Data Processing Addendum

1. Who does what

• "You" means the business that holds the PromptUI account. "We" means Vrising Properties Ltd (trading as PromptUI), a company registered in England and Wales under company number 15713546, with its registered office at 3 Hemingway Loke, Milton Keynes, Buckinghamshire, MK4 4QG, United Kingdom. "Data protection law" means the UK GDPR and the Data Protection Act 2018 and, where they apply to your processing, the EU GDPR and other laws of the same kind.
• When PromptUI processes personal data about your customers, the people who contact you, or visitors to websites you build with PromptUI, you are the controller and we are your processor. This DPA covers that processing ("Customer Personal Data").
• Data about you and your team as PromptUI account holders is covered by our Privacy Policy, where Vrising Properties Ltd (trading as PromptUI) is the controller.

2. Details of the processing

• Subject matter and purpose: providing the features you use, such as the inbox for social messages and comments, lead forms, enquiries, reply drafts, ad measurement on your websites, and apps built with PromptUI Cloud data.
• Nature: collecting through the platforms you connect, storing, organising, showing to your workspace, sending to AI providers to draft replies you approve, sending replies you confirm, and deleting.
• Duration: while your account is open, and after that until the data is deleted under section 9. Shorter periods for some data are set out in the Privacy Policy.
• Types of personal data: names and display names, contact details (such as email address and phone number), platform account IDs, the content of messages, comments and reviews, lead-form answers, enquiry details, ad click identifiers with the visitor's consent choice, and data you or your app's users store in apps built with PromptUI Cloud data.
• Data subjects: your customers and prospective customers, people who message or comment on your connected accounts, people who fill in your lead forms or send you enquiries, visitors to websites you build with PromptUI, and users of apps you build with PromptUI Cloud data.
• Special category data: the Service is not designed for it. Do not use these features for special category or criminal-offence data without your own legal advice.

3. Your instructions

• We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, and the settings and actions you choose in the Service (for example turning on the inbox or approving a reply).
• If the law requires us to process it in another way, we will tell you first unless the law forbids that.
• If we think an instruction breaks data protection law, we will tell you.
• We do not sell Customer Personal Data, use it for our own marketing, or combine it with other customers' data.

4. Confidentiality

Only people who need access to run and support the Service can access Customer Personal Data, and they are bound by a duty of confidentiality. Inside the Service, only members of your workspace can see it.

5. Security

We take measures appropriate to the risk, including:

• encryption in transit (HTTPS/TLS) and encryption at rest in our main database;
• encrypting the access tokens of connected platforms before we store them;
• keeping secrets out of source code, and limiting access to production systems to the people who run the Service;
• keeping each workspace's data visible only to that workspace;
• sending AI providers only the content the task needs; Growth, Ads and Operate requests are configured to ask them not to store or train on it, where the request type supports it;
• deleting data at the end of the periods set out in the Privacy Policy.

No system is completely secure, and we do not hold a security certification. We review these measures as the Service changes.

6. Sub-processors

• You give us general authorisation to use the sub-processors on our sub-processor list, and to add or replace them as set out here.
• Before we add or replace a sub-processor that processes Customer Personal Data, we update the list and email the account owner at least 30 days before the change takes effect. If a change is urgent (for example, for security or because a provider fails), we tell you as soon as we can.
• You can object to a change on reasonable data protection grounds by emailing hello@promptui.co within that notice period. We will work with you in good faith to resolve it. If we cannot, you may stop using the feature that relies on that sub-processor, or close your account.
• If you object to a new sub-processor on reasonable data-protection grounds and we cannot resolve the objection, you may cancel the affected paid service and we will refund any prepaid fees for the unused period, pro rata.
• We use sub-processors under written terms that impose the same data protection obligations as in this DPA (usually the provider's own published data processing terms). We remain responsible to you for how our sub-processors process Customer Personal Data.
• Platforms you choose to connect (such as Meta, Google, LinkedIn, X, TikTok and Shopify) are not our sub-processors. They handle the data you publish or read through them under their own terms with you.

7. International transfers

• Some sub-processors process data outside the UK, as shown on the sub-processor list. Each restricted transfer under UK data protection law relies on the mechanism the list states for that sub-processor: UK adequacy regulations (for example for the EEA), the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in the sub-processor's own data processing terms, or the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) where the sub-processor states it is certified under it.
• Where the list marks a transfer mechanism "to confirm", the provider has not published one we could check. We are obtaining it from the provider and will update the list when we have it. You can ask us which terms apply to a particular provider.
• Growth, Ads and Operate AI requests that write or check text or describe images are configured to exclude hosting providers based in China, and audio is transcribed by default with a model not hosted in China. We do not send your prompts or media to video models hosted in China: ByteDance's Seedance video models, which are served only in China, are switched off for customer content, and video clips are made with Google Veo or HeyGen instead. We will only switch Seedance back on once a UK transfer mechanism is in place, and only after adding it to the sub-processor list with notice under section 6.

8. Helping you meet your obligations

• Requests from individuals: we help you answer requests to access, correct, delete, restrict, move or object to the processing of Customer Personal Data. If a request reaches us directly, we pass it to you without undue delay and do not answer it ourselves unless you ask us to.
• Personal data breaches: we tell you without undue delay after becoming aware of a breach affecting Customer Personal Data, with the information we have, and we add to it as we learn more. We help you with any notification you have to make to a regulator or to the people affected.
• Impact assessments: we give you the information we reasonably can to help with a data protection impact assessment, and with any prior consultation with a regulator, about your use of the Service.

9. Deletion or return at the end

• When you ask us to delete your account, we delete Customer Personal Data from active databases within 30 days of your request, unless the law requires us to keep it. Backups and disaster recovery archives are overwritten and purged within 90 days.
• If you would like a copy first, ask us before you request deletion and we will provide the Customer Personal Data we hold in a common format.
• While your account is open, data is deleted at the end of the periods in the Privacy Policy, or sooner when you delete it or ask us to.

10. Information and audits

We will give you the information reasonably needed to show that we meet this DPA. If that is not enough, you (or an independent auditor you appoint who is bound by confidentiality) may audit our compliance with this DPA, on at least 30 days' written notice, once a year, unless a regulator requires it or after a personal data breach. We will first try to answer with written information. Each party pays its own costs.

11. Feature terms

Where a feature has its own processing terms, such as ad measurement on websites you build with PromptUI, those terms are shown when you turn the feature on and add to this DPA for that feature.

12. General

• The limits of liability in the Terms apply to this DPA, except where the law does not allow them to.
• We may update this DPA, for example when the law or the Service changes. We will tell account owners by email before a change that reduces your protection takes effect.
• This DPA is governed by the laws of England and Wales.
• Questions: hello@promptui.co.