> **Template — have your legal adviser review before use.**
> This is a starting point written by the STX Device Lab software, not legal advice. It makes no claim of certification, audit or compliance. Fill in every [bracketed] field and have both parties' advisers review it.

# Data Processing Agreement

Between **[Customer legal name]** ("the Customer", responsible party / controller) and **[Lab operator legal name]** ("the Operator", operator / processor), for the Customer's use of the Operator's device lab at [portal address].

Prepared on 2026-10-22. Retention figures below come from the lab's settings on that day.

## 1. Subject matter

The Operator provides Android phones in Johannesburg, South Africa, that the Customer's testers control remotely to test the Customer's apps. Personal information is processed only to provide that service.

## 2. Categories of information and people

- The Customer's testers: names, usernames, email addresses, what they do in the lab.
- Whatever the Customer's apps display, send or receive during testing, which may include personal information of the Customer's own users or test accounts. The Customer should use test data wherever possible.

## 3. The Operator's obligations

1. Process personal information only on the Customer's documented instructions, which include using the lab as designed.
2. Store the phones, the portal and all session data in Johannesburg, South Africa, unless the Customer agrees otherwise in writing. In transit, traffic reaches the lab through Cloudflare's edge network, which terminates TLS at its nearest point of presence; that point may be outside South Africa. Cloudflare is a sub-processor for traffic in transit.
3. Ensure people with access are bound by confidentiality.
4. Apply the security measures in Schedule 1.
5. Not engage another operator / sub-processor without the Customer's prior written consent. Current sub-processors: Cloudflare (TLS edge, traffic in transit only) [and any others].
6. Help the Customer respond to requests from data subjects and regulators.
7. Notify the Customer without undue delay, and within [48] hours, after becoming aware of a security compromise affecting the Customer's information.
8. Delete session data on the schedule in clause 4, or earlier on the Customer's written request, and confirm deletion in writing.
9. Make available the information needed to show compliance with this agreement.

## 4. Retention

| Information | Kept for |
|---|---|
| Recordings, phone logs, network captures, screenshots, defects, language-run screenshots | 90 days, then deleted automatically |
| Audit events (who used which phone, when, and what they did) | 730 days |
| Recorded flows, including text typed while recording | 90 days, or sooner if deleted by their owner or with their owner's account |
| Share links to a defect | 7 days by default, at most 30 days |

## 5. The Customer's obligations

1. Have a lawful basis for any personal information its apps bring into the lab.
2. Use test accounts and test data where it can, and not type real passwords into recorded flows.
3. Decide whether to decrypt HTTPS traffic in the network inspector, knowing that decrypted captures can hold credentials and personal information.

## 6. Cross-border transfers

[State the basis under POPIA s72 and NDPA Part VIII for traffic in transit through Cloudflare's edge outside South Africa, and any other transfer.]

## 7. Term and termination

This agreement lasts as long as the Customer uses the lab. On termination the Operator deletes the Customer's session data within [30] days, except where law requires it to keep it.

## 8. Governing law

[South African / Nigerian] law. [Jurisdiction.]

## Schedule 1: security measures

- Role-based accounts (viewer, tester, admin) and team-limited phones.
- Passwords stored as hashes; share-link and tunnel tokens stored as hashes only.
- Every phone setting changed during a session is put back when the session ends, after a crash, and before the next session. Network proxies are cleared the same way.
- Apps not on the approved list are removed after each session when washing up is on.
- Private network tunnels are deny-by-default, checked on both sides, scoped to a team and expire within 30 days.
- [Physical security of the machine, backups, patching, logging and incident response.]

Signed for the Customer: ______________________ Date: __________

Signed for the Operator: ______________________ Date: __________