Data Processing Agrement

1. Definitions

1.1. “Applicable Data Protection Laws” means all laws and regulations applicable to the processing of Personal Data under this DPA, including the Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (“GDPR”), and any other data protection or privacy laws of any jurisdiction applicable to the processing of Personal Data, in each case as amended, supplemented or replaced from time to time. 

1.2. “Agreement” means the Userlytics Terms of Service located at https://www.userlytics.com/user-experience-research/legal-resources/terms-of-service-clients/, as amended and modified from time to time, together with any applicable Order Form, or any other written or electronic agreement executed or entered into between Userlytics and Customer, that governs the provision of Services by Userlytics to Customer.

1.3. “Services” means the services to be provided by the Processor as defined under the Agreement, including as described in the DPA.

1.4. “Controller” means the Customer, the entity that determines the purposes and means of the processing. 

1.5. “Processor” means Userlytics, the entity that processes Personal Data on behalf of the Controller. 

1.6. “Personal Data” means any information relating to an identified or identifiable natural person.

1.7. “Sub-processor” means any entity engaged by the Processor to perform data processing activities necessary to deliver the Services to the Controller.

1.8. “Instructions” means the documented instructions issued by the Customer to Userlytics in relation to the processing of Personal Data including those set out in this DPA;

The terms “Controller,” “Processor,” “Personal Data” and “Sub-processor” are described above for convenience. To the extent any such term is defined under Applicable Data Protection Laws such term shall be interpreted in accordance with the meaning assigned to it under those laws.

2.  Term and Subject Matter of the DPA

2.1 By means of these clauses, the Processor is authorized to process, on behalf of the Controller, the Personal Data necessary as further detailed in Appendix 1 of this DPA. As such, the specific details of the processing activities, data categories, and subjects are set out in Appendix 1, which forms an integral part of this DPA.

2.2. This DPA shall take effect on the Effective Date and remain in force for the duration of the Agreement. It shall continue in effect after the Agreement expires or is terminated for as long as the Processor retains or processes any Personal Data on behalf of the Controller.

3.  Controller Obligations

3.1 In its use of the Services, the Controller shall: (i) process Personal Data in accordance with Applicable Data Protection Laws; (ii) ensure that its instructions to the Processor comply with Applicable Data Protection Laws and will not cause the Processor to breach them; and (iii) ensure that, to the extent required by Applicable Data Protection Laws, it has a valid lawful basis and has provided all necessary notices to, and obtained all necessary consents from, data subjects so that the Processor may process Personal Data and provide the Services. As between the parties, the Controller is solely responsible for the accuracy, quality and legality of the Personal Data, the means by which it obtained the Personal Data, and the instructions it gives to the Processor. 

4. Processor Obligations

4.1 Processor shall use Personal Data solely for the purposes set out in this DPA and in compliance with Applicable Data Protection Laws. The Processor shall not use any Personal Data for the training of any machine learning or artificial intelligence models, except where expressly authorized in writing by the Controller. 

4.2 The Processor shall process Personal Data strictly in accordance with the Controller’s documented instructions. The Processor shall inform the Controller if an instruction infringes the GDPR or other applicable data protection provisions.

4.3 In the case that the processing implies the transfer of Personal Data outside the European Economic Area (EEA), the United Kingdom or Switzerland, said operations will be carried out under the safeguard mechanisms provided in Chapter V of the GDPR. To this effect, the Processor declares to be certified under the EU-U.S. Data Privacy Framework (DPF), including its extension for the United Kingdom and the Switzerland-U.S. framework, strictly complying with its privacy principles. The status of said certification can be consulted in the official portal (https://www.dataprivacyframework.gov/). In the absence of this certification or in the event of any legal contingency of the cited framework, the Parties shall base the transfers on the Standard Contractual Clauses set out in Appendix 2.

