Data Processing Addendum

1. Roles and scope

• Customer is the controller (data fiduciary) of personal data it collects through the service. Surge is the processor and acts only on Customer's documented instructions, which include using the service as designed.
• Scope: interview recordings (audio and video clips), transcripts, screener answers, participant names, emails, incentive payment details (UPI ID), fraud-check data, and workspace user accounts.
• Purpose: to run AI-moderated interviews, analyse them and provide the service to Customer. Duration: while Customer uses the service, plus the deletion period in section 8.

2. Confidentiality

Surge ensures that everyone it authorises to process the data is bound by confidentiality and accesses it only to run, secure and support the service.

3. Security measures

Surge keeps the technical and organisational measures described on the Security page, including encryption in transit, role-based access in workspaces, hashed passwords and API keys, and participant erasure tools.

4. Subprocessors

• Customer authorises the subprocessors listed on the Subprocessors page.
• Surge gives Customer 14 days' notice by email before adding or replacing a subprocessor. Customer may object on reasonable data-protection grounds; if we cannot resolve it, Customer may end the affected service.
• Surge binds each subprocessor to data-protection terms no less protective than this addendum and remains responsible for its performance.

5. Personal data breaches

Surge notifies Customer without undue delay after becoming aware of a personal data breach affecting Customer data, with a target of 72 hours, and gives the information Customer reasonably needs to meet its own notification duties.

6. Data-subject requests and assistance

Surge helps Customer respond to requests from participants and users (access, correction, erasure and similar), including through the in-app participant erasure tool, and gives reasonable help with data-protection impact assessments and regulator enquiries.

7. International transfers

Customer data is processed in India and by the listed subprocessors in their stated locations. Where data protection law requires it, Surge will sign the European Commission's Standard Contractual Clauses (or the UK addendum) on request.

8. Deletion or return

At the end of the service, or on Customer's request, Surge deletes Customer data from its live systems, or returns it first if Customer asks (reports export as Markdown or HTML; other exports on request to [email protected]), unless the law requires Surge to keep it.

9. Information and audits

Surge makes available the information reasonably needed to show compliance with this addendum and answers Customer's reasonable written security questions.

10. Signing

For a countersigned copy, email [email protected] with your company name and address. Support: [email protected], reply within 1 business day (IST).