> **Template — have your legal adviser review before use.**
> This is a starting point written by the STX Device Lab software, not legal advice. It makes no claim of certification, audit or compliance. Fill in every [bracketed] field, remove what does not apply, and have it checked against your own contracts and practices.

# Data protection statement: [Lab operator name] device lab (STX Device Lab)

Prepared on 2026-10-22 from the lab's settings on that day. Figures in this statement come from the running system; if an administrator changes them, produce this statement again.

## 1. Who is responsible

- **Responsible party / data controller for the lab service:** [Lab operator legal name], [registration number], [address].
- **Information officer (POPIA s55) / data protection officer (NDPA s32):** [name], [email], [phone].
- **Customers** who test their own apps on the lab's phones remain the responsible party / controller for any personal information their apps send or show during a session. For that information the lab operator acts as an operator (POPIA) / data processor (NDPA), under the data processing agreement between the parties.

## 2. Where the information is

- **Stored in Johannesburg, South Africa:** the phones, the portal and everything a session produces are on one machine there (node JNB-01), and nowhere else.
- **In transit:** visitors reach the lab over TLS through Cloudflare's edge network. Cloudflare terminates TLS at its nearest point of presence and encrypts again to the lab. That point of presence may be outside South Africa, so personal information in a session (video, typing, files) can pass through, and be decrypted at, a location outside the country while in transit. Name Cloudflare as an operator / processor in your records.
- **Private network tunnels** end at the lab in Johannesburg. The customer's connector reaches the lab through the same edge network, so tunnel traffic is in transit through Cloudflare as above.
- [List any backup location, or state that there is none.]

## 3. What is processed, and why

| Information | Why | Kept for |
|---|---|---|
| Account details: username, display name, email, role, team, a password hash | To let people sign in and control what they can use | Until the account is deleted |
| Sign-in sessions (a hashed token) | To keep people signed in | 8 hours |
| Audit events: who took which phone and when, what they did (taps, typing length, settings changed, installs, defects) | Security, fair use and the lab's reports | 730 days |
| Screen recordings, phone logs, network captures, screenshots, defects, language-run screenshots | The customer's testing | 90 days |
| Recorded flows (steps, including any text typed while recording) | Replaying a test in other languages | 90 days, or sooner if deleted by their owner or with their owner's account |
| Journey names and their data totals | Comparing the data cost of a task over time | 730 days |

Network captures can contain whatever the app under test sends, including personal information and credentials. HTTPS is only decrypted when the tester turns it on for a phone.

## 4. Sharing

- Nothing is sent to an analytics or advertising service.
- A tester can make a read-only share link to one defect. Links last 7 days by default and at most 30 days, leave out log lines, requests and notes unless the tester ticks them in, are not indexed by search engines, and can be turned off at any time. Only a hash of the link is stored.
- [List any other recipients: support contractors, hosting providers.]

## 5. Cross-border transfers

[State whether any personal information leaves South Africa or Nigeria, to whom, and on what basis (POPIA s72; NDPA Part VIII). Traffic in transit passes Cloudflare's edge, which may be outside South Africa (see section 2): cover it here.]

## 6. Security measures

- Accounts have roles (viewer, tester, admin); phones can be limited to teams.
- Every phone setting a tester changes is put back when the session ends, after a crash, and before the next person takes the phone. A network proxy left on a phone is cleared the same way.
- Apps not on the approved list are removed after each session when washing up is switched on.
- Share-link and tunnel tokens are stored as hashes only; passwords are stored as salted hashes.
- [Describe physical security, backups, patching, access to the machine, and incident response.]

## 7. Rights of data subjects

People can ask for access to, correction of, or deletion of their personal information, and can object to processing, by contacting [contact]. Complaints can go to the Information Regulator (South Africa) or the Nigeria Data Protection Commission.

## 8. Breach notification

[Describe how and when the operator notifies customers, the Information Regulator (POPIA s22) and the NDPC (NDPA s40, 72 hours).]