Data Processing Agreement

"Personal Data", "Data Subject", "Processing", "Controller", "Processor", "Supervisory Authority" and "Personal Data Breach" have the meanings given in Article 4 GDPR.

"Customer Personal Data" means Personal Data that you, or Data Subjects acting through the Service at your invitation, submit to the Service and that Test Utopia processes on your behalf. It is described in Annex 1.

"Candidate" means a natural person you invite to an assessment, interview, stream, training or AI assessment through the Service.

"Sub-processor" means a third party engaged by Test Utopia to process Customer Personal Data.

"Service" means the Test Utopia platform as described in the Agreement.

2.1 For Customer Personal Data (Annex 1, Part A) you are the Controller and Test Utopia is the Processor. You decide whom to assess, which questions to ask, which proctoring features to enable, how long candidate data is retained, and what to do with the results.

2.2 For Account Data — the Personal Data of your users (names, emails, roles, authentication and session data, audit logs) and your billing and invoicing data — Test Utopia is an independent Controller. That processing is described in the Privacy Policy and is not governed by this DPA, except that §8 (breach notification) and §5 (security) apply to it as well.

2.3 Where you connect the Service to a third-party system you control (an ATS such as Greenhouse, a webhook endpoint, your SSO identity provider or SCIM directory), data exchanged with that system is processed on your documented instruction, and that system is your own Processor, not Test Utopia's Sub-processor.

3.1 Test Utopia processes Customer Personal Data only on your documented instructions, which are: (a) this DPA; (b) the Agreement; (c) your configuration of the Service through its settings and its API; and (d) any further written instruction you give that is consistent with the Agreement. Test Utopia will inform you if, in its opinion, an instruction infringes the GDPR or other EU or Member State data-protection law.

3.2 You are responsible for the lawfulness of the processing you instruct — in particular for having a lawful basis to assess and, where enabled, to proctor Candidates, for giving Candidates the information required by Articles 13 and 14 GDPR, and for honouring Candidates' rights. The Service shows every Candidate a notice before the assessment begins (the Candidate Privacy Notice) that names you as the Controller and lists the monitoring features you have enabled; you must not instruct Test Utopia to remove or falsify it.

3.3 Automated decisions. The Service produces scores, integrity indicators and AI-generated evaluations. These are decision support. Test Utopia makes no decision about any Candidate and communicates no outcome to any Candidate. You undertake not to base a decision producing legal or similarly significant effects on a Candidate solely on an output of the Service without meaningful human review, unless Article 22(2) GDPR permits it and you have put the safeguards of Article 22(3) in place. Where the Service sends a score to a third-party system under §2.3, it sends the measurement and your own configured threshold, never a derived verdict; what that system does with it is your responsibility as Controller.

5.1 Test Utopia implements and maintains the technical and organisational measures in Annex 3, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. The measures are published and kept current on the Trust Center; Test Utopia may update them, but not in a way that reduces the overall level of protection during the term.

5.2 You are responsible for the security of your own accounts: choosing and protecting credentials, enabling two-factor authentication or SSO, assigning roles with least privilege, and keeping the list of your users current (including through SCIM where available).

6.1 You give general authorisation to Test Utopia's engagement of the Sub-processors listed in Annex 2 (published and kept current at testutopia.com/trust). Test Utopia has a written agreement with each Sub-processor imposing data-protection obligations no less protective than those in this DPA, and remains fully liable to you for the Sub-processor's performance.

6.2 Changes. Test Utopia will give you at least 30 days' notice by email to your billing contact before engaging a new Sub-processor or materially changing the scope of an existing one, and will update Annex 2 at the same time. Replacing an infrastructure provider, changing the AI model provider, or moving data to a new processing location are each a change requiring notice.

6.3 Objection. You may object on reasonable data-protection grounds within the notice period. The parties will discuss in good faith; if no resolution is found within 30 days of your objection you may terminate the affected part of the Service, or the Agreement, with a pro-rata refund of prepaid fees for the unused period, as your sole remedy.

6.4 An emergency replacement necessary to maintain the security or availability of the Service may be made first and notified without undue delay afterwards, with the reason.

