Effective Date: November 6, 2025

This Data Processing Agreement ("DPA") supplements the Client Terms of Service and governs how UserTest Pro ("Processor") processes personal data on behalf of the Client ("Controller") under the Digital Personal Data Protection Act, 2023 (DPDPA).

1. INTRODUCTION

Purpose: This DPA clarifies our respective responsibilities for personal data processing and ensures compliance with DPDPA.

Applicability: This DPA applies to all Clients using the Platform to collect and process personal data from research participants.

Incorporation: The DPA is mandatory and incorporated into the Client Terms by reference. In case of conflict, the DPA prevails.

2. DEFINITIONS

Personal Data: Any information relating to an identifiable natural person (name, email, video recording, IP address, responses, device information)

Processing: Any operation on personal data (collection, recording, storage, retrieval, transmission, deletion)

Data Subject: The individual to whom personal data relates (your research participants)

Controller: The entity determining purposes and means of processing (YOU)

Processor: The entity processing data on behalf of the Controller (UserTest Pro)

Sub-processor: A processor engaged by the primary processor (AWS, Postmark)

Data Breach: Unauthorized or accidental destruction, loss, or processing of personal data

3. YOUR ROLE AS CONTROLLER

You Are Responsible For:

Lawful Processing: