This DPA forms part of the Unity Discover Terms of Service between Universal Strategic Arts Ltd (company no. 16700907) ("Processor", "we") and the organisation that accepts those Terms ("Customer", "Controller"). It applies automatically when the Customer accepts the Terms. No signature is needed. If the Customer has a signed agreement with us, that agreement's data terms prevail.
1. Definitions
"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR. "Personal Data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings in Data Protection Law. "Customer Personal Data" means Personal Data we process for the Customer through Discover, described in Annex 1.
2. Roles
- For Customer Personal Data (mainly participants' interviews), the Customer is the controller and we are the processor.
- For account, billing and security data about the Customer's own users, we are the controller. Our Privacy Policy covers that, not this DPA.
3. Our obligations as processor
We will:
- process Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use of Discover's features are those instructions. We will tell the Customer if we think an instruction breaks Data Protection Law;
- ensure everyone who processes it is bound by confidentiality;
- apply the security measures in Annex 2;
- use sub-processors only as set out in §5;
- help the Customer respond to data subject requests (§6), and with security, breach notification, impact assessments and consultation with regulators, taking into account the nature of the processing;
- delete or return Customer Personal Data at the end of the service (§8);
- make available information needed to show compliance with this DPA, and allow audits as set out in §9.
4. Customer obligations
The Customer confirms it has a lawful basis and has given the notices required for the processing, including to participants, and that its instructions comply with Data Protection Law. The Customer is responsible for the accuracy of the data it collects and for not inviting participants it may not lawfully contact.
5. Sub-processors
- The Customer gives general authorisation for us to use the sub-processors listed on our sub-processors page (Annex 3).
- We impose data protection terms on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance.
- Changes: we will update the list and email the Customer's account owner at least 30 days before a new sub-processor begins processing Customer Personal Data. The Customer may object on reasonable data protection grounds within that period. If we cannot reasonably address the objection, the Customer may close its account, and we will refund any prepaid fees for the unused period.
6. Data subject requests
If a participant contacts us directly, we will pass the request to the Customer without undue delay and not respond ourselves except to redirect them. Discover lets the Customer view, export and delete a participant's interview, and exclude a response from analysis. Deleting a participant removes their interview and analysis from Discover. On request to privacy@thisisuniversal.com, we also remove any remaining search entries and the voice provider's copy of the conversation.
7. Personal data breaches
We will notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Personal Data. We will give the information reasonably available to us, and update it as we learn more. Notice goes to the workspace owner's email address.
8. Return and deletion
- The Customer can export its data at any time (Settings → Account → Export).
- When the Customer closes its account, we delete Customer Personal Data from our production systems within 60 days, and it leaves our backups within a further 30 days, unless the law requires us to keep it.
- The voice provider keeps conversation records, including audio, until we delete them. We delete them on request, and when the Customer closes its account.
- Deleting a study or participant in Discover removes it from our database straight away.
9. Audits
We hold ISO 27001 certification and a SOC 2 Type 2 report, both covering Unity Platform, of which Discover is part. On request to trust@thisisuniversal.com, we will provide these and answer reasonable security questionnaires once a year. If that is not enough to show compliance, the Customer may audit us, at its own cost and on 30 days' notice, no more than once a year, unless a regulator requires otherwise or there has been a breach.
10. International transfers
Some sub-processors process data outside the UK and EEA, mainly in the United States. Where they do, we rely on adequacy regulations (including the UK–US Data Bridge for certified companies) or on the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses, with supplementary measures where needed. The relevant terms are incorporated in our agreements with each sub-processor.
11. Liability and precedence
Liability under this DPA is subject to the limits in the Terms, except where Data Protection Law does not allow that. If this DPA conflicts with the Terms on data protection, this DPA prevails.
Annex 1 — Details of processing
| Subject matter and purpose | Providing Discover: running AI voice and text interviews; transcribing; storing; analysing, summarising and drafting; search and question-answering over the Customer's research; sending interview invitations, access codes and transcript copies. |
| Duration | The term of the Customer's account, plus the deletion periods in §8. |
| Data subjects | Interview participants invited by the Customer (customers, prospects, staff, members of the public). |
| Personal data | Name, email address and job title (if given); access codes; interview audio (held by the voice provider, see Annex 3); typed answers; transcripts; consent time and version; AI-generated analysis, quality scores and quotes; any personal data participants choose to share in answers. |
| Special category data | Not intended. It may occur if participants volunteer it, or if the Customer's study asks for it, in which case the Customer is responsible for the lawful basis (Terms §4). |
| Processing operations | Collection, recording, storage, transcription, analysis by AI models, embedding and indexing for search, retrieval, display, export, email delivery, deletion. |
| Location | Primary database in Ireland (EU). Other processing as listed in Annex 3. |
Annex 2 — Security measures (summary)
- Encryption in transit (TLS) and at rest.
- Database row-level security: each workspace's data is isolated, and access is limited to the account owner.
- Email one-time-code sign-in, rate limits on authentication and sensitive endpoints, and signature-verified webhooks.
- Least-privilege staff access to production, logged administrative actions, and background checks and security training for staff.
- Error monitoring hosted in the EU, with personal data minimised and session replays masking all text and inputs.
- An ISO 27001 ISMS, incident response plan, business continuity and backup testing (Trust Centre: trust.thisisuniversal.com).
Annex 3 — Sub-processors
See our sub-processors page.