Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
Userlytics
GDPR evidence
Remote user testing with
Vendor-statedUserlytics and GDPR
Userlytics states it holds a data processing agreement. CertReports captured this on 21 Sep 2026 from its trust centre (Drata); it is a vendor statement, not an independent confirmation.
Evidence
Vendor-statedVendor states GDPR on its trust centre
as of 21 Sep 2026 · confidence 80%VerifiedActive: EU-US Certification, SW-US Certification, UK Extension Certification
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 30 Jan 2019
- Expires or valid through
- 20 May 2027
- Scope
- Userlytics is a User Experience Testing Service that provides software services to organizations (of all types) across the world. Please see a brief description of our service here: Userlytics’ platform allows clients to set up and manage user experience and usability testing, mostly in online settings. The platform (www.userlytics.com) enables the recording of a combined “Picture-in-Picture'' audiovisual recording of participants (what they see and do, as well as they themselves), through a video recording of their screen as they interact with digital assets (websites, mobile apps, prototypes and other digital assets), by following instructions, while they speak out loud in a “Think Aloud” protocol, and also captures and allows the manipulation and sharing of a number of additional qualitative and quantitative metrics of each user experience and usability test. Simply put, our clients evaluate actual people interact with user interfaces. This could be moderated, whereby we have an individual asking questions, tasks, etc. as the people interact with the website and/or interface. This data is considered extremely valuable insight for our clients. We have a panel of over 2.1 Testers (or otherwise, market research partipants) who voluntarily offer their information to be used in research studies. In turn, the Testers are paid compensation for their involvement. The specific data processed depends on the client and the type of study. We commonly use consent forms with all testers, as disclosure of information is extremely important to our organization. The purpose of the data use is solely limited based on the structure of the project; processing is also limited to the activities discussed in the applicable service agreement and/or data processing agreement established between Userlytics We have dedicated Privacy and Security teams, tasked with implementing and constantly developing the best practices for the protection of all data. We ensure data subjects understand their inherent rights given under applicable law. Our practices are in accordance with domestic and international (mostly EU - GDPR) data privacy law. Userlytics may share information with third-party agents or service providers as specified in our Privacy Policies to facilitate certain functions on our behalf and comply with legal requirements.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | Userlytics Corporation: Active: EU-US Certification, SW-US Certification, UK Extension Certification | Live pagesha256 7ec7de806b |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Userlytics GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Form builders and surveys category) whose GDPR row is verified or vendor-stated, ranked by similarity.
No Form builders and surveys vendor has GDPR evidence in the index yet.
Understand GDPR evidence
All articlesHow-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read