7.1 Test Utopia will, taking into account the nature of the processing, assist you by appropriate technical and organisational measures in responding to requests by Data Subjects to exercise their rights. The Service provides, to your organisation administrators, self-service tools for the common cases: export of a Candidate's data across attempts, invitations and interviews (Articles 15 and 20), and erasure of a Candidate's data (Article 17), both audit-logged. Where a request cannot be met with those tools, Test Utopia will assist within 10 business days of your written request.

7.2 If a Data Subject contacts Test Utopia directly about Customer Personal Data, Test Utopia will not respond substantively but will, where the Data Subject names you, direct them to you and inform you of the request without undue delay.

8.1 Test Utopia will notify you without undue delay, and in any event within 24 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data, by email to your billing contact and your organisation administrators. Where the scope is still being established the first notice may be partial and will be followed up; it will in no case be delayed beyond 48 hours from awareness.

8.2 The notice will contain, so far as known: the nature of the breach; the categories and approximate number of your Data Subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point.

8.3 Test Utopia will provide the further information and reasonable assistance you need to meet your own obligations under Articles 33 and 34 GDPR. Test Utopia will not notify a Supervisory Authority or Data Subjects on your behalf unless you instruct it to, but will notify its own Supervisory Authority where the breach also affects data for which it is Controller (§2.2).

10.1 Customer Personal Data is stored and processed in the European Union (Annex 2). Where a Sub-processor processes Customer Personal Data outside the EEA, or may access it from outside the EEA for support purposes, the transfer is covered by an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or by the Standard Contractual Clauses adopted under Commission Decision (EU) 2021/914, as stated per Sub-processor in Annex 2.

10.2 Test Utopia will not transfer Customer Personal Data to a third country or international organisation except as described in Annex 2 or as required by EU or Member State law; in the latter case Test Utopia will inform you of the legal requirement before processing, unless that law prohibits it on important grounds of public interest.

11.1 During the term, Candidate data is retained for the period you configure in the Service (the "candidate retention period"; default 180 days, adjustable between 30 and 730 days, measured from the end of the Candidate's assessment, invitation or interview). On expiry the Service anonymises the record: every identifier and every piece of content attributable to the Candidate is removed or deleted, while the anonymous score survives for your aggregate reporting. You acknowledge that Bulgarian law (ЗЗЛД Art. 25k) requires employers to delete applicant data within six months of the end of the recruitment procedure absent the applicant's consent, and that you, not Test Utopia, choose the setting.

11.2 At the end of the Agreement, Test Utopia retains your data for 30 days so that you can export it or reactivate. On your written request at any time, or automatically 30 days after an account-deletion request, Test Utopia deletes all Customer Personal Data and existing copies, except: (a) invoices and other accounting records Test Utopia must retain under Bulgarian tax and accounting law (ten years); (b) VAT-validation evidence it must retain for the same reason; and (c) encrypted backup archives, which are pruned on a rolling schedule and are fully overwritten within six months of deletion. Backup archives are never restored for the purpose of recovering deleted Customer Personal Data except in a disaster-recovery event, and are then re-deleted.

11.3 Test Utopia certifies deletion on request.

12.1 Test Utopia makes available to you all information necessary to demonstrate compliance with Article 28 GDPR: this DPA, the Trust Center, its security policy set, completed security questionnaires (SIG Lite, CAIQ-Lite or your own template), and any third-party audit reports or certifications it holds at the time.

12.2 Where that information is not sufficient to demonstrate compliance, you (or an independent auditor you mandate, bound by confidentiality and not a competitor of Test Utopia) may audit Test Utopia's processing of Customer Personal Data once per twelve months, or additionally following a Personal Data Breach affecting your data or a request from a Supervisory Authority, on at least 30 days' written notice, during business hours, in a manner that does not disrupt the Service or expose other customers' data. Each party bears its own costs.

13.1 Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, except that nothing limits either party's liability to Data Subjects under Article 82 GDPR or to a Supervisory Authority.

13.2 This DPA takes effect on acceptance of the Agreement and remains in force for as long as Test Utopia processes Customer Personal Data on your behalf, including the retention period in §11.2. In case of conflict between this DPA and the Agreement, this DPA prevails for the processing of Customer Personal Data.

13.3 This DPA is governed by the law of the Republic of Bulgaria and by the GDPR. Disputes are resolved as provided in the Agreement.