4.4 The Processor shall implement the necessary technical and organizational measures to take reasonable steps to ensure a level of security adequate to the risk. Among them:

a) The pseudonymization and encryption of Personal Data.

b) The confidentiality, integrity, availability and resilience of the processing systems and services.

c) The capacity to restore the availability and the access to the Personal Data in a rapid way, in case of a physical or technical incident.

d) The process of regular verification, evaluation and assessment of the efficiency of the technical and organizational measures to maintain the security of the processing.

e) The appropriate training regarding data protection and processing of Personal Data of the authorized personnel.

The details of these security measures are available at the Userlytics Security Portal (https://security.userlytics.com/) 

4.5 The Processor will take reasonable steps to ensure that its personnel authorized to process Personal Data is contractually or statutorily committed to respect confidentiality and to comply with appropriate security measures.

4.6 The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures for the fulfillment of the Controller’s obligation to respond to requests for exercising data subjects’ rights. 

4.7. Three hundred and sixty-five (365) days after termination of the Services, or upon the Controller’s written request, the Processor shall, at the choice of the Controller, delete or return all Personal Data and delete existing copies. Notwithstanding anything to the contrary in this Section, Processor shall be permitted to retain Personal Data solely insofar as such retention is mandated by applicable law; provided, however, that Processor shall (i) maintain any such retained data in a secure and segregated manner, and (ii) refrain from any further processing thereof save as may be compelled by applicable law. The Processor’s responsibility is limited to the data within its systems; it shall not be liable for any copies or exports of data held under the Controller’s own custody or control.

4.8 The Processor will notify the Controller, without undue delay and in a maximum period of 72 hours, any infringement of the security of the data under its charge, including all the information reasonably necessary to document the incidence (nature, affected parties, possible consequences and corrective measures). Where such information is not available at the time of notification, the Processor may provide it in phases without further undue delay.

4.9 The Controller grants a general authorisation to the Processor to subcontract the processing activities necessary for the execution of the DPA. The list of Sub-processors authorised as of the Effective Date is available at the Userlytics Security Portal (https://security.userlytics.com/). The Processor shall ensure that any Sub-processor is bound by contractual or statutory commitments to data protection obligations, instructions and security measures no less protective than those set out in this DPA, including, where applicable, appropriate safeguards for international data transfers. The Processor shall remain liable to the Controller for any failure by its Sub-processors to fulfil their data protection obligations under this DPA to the same extent as the Processor would be liable had it performed those obligations itself, subject to the limitations and exclusions of liability set out in the Agreement.

4.10 The Processor shall maintain a current list of its Sub-Processors at Userlytics Security Portal, and shall update that list fifteen (15) days before engaging any new Sub-Processor. Processor shall provide Controller with a mechanism to receive notice of such update. If the Controller reasonably objects to a proposed Sub-processor within fifteen (15) days of such notice, the Parties shall work together in good faith to address the Controller’s concerns. If the Parties are unable to reach a resolution within fifteen (15) days of the objection, the Controller may terminate the affected Services upon thirty (30) days’ written notice. If the Controller does not object within the fifteen (15) day period, the proposed Sub-processor shall be deemed approved.

4.11 The Processor shall make available to the Controller the information necessary to demonstrate the Processor’s compliance with its obligations under this DPA. The Controller agrees that the Processor may meet this obligation, in the first instance, by providing copies or summaries of its current third-party certifications, audit reports or security documentation. Where the information provided is reasonably insufficient to demonstrate such compliance, the Processor shall allow audits, including inspections, by the Controller or an independent external auditor it appoints, subject to the following conditions:  (i) no more than once per calendar year, (ii) the Controller shall give written notice at least thirty (30) days in advance, and the parties shall agree on the audit’s scope, timing and duration beforehand, (iii) audits shall take place during business hours and without interfering in the normal operations of the Processor, (iv) any external auditor shall be bound by written confidentiality obligations acceptable to the Processor and shall not be a competitor of the Processor, (v) the cost of said audit will be assumed by the Controller, and (vi) the Controller shall treat all information obtained during the audit, including its results, as the Processor’s Confidential Information. The Processor will provide reasonable assistance to the Controller in the performance of impact assessments and prior consultations with the control authorities, taking into account the nature of the processing and the information at the disposal of the Processor, where required under Applicable Data Protection Laws. Audits shall be limited to the Processor’s Processing of the Controller’s Personal Data under this DPA. The Controller and its auditor shall not have access to: (i) data, systems or information relating to the Processor’s other clients; (ii) data or information not relevant to the Processing of the Controller’s Personal Data; (iii) the Processor’s trade secrets, proprietary information or legally privileged material; or (iv) information whose disclosure would compromise the security of the Processor’s systems or facilities or breach the Processor’s confidentiality obligations to third parties.

