Personal Data Processing Agreement

1. Parties and subject matter

On one side, the Client, a natural or legal person holding the UXTap account, as Controller. On the other side, Qualitap Soluções e Serviços Ltda. (QualiTAP), CNPJ 59.701.681/0001-68, headquartered in Osasco/SP, operator of the UXTap platform, as Operator.

1. 1.1This attachment is an integral part of the Terms of Use and governs the processing of personal data of participants in studies created by the Client.
2. 1.2In case of conflict between this attachment and the Terms of Use regarding data protection, this attachment shall prevail.
3. 1.3Regarding the Client's registration and account usage data, QualiTAP acts as Controller, as per the Privacy Policy, and this attachment does not apply.

2. Description of processing

1. 2.1Purpose: collection and processing of participant responses and behavior in usability and research studies configured by the Client.
2. 2.2Nature and purpose: to host the study, collect responses, record interactions, record session when the Client enables and the participant consents, generate analyses, reports, and transcripts for the Client.
3. 2.3Duration: for the duration of the contract, subject to the retention periods of clause 10.
4. 2.4Categories of data subjects: study participants, invited by the Customer via open link or recruitment panel; people who sign up through the interview scheduler; visitors to the Controller’s websites where it installs the UXTap tag or collector; and observers invited by the Controller to moderated sessions.
5. 2.5Categories of data: responses, including free text; click coordinates, screens visited, scrolling and timings; technical device, browser and language data; opaque identifier and panel variables; participation status reported to the panel; screen recording; camera image; voice audio; live-website screenshots; name, email, time zone and screening answers in scheduled interviews; audio, video and shared screen in moderated interviews; and, on the Controller’s websites, pseudonymous visitor identifier, source page, approximate country, pages, clicks and scrolling.
6. 2.6The platform does not ask participants for ID documents, passwords or financial data. Name and email are requested only when scheduling moderated interviews. If the Customer sets up questions that capture sensitive data, that decision and its legal basis are solely the Customer’s.

3. Roles and responsibilities

1. 3.1The Controller defines essential purposes and means, chooses the legal basis, informs the participant, obtains consent when necessary, and responds to data subjects' requests.
2. 3.2The Processor processes data only according to the Controller's documented instructions, represented by the configurations made on the platform and by this addendum.
3. 3.3The Processor will inform the Controller if, in its assessment, an instruction violates data protection legislation, and may suspend execution until clarification.
4. 3.4The Processor does not use participant data for its own purposes, does not sell it, does not use it to train its own models and does not authorize its subprocessors to use it to train models.

4. Documented instructions

1. 4.1The Controller’s instructions are: the study configuration, the choice of blocks and questions, whether recording, camera and audio are enabled, the language, the plan’s retention period, the recruitment panel configuration and the deletion actions taken in the dashboard.
2. 4.2The Controller’s instructions also include: publishing public links to reports, clips and compilations; installing the tag or collector on its websites; purchasing recruitment, which involves sending each participation’s status to the partner panel; and connecting external tools via API or MCP, whose access is at the Controller’s own risk.
3. 4.3Additional instructions must be sent in writing to contato@paineltap.com.br and may require scope or price adjustments if they require development.

5. Confidentiality and authorized personnel

1. 5.1Access to data is restricted to personnel who need it to operate and provide support, subject to a duty of confidentiality.
2. 5.2Administrative access is limited to email addresses authorized by configuration, and every administrative action is recorded in an audit trail with author, action, target, and date.

6. Sub-processors

1. 6.1The Controller generally authorizes the engagement of the sub-processors listed and kept updated at uxtap.app/subprocessadores, with purpose, data processed, and hosting country.
2. 6.2Artificial intelligence providers appear on that page grouped by function and country. The complete list of names, including those providers, is provided to the Controller on request, under confidentiality.
3. 6.3The addition of a new subprocessor that processes participant data, or a change in the country of processing, is communicated by email to the account holder and published at uxtap.app/subprocessadores 30 days in advance.
4. 6.4The Controller may object with justification. If there is no reasonable technical alternative, they may terminate the contract without penalty for the unused period.
5. 6.5The Processor is liable to the Controller for the acts of its sub-processors with regard to this addendum.

7. Technical and organizational measures

The measures below are implemented as of the date of this version.

