Data Processing Agreement

1. Scope and parties

This Data Processing Agreement ("DPA") forms part of the Terms of Service between TestSapien LLC ("TestSapien") and the customer using the Service ("Customer"). It applies when TestSapien processes Customer Personal Data: personal data in Customer Data, including Evidence and data read from Connected Services. Terms not defined here have the meaning given in the Terms. If this DPA conflicts with the Terms, this DPA wins for personal data.

No signature is needed; the DPA applies automatically. If you need a countersigned copy, email hello@testsapien.com.

2. Roles

Customer is the controller of Customer Personal Data, or a processor acting for its own clients. TestSapien is Customer's processor (or subprocessor). Customer is responsible for having a lawful basis and any notices and consents needed for the processing. Customer should use test accounts and test data in its tests wherever it can, so that Evidence holds as little real personal data as possible.

3. Processing on instructions

TestSapien processes Customer Personal Data only to provide the Service and on Customer's documented instructions. The Terms, this DPA and Customer's use of the Service, including the runs its Authorized Users start or schedule, are those instructions. TestSapien will tell Customer if it believes an instruction breaks data protection law, and is not required to follow it.

TestSapien does not sell Customer Personal Data, share it for cross-context behavioral advertising, use it to train AI models, or combine it with other data except as needed to provide the Service. TestSapien acts as a "service provider" under the California Consumer Privacy Act: it will not retain, use or disclose Customer Personal Data outside its direct business relationship with Customer, certifies that it understands these restrictions, and will tell Customer if it can no longer meet them.

4. Details of the processing

• Subject matter and duration: providing the Service for the term of the Terms, plus the deletion period in section 12.
• Nature and purpose: storing test cases and results; checking out repositories and running tests against Target Environments; recording and storing Evidence; exchanging results and issues with Connected Services; keeping audit records.
• Data subjects: people whose data appears in test cases, repositories, Connected Services, Target Environments or Evidence, such as Customer's staff, its test account holders, and users of the applications it tests. Personal data about Customer's own Authorized Users (their TestSapien accounts and activity) is processed by TestSapien as a controller under its Privacy Policy, not under this DPA.
• Categories of data: names, usernames and email addresses; commit author details; issue and comment content; any personal data shown on screen, sent over the network or written to logs while a test runs, as captured in screenshots, videos, traces and logs.
• Special categories: none intended. Customer should not run tests that display or transmit special category data.
• Frequency: whenever tests run or Connected Services are synchronized.

5. Confidentiality of personnel

TestSapien ensures that anyone authorized to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed to provide or support the Service.

6. Security measures

TestSapien maintains the technical and organizational measures in Annex A (section 15) and may update them, provided the overall level of protection does not decrease.

7. Subprocessors

Customer authorizes TestSapien to use the subprocessors listed on our Subprocessors page. TestSapien imposes data protection terms on each subprocessor that protect Customer Personal Data at least as well as this DPA, and remains responsible for their performance.

TestSapien will give at least 30 days' notice before adding or replacing a subprocessor, by updating that page and emailing customers who have asked to be notified. Customer may object on reasonable data protection grounds within that period. The parties will try in good faith to resolve the objection; if they cannot, Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the period after termination.

8. Data subject requests and assistance

TestSapien will promptly forward to Customer any request from a data subject about Customer Personal Data and will not answer it except on Customer's instructions. Taking into account the nature of the processing, TestSapien will help Customer respond to such requests and with data protection impact assessments and consultations with regulators, to the extent Customer cannot do so itself using the Service.

9. Personal data breaches

TestSapien will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the breach, the data and data subjects likely affected, the likely consequences, and the measures taken or proposed, with further information as it becomes available. TestSapien will take reasonable steps to contain and remedy the breach. Notice is not an admission of fault.

10. International transfers

TestSapien processes Customer Personal Data in the United States, and in any other runner location Customer chooses. Where Customer Personal Data originating in the European Economic Area is transferred to TestSapien, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"), which are incorporated by reference: Module Two where Customer is a controller and Module Three where Customer is a processor, with TestSapien as data importer. For the SCCs: clause 7 (docking) applies; clause 9 option 2 (general authorization, 30 days' notice) applies; the optional clause 11 language does not apply; clauses 17 and 18 select the law and courts of Ireland; for clause 13 and Annex I.C, the competent supervisory authority is that of the EU member state where Customer is established or, if Customer is not established in the EU, where its Article 27 representative is established, and otherwise the Irish Data Protection Commission; Annex I.A lists Customer as data exporter and TestSapien as data importer, with the contact details in their account and on this page, and acceptance of the Terms counts as signature; Annex I.B is section 4 of this DPA; Annex II is Annex A; Annex III is the Subprocessors page.

For transfers from the United Kingdom, the UK International Data Transfer Addendum to the SCCs applies. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection.

11. Requests from authorities

If a public authority asks TestSapien for Customer Personal Data, TestSapien will refer it to Customer where possible, notify Customer before disclosing anything unless the law forbids it, disclose only the minimum required, and challenge requests it reasonably considers unlawful.

12. Retention, return and deletion

Evidence is deleted automatically at the end of the retention period Customer's plan includes. During the subscription, Customer can export its test cases and results at any time; its test code already lives in its own repositories. After the Terms end, Customer has 30 days to export; TestSapien then deletes Customer Personal Data within a further 30 days, and it expires from backups within a further 35 days, unless the law requires it to keep the data.

13. Audits

On written request, TestSapien will provide information reasonably necessary to show compliance with this DPA, such as answers to security questionnaires and, when available, third-party audit reports. If that is not enough, or a regulator requires it, Customer may audit TestSapien once a year, with 30 days' notice, during business hours, at Customer's cost, under confidentiality, and without access to other customers' data.

14. Liability

Each party's liability under this DPA is subject to the limitations in the Terms, except where data protection law or the SCCs do not allow them.

15. Annex A: technical and organizational measures

• Encryption: TLS for data in transit; encryption at rest for databases, storage and backups.
• Isolation: every query limited to the Customer's workspace in the application, and Postgres row-level security refusing other workspaces' rows at the database.
• Secrets: credentials for repositories and Connected Services held in a managed secrets vault, read only when used, never returned by the API and never stored in source code.
• Access control: four workspace roles (owner, lead, tester, viewer); only owners and leads can run tests against environments marked protected; staff access limited to what is needed.
• Authentication: sign-in through our identity provider, with multi-factor authentication available to every user.
• Logging and monitoring: workspace audit log of changes to people, roles, settings and billing; security logging of the platform.
• Retention: Evidence deleted automatically at the end of the plan's retention period.
• Resilience: managed cloud infrastructure with automated daily database backups.
• Vendor management: data protection terms with every subprocessor.