5. Exclusions and Limitations of Liability

5.1 THE PROCESSOR SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL LOSS OR DAMAGE, INCLUDING LOSS OF PROFITS, REVENUE, BUSINESS, DATA OR GOODWILL, OR FOR ANY LOSS ARISING FROM THE CONTROLLER’S INSTRUCTIONS, THE CONTROLLER’S BREACH OF THIS DPA OR APPLICABLE DATA PROTECTION LAWS, OR PERSONAL DATA HELD UNDER THE CONTROLLER’S OWN CUSTODY OR CONTROL. 

5.2. To the maximum extent permitted by applicable law, the Processor’s total aggregate liability arising out of or in connection with this DPA, whether in contract, tort (including negligence) or otherwise,  shall not exceed the fees paid or payable by the Controller to the Processor during the twelve (12) months preceding the event giving rise to the first claim. This limit forms part of, and is not in addition to, any liability cap in the Agreement.

6. General Provisions

6.1 Processing Authorization. Subject to the terms of this Agreement, Customer authorizes 6.1 If there is any conflict or inconsistency between this DPA and the Agreement, this DPA shall prevail with respect to the processing of Personal Data. If there is any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

6.2. This DPA shall be governed by and construed in accordance with the laws governing the Agreement, and any dispute arising out of or in connection with it shall be subject to the jurisdiction set out in the Agreement, except where Applicable Data Protection Laws or the Standard Contractual Clauses require otherwise.

6.3. If any provision of this DPA is held invalid or unenforceable, the remaining provisions shall remain in full force and effect, and the invalid provision shall be replaced by a valid one that most closely reflects the parties’ original intent.

6.4. This DPA, together with the Agreement, constitutes the entire agreement between the parties regarding its subject matter and supersedes any prior agreements on the same subject. No amendment shall be effective unless made in writing and signed by both parties.

6.5. No failure or delay by either party in exercising any right under this DPA shall operate as a waiver of that right.

6.6. Except as expressly provided in the Standard Contractual Clauses or required by Applicable Data Protection Laws, nothing in this DPA confers any rights on any third party.

6.7. This DPA may be executed in any number of counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. The parties agree that this DPA may be executed and delivered by electronic signature, electronic acceptance or any other electronic means, including through an e-signature platform or by exchange of signed copies in PDF or similar format, and that such execution shall be legally valid, binding and enforceable to the same extent as a handwritten signature. Each party waives any objection to the validity or enforceability of this DPA on the ground that it was executed or delivered electronically, to the extent permitted by applicable law.

Apendix 1

APPENDIX 1

 PROCESSING ACTIVITIES

Data Controller

Customer, as identified in its account or in the applicable Order Form

Contact details:

As last recorded by Userlytics for the Customer’s account.

Data Processor

Userlytics Corporation

Contact details: privacy@userlytics.com

Subject, scope and nature of processing

Userlytics will process Personal Data to the extent necessary to provide the Services, i.e. User Experience Testing and related support.

Duration of processing

Personal Data will be held for the period of time necessary to complete the study and/or service for the Customer. Unless requested earlier by the Customer, Personal Data will remain available in the Customer’s account for up to three-hundred and sixty-five (365) days after Customer’s subscription termination date. Please note, it may take an additional 45 days, following the 365 period, to delete back-up drives.

Categories of Personal Data and data subjects

The Processor processes Personal Data relating to Research Participants and Controller Personnel. This could include participant demographics collected during the studies (e.g., age, gender), technical data generated during the sessions (e.g., device type, operating system) and content captured during the user testing and research services, such as audio and video recordings of the participant’s face and voice, screen captures, responses to study tasks and questions, resulting text-based transcriptions and sentiment analysis. For Controller Personnel, data includes session data if they moderate the testing. 

