Version: 1.1
Effective Date: 2026-11-05
Supersedes: Version 1.0 of 2025-08-18
ELDEY hugbúnaður ehf. (the Processor or ELDEY), reg. no. 521211-1720, Engjateigi 9, 105 Reykjavík, Iceland; and
each customer that enters into the Agreement or uses the Services (the Controller or Customer).
This DPA forms part of and is incorporated into the Agreement for all ELDEY Services and Orders.
Plain-English summary (non-binding aid): This DPA is part of your customer contract (the "Agreement"). It applies wherever ELDEY processes personal data on your behalf, and it is intended to meet the requirements of Article 28 of the GDPR. It covers security measures, subprocessors (cloud hosting, push notification delivery and support email), breach notices, deletion and return of data, audits, and international transfer safeguards. If there is a conflict, the legal terms of this DPA control.
Addendum to Agreement. This DPA is an addendum to, and forms part of, the Agreement between ELDEY and the Customer. It applies to all Services provided under the Agreement, including any Order Forms, Statements of Work, or similar ordering documents, and to the ELDEY web application and the ELDEY mobile applications alike.
Self-serve sign-ups and mobile applications. This DPA also applies where the Customer accepts the Agreement by web sign-up or in-product click-through, and to use of the ELDEY mobile applications installed from the App Store or Google Play. In such cases, this DPA is incorporated by reference and becomes binding as of the Customer's acceptance or first use of the Services.
Changes to this DPA. ELDEY may update this DPA to reflect changes in law, in the Services, or in the Subprocessors. ELDEY will publish the updated version with a new version number and effective date and will give Customer at least 30 days' notice of material changes by email or in-product notice. Changes that reduce the protections of this DPA do not apply to a Customer that objects in writing within the notice period.
Capitalised terms not defined here have the meanings given in the Agreement. Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings in Applicable Data Protection Law. In addition:
ELDEY processes Personal Data on the Controller's behalf solely to provide the Services, as further described in Annex I. This DPA remains in force for the term of the Agreement and thereafter until Personal Data has been deleted or returned under Section 11.
Purpose. Processing is limited to what is necessary to deliver, maintain, secure and support the Services. ELDEY does not use Personal Data for its own purposes. ELDEY may use aggregated or anonymised data that does not identify any natural person or Customer for service operation and improvement.
Instructions. ELDEY processes Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless required to do otherwise by EU, EEA or Member State law. In that case ELDEY will inform the Controller of the legal requirement before processing, unless the law prohibits such information on important grounds of public interest. The Agreement, this DPA and the Controller's use of the Services' features constitute the Controller's documented instructions.
Infringing instructions. ELDEY will immediately inform the Controller if, in ELDEY's opinion, an instruction infringes Applicable Data Protection Law. ELDEY may suspend the affected processing until the Controller confirms or modifies the instruction.
Prohibited data. The Controller will not submit special categories of personal data (GDPR Article 9), data relating to criminal convictions (Article 10) or data of children under 16 to the Services unless expressly agreed in writing with appropriate safeguards.
The categories of Personal Data and of data subjects are described in Annex I.
The Controller is responsible for the lawfulness of the processing, including transparency to data subjects, legal basis and data minimisation; for the accuracy of its instructions; for configuring the Services, including optional features such as location capture, in accordance with Applicable Data Protection Law; and for notifying ELDEY of any data subject request or restriction that affects the Services. The Controller administers its own users, devices, feature settings and retention through the admin portal provided with the Services, and those settings form part of its documented instructions to ELDEY.
ELDEY shall:
General authorisation. The Controller authorises ELDEY to engage the Subprocessors listed in Annex III. ELDEY publishes the current version of this DPA, including Annex III, at https://skilmalar.eldeysoft.is/dpa.html.
Changes. ELDEY will give the Controller at least 30 days' notice before adding or replacing a Subprocessor, by publishing an updated Annex III at the URL above and by email or in-product notice. The Controller may object in writing within the notice period on reasonable data protection grounds. If the parties cannot resolve the objection in good faith, the Controller may terminate the affected Services without penalty.
Flow-down. ELDEY enters into written terms with each Subprocessor that impose data protection obligations no less protective than those in this DPA, including appropriate TOMs and, where applicable, a valid transfer mechanism.