1. 7.1Encryption in transit via HTTPS throughout the application, with HSTS and security headers (nosniff, referrer-policy).
2. 7.2Password authentication with storage of only bcrypt cryptographic hash, and session signed with server secret.
3. 7.3Role-based authorization, verified on the server with each request, with association read directly from the database.
4. 7.4Recordings and audios in a private bucket, without a public URL, with access only via a short-lived, 1-hour signed link.
5. 7.5Third-party integration tokens encrypted with AES-256-GCM at rest.
6. 7.6Isolation by workspace in all read and write queries for study data.
7. 7.7Limitation of requests per address and per session on public routes, and daily consumption caps per account, to contain abuse and cost.
8. 7.8Collection event logging with deduplication, preventing duplicate responses due to resubmission.
9. 7.9Error monitoring with prior sanitization, without request body or response content.
10. 7.10Backups managed by the database provider, encrypted at rest, deleted within 30 days.
11. 7.11Automatic purge routine for expired recordings according to the plan's term.

The Processor maintains a program for the evolution of these measures. Items not yet implemented, such as second factor authentication and external certification, are not subject to contractual commitment in this version.

8. Support to the Controller

1. 8.1The Processor provides resources in the product for the Controller to assist data subjects: response export, session deletion with its media, recording deletion, and study deletion.
2. 8.2Upon receiving a data subject's request directly, the Processor does not respond to the merits and forwards it to the Controller within 3 business days, unless it can address it itself, in which case it informs the Controller.
3. 8.3The Processor supports the Controller in preparing an impact assessment report and in responding to authorities, with regard to information under its domain.

9. Security incidents

1. 9.1The Processor communicates to the Controller without undue delay, and within a maximum of 48 hours of becoming aware, of an incident that may entail significant risk or damage to the data under its responsibility.
2. 9.2The communication indicates the nature of the incident, the affected data and data subjects, the measures adopted, the risks involved, and the contact for clarification.
3. 9.3Communication to the ANPD and to data subjects, when applicable, is the Controller's obligation, observing the deadlines of Resolution CD/ANPD nº 15/2024, with the Processor's support.
4. 9.4The Processor keeps a record of incidents and the measures taken for at least 5 years, with the information required by ANPD regulations.

10. Retention, return, and deletion

1. 10.1Recordings and audios are automatically deleted at the end of the contracted plan's retention period.
2. 10.2Other participant data remains as long as the study exists in the account or until deletion commanded by the Controller.
3. 10.3Upon termination of the contract, the Controller has 30 days to export the data. After this period, the Processor deletes participant data within 60 days, unless there is a legal obligation to retain it.
4. 10.4Deletion covers database records and the corresponding files in object storage. Backups are deleted within 30 days.
5. 10.5Upon request, the Processor issues a declaration of deletion.

11. International transfer

1. 11.1Part of the processing takes place outside Brazil, in the United States and the European Union, as shown on the subprocessors page. The application servers and the database are located in the United States.
2. 11.2Transfers are carried out under article 33 of the Brazilian General Data Protection Law, subject to the contractual data protection safeguards offered by each subprocessor. The Processor will adopt the standard contractual clauses approved by CD/ANPD Resolution No. 19/2024 within the regulatory deadline.
3. 11.3Once adopted, the ANPD standard clauses prevail over any conflicting provisions of this annex.

12. Audit

1. 12.1The Processor provides, upon written request and once a year, reasonable information to demonstrate compliance with this addendum, including a description of technical measures and a response to a security questionnaire.
2. 12.2On-site audit or by an independent third party may be agreed upon in a specific contract, with 30 days' notice, during business hours, without interruption of operation and subject to confidentiality, with costs borne by the Controller.

13. Term and final provisions

1. 13.1This addendum remains in force for as long as the Processor processes participant data on behalf of the Controller.
2. 13.2The obligations of confidentiality, deletion, and cooperation survive termination.
3. 13.3Relevant changes will be published on this page 30 days in advance, applying the rule of justified objection from clause 6.

14. Liability, governing law and venue

1. 14.1Each party is liable for the damage it causes by breaching the Brazilian General Data Protection Law or this annex, with the right of recourse ensured, under article 42, §4, of that law.
2. 14.2Brazilian law and the venue set out in the Terms of Use apply.