Special categories of Personal Data

The processing might include special categories of data (such as health, religion, or political opinions) voluntarily disclosed by participants during a session or requested by the Controller for personalized testing requirements. This data is captured solely to complete the test service, which includes the execution of UX research activities, capturing of interactions, operation of testing tools and generation of transcriptions. The Controller is strictly responsible for obtaining all required explicit consents for the collection of sensitive data. The Processor shall have no liability to the Controller, and the Controller hereby waives and releases the Processor from any and all claims, damages, losses, judgments, settlements, fines, penalties, costs and expenses (including reasonable legal fees), to the extent arising out of or relating to the Controller’s collection, use, transfer or other Processing of special categories of Personal Data.

Apendix 2

STANDARD CONTRACTUAL CLAUSES

1. Incorporation. “SCCs” means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj), as amended or replaced from time to time. The SCCs are incorporated into this DPA by reference (a) where required under Clause 4.3, and (b) for the transfers described in Clause 2 of this Appendix under Modules One and Four. The Customer’s acceptance of the Agreement constitutes its signature of the SCCs.

2. Modules. The following Modules apply:

(a) Module One (controller to controller), to transfers from Userlytics, as data exporter, to the Customer, as data importer, located in a third country without an adequate level of protection, of participant profile information made available to the Customer for a study.

(b) Module Two (controller to processor), to transfers from the Customer to the Processor.

(c) Module Four (processor to controller), to transfers from the Processor to the Customer located in a third country without an adequate level of protection.

3. Options.

(a) Clause 7 does not apply.

(b) The option in Clause 11(a) does not apply.

(c) For Module Two, Option 2 of Clause 9(a) applies, with the notice period and mechanism set out in Clause 4.810 of this DPA, and Option 1 of Clause 17 applies.

(d) For all Modules, the SCCs are governed by the laws of Spain (Clause 17) and disputes are resolved by the courts of Madrid, Spain (Clause 18).

4. Annexes.

(a) Annex I is completed with Appendix 1 and, for Module One, with Clause 2(a) of this Appendix. The competent supervisory authority is determined in accordance with Clause 13.

(b) Annex II is completed with Clause 4.4 of this DPA and the Userlytics Security Portal (https://security.userlytics.com/). For Module One, Annex II comprises the technical and organisational measures that the Customer implements in accordance with Applicable Data Protection Laws.

(c) Annex III does not apply. The agreed list of Sub-processors for the purposes of Clause 9(a) is the list referred to in Clause 4.10 of this DPA.

5. Precedence. To the extent permitted by the SCCs, the SCCs are exercised in accordance with this DPA, including Clauses 4.8 (breach notification), 4.11 (audits) and Section 5 (liability). In the event of conflict, the SCCs prevail.

6. United Kingdom. For transfers of Personal Data subject to the UK GDPR, as defined in section 3(10) of the Data Protection Act 2018, the SCCs apply as amended by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018 (the “UK Addendum”). The UK Addendum is completed as follows:

(a) Table 1: the Parties’ details and key contacts are those set out in Appendix 1.

(b) Table 2: the Approved EU SCCs are the SCCs, including the Modules and options selected in this Appendix.

(c) Table 3: the Appendix Information is set out in Appendix 1, Clause 2(a) of this Appendix, Clause 4.4 and the list referred to in Clause 4.10.

(d) Table 4: neither Party may end the UK Addendum under its Section 19.

The Customer’s acceptance of the Agreement constitutes its signature of the UK Addendum.

7. Switzerland. For transfers of Personal Data subject to the Swiss Federal Act on Data Protection (FADP), the SCCs apply with the following adaptations:

(a) references to the GDPR are read as references to the FADP,

(b) the competent supervisory authority is the Federal Data Protection and Information Commissioner, and

(c) the term “member state” shall not be interpreted so as to prevent data subjects in Switzerland from bringing claims in their place of habitual residence.