Responsibility. ELDEY remains fully liable to the Controller for the performance of each Subprocessor's obligations.
ELDEY is established in Iceland, within the EEA, and stores and processes production data in AWS regions within the EEA, currently eu-west-1 (Ireland). Backup copies may be held in another AWS region within the EEA. ELDEY will not itself transfer Personal Data outside the EEA without the Controller's documented instruction, and will enter into the EU SCCs before any such transfer, as set out in Annex IV.
Push notification delivery to mobile devices requires the transfer of device push tokens and notification content to Google (Android) and Apple (iOS), which may process them in the United States. These transfers take place under the transfer mechanisms stated for each Subprocessor in Annex III. Where any other Subprocessor processes Personal Data outside the EEA, ELDEY ensures a valid transfer mechanism under Chapter V of the GDPR and will, on request, provide the Controller with information reasonably needed for a transfer impact assessment.
ELDEY will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Personal Data. The initial notice may be partial; ELDEY will provide the information required by GDPR Article 33(3) as it becomes available, will take appropriate measures to contain and mitigate the breach and prevent recurrence, and will cooperate with the Controller in meeting its obligations under Articles 33 and 34. ELDEY will not notify data subjects or authorities on the Controller's behalf unless the Controller instructs it to or the law requires it.
ELDEY will make available the information necessary to demonstrate compliance with this DPA. The Controller may audit ELDEY's compliance, itself or through an independent auditor mandated by it and bound by confidentiality, no more than once in any 12-month period, on at least 10 business days' written notice. Audits will first rely on documentation and evidence provided by ELDEY, such as policies, configuration evidence and AWS compliance reports. Where an on-site or remote inspection is still required, it will take place during normal business hours, under confidentiality, without unreasonable disruption to operations, and at the Controller's cost unless the audit reveals material non-compliance. The once-per-year limit does not apply to audits following a Personal Data Breach or required by a supervisory authority.
The Controller may export its data at any time through the admin portal. Within 90 days after termination or expiry of the Services, or after the Controller's written request, ELDEY will delete Personal Data from production systems and, if the Controller requests it before deletion, first return the Personal Data in a commonly used machine-readable format. If the Controller does not request return within 30 days after termination, ELDEY will delete the data. ELDEY may retain Personal Data only where and for as long as EU, EEA or Member State law requires.
Backups. Backup copies may be stored in locked or immutable backup vaults to meet the integrity and recovery requirements of GDPR Article 32 and to protect against ransomware. Individual records are not removed from a backup before it expires, and a backup held in a locked or immutable vault cannot be deleted before it expires. Deletion from backups therefore occurs by scheduled expiry under Annex II, item 5. Backups are isolated, used only to restore the Services, and not otherwise accessed. Personal Data deleted from production is not restored into production; if a backup containing it is restored, the data is deleted again before the restored environment is used.
Taking into account the nature of the processing, ELDEY will assist the Controller with appropriate technical and organisational measures in responding to requests by data subjects to exercise their rights under Applicable Data Protection Law. The Controller is responsible for verifying the requester's identity and for the substantive response. ELDEY will execute the Controller's documented deletion, rectification, restriction or export instructions in the Services within 10 business days, or sooner where the Controller's statutory deadline requires it. If a data subject contacts ELDEY directly about Personal Data, ELDEY will not respond except to refer the request to the Controller, and will notify the Controller within 5 business days. Support communications are handled by email hosted by the Subprocessor named for that purpose in Annex III; the Controller should limit Personal Data in support requests to what is needed to resolve them.
Each party will keep Personal Data and audit information confidential and will ensure that personnel processing Personal Data are subject to appropriate confidentiality undertakings.
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent such limitation is not permitted by Applicable Data Protection Law.
In case of conflict between this DPA and the Agreement, this DPA prevails with respect to the processing of Personal Data. Where the EU SCCs apply, they prevail over this DPA for the matters they govern.
ELDEY's contact for data protection matters is privacy@eldeysoft.is. ELDEY has not appointed a data protection officer, as it is not required to under Article 37.
