exchanged with members through Customer’s channels, including text, images, attachments, and voice notes (and their transcriptions), plus delivery and reply status
• Profiles and inferences: summaries, notes, and recommendations the Products generate about members from the above

Customer’s staff and authorized users:

• Name, email, phone number, role, and Slack identifiers
• Login and authentication records, and device identifiers for app notifications
• Instructions, messages, and approvals staff give the Unprompted Products

Does Unprompted Process any “sensitive” Personal Information? No.

• Members and players: Customer’s current and former members, players, and customers, including those listed in Customer’s booking or membership platform or member lists
• Guests and non-members: People who book, attend, or register for Customer’s courts, programs, clinics, events, or tournaments without a membership
• Leads and prospects: People Customer identifies as potential members or customers, including those on lead lists Customer provides
• Coaches and instructors: Coaches, instructors, and program staff associated with Customer
• Customer staff and authorized users: Customer’s employees, contractors, and administrators who use the Unprompted Products or direct the agents
• Group chat participants: people in group conversations Customer connects to the Unprompted Products (e.g. WhatsApp or iMessage groups), who may include people not otherwise in Customer’s records
• Third parties mentioned in communications: People that members or staff refer to in messages, such as playing partners.

• Supabase
• OpenAI
• Anthropic
• Vercel
• Resend
• Slack
• Meta
• Apple