If any provision of this DPA is held invalid, the remainder remains in full force. This DPA may be executed in counterparts and delivered electronically; acceptance of the Agreement constitutes acceptance of this DPA. This DPA is governed by the laws of Iceland, and the parties submit to the exclusive jurisdiction of the District Court of Reykjavík (Héraðsdómur Reykjavíkur).
Subject matter. Processing of Personal Data by ELDEY on behalf of the Controller in connection with the Services.
Duration. The term of the Agreement and thereafter until deletion or return under Section 11.
Nature and purpose. Hosting, storage, retrieval, transmission, synchronisation to mobile devices, notification delivery, support, maintenance and security monitoring necessary to provide the Services.
Categories of data subjects. The Controller's employees and contractors; users of the Services; the Controller's customers and their contact persons, including natural persons who are customers; the Controller's vendors and partners and their contact persons.
Categories of Personal Data.
Special categories of data are not intended to be processed.
Feature-specific processing: location capture (optional). When the Controller enables location capture, the mobile applications record the device location at the moment a user takes an action such as capturing an order, and the Services store it for location-based order history and reporting. Location is not tracked continuously or in the background. The Controller is responsible for a valid legal basis, transparency to affected users and any required impact assessment.
Feature-specific processing: push notifications (mobile applications). To deliver notifications to mobile devices, the Services store each device's push token and send notification messages through Google Firebase Cloud Messaging (Android) and the Apple Push Notification service (iOS). Notification payloads carry the identifiers needed to open the relevant screen and a short notification text, which may include business record content such as an order or customer name. Push tokens are removed when the user signs out or when the Controller's administrator removes the device in the admin portal.
The current list is Annex III of the version of this DPA published at https://skilmalar.eldeysoft.is/dpa.html. ELDEY gives notice of changes under Section 7.
| Subprocessor | Purpose | Personal Data received | Location of processing | Transfer mechanism | Applies when |
|---|---|---|---|---|---|
| Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg | Cloud hosting: compute, database, object storage, key management, logging and security services | All Personal Data stored in the Services | EEA (currently eu-west-1, Ireland; backup copies may be held in another EEA region) | In-EEA storage and processing. For remote support access from outside the EEA: the AWS GDPR Data Processing Addendum, which incorporates the EU SCCs, and AWS's EU-US Data Privacy Framework certification | Always |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Push notification delivery to Android devices via Firebase Cloud Messaging | Device push tokens, device and app identifiers, and notification content, which may include short excerpts from business records such as an order or customer name | EEA and United States | Firebase Data Processing and Security Terms, which incorporate the EU SCCs, and Google's EU-US Data Privacy Framework certification | Customer uses the ELDEY Android application |
| Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland | Push notification delivery to iOS devices via the Apple Push Notification service | Device push tokens, device and app identifiers, and notification content, which may include short excerpts from business records such as an order or customer name | EEA and United States | Apple Developer Program License Agreement, including its data protection terms and the Model Contract Clauses provided under it, and Apple's EU-US Data Privacy Framework certification | Customer uses the ELDEY iOS application |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Email hosting for ELDEY support communications (Microsoft 365) | Personal Data that the Controller includes in support requests, such as names, contact details and excerpts from business records | EEA (Microsoft EU Data Boundary) | Microsoft Products and Services Data Protection Addendum, which incorporates the EU SCCs, and Microsoft's EU-US Data Privacy Framework certification | Controller contacts ELDEY support by email |
Subprocessor terms and sub-processor lists (for reference):
Apple and Google also act as independent controllers in operating the App Store and Google Play, including app distribution, crash reporting and store analytics. That processing is not on ELDEY's behalf and is not covered by this Annex.
ELDEY is established in the EEA. No transfer mechanism is required between the Controller and ELDEY while ELDEY processes Personal Data within the EEA. Transfers by Subprocessors outside the EEA are governed by the mechanisms stated in Annex III, which ELDEY has entered into with each Subprocessor. If ELDEY ever needs to process Personal Data outside the EEA on the Controller's documented instruction, the parties will enter into the EU SCCs, Module 2 (controller to processor), before such processing starts.
To obtain a signed copy for recordkeeping, or to request a countersigned version, contact privacy@eldeysoft.is.