Last Updated: January 12, 2026
This Data Processing Agreement (“DPA”) constitutes a legally binding agreement between Alda (Alda Solutions ehf.) (“Data Processor”) and you, the user of Alda’s services (“User” or “Data Controller”) (together as the “Parties”). Please read it carefully.
By checking the “accept” box you are agreeing to both Terms of Service and the Data Processing Agreement. If you don't accept them, do not use the software.
INTRODUCTION
This DPA is implemented on the basis of Article 28 of the Regulation (EU) 2016/679 of European Parliament and of the Council of 27 April 2016 (the “GDPR”), cf. Article 25 of the Icelandic Act no. 90/2018 on Data Protection and the Processing of Personal Data (“The Icelandic Data Protection Act”) (together the “Data Protection Legislation”).
The DPA shall apply in parallel with the Alda Solutions Terms of Service and govern the terms on which Data Processor shall process personal data on behalf of User to provide the Alda Solutions Diversity, Equity and Inclusion Solution software. In case of any conflict between any provision of this DPA and the Terms of Service, the provisions of this DPA shall prevail.
The parties acknowledge that, for the purposes of the Data Protection Legislation, the User acts as a Data Controller of the Personal Data of its employees processed on the basis of this DPA and the Terms of Service, and Alda Solutions Acts as Data Processor.
The Parties agree as follows:
1. DEFINITIONS AND INTERPRETATION
1.1 In this DPA unless the context requires otherwise:
“The Service” means a SaaS solution that helps organisations gain a real-time overview of the status of DEI within the workplace, set measurable goals and provide micro-education for employees. The software sends a survey to employees to gauge the workplace culture - using data from the survey, as well as from the organisations payroll & HR systems, to give management a holistic overview in a real- time DEI dashboard. The software further helps management set measurable goals and provides guidance as to a custom employee training on the relevant DEI topics year round;
“Terms of Service” means the Alda Solutions Terms of Service governing the provision of the Service;
“The Icelandic Data Protection Act” means Icelandic Act no. 90/2018 on Data Protection and the Processing of Personal Data;
“GDPR” means Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
“Data Protection Legislation” means GDPR, the Icelandic Data Protection Act and any legislation and/or regulation implementing or made pursuant to them, or which amends, replaces, re-enacts or consolidates any of them;
“Data Controller”, “Data Processor”, “Processing”, “Data Subject”, and “Personal Data Breach” have the meaning given in the Data Protection Legislation;
“Personal Data” means any Personal Data, within the meaning of the Data Protection Legislation, of Data Subjects processed by the Data Processor on behalf of the User pursuant or in connection with the Terms of Service.
“Data Subject Request” means a request from or on behalf of a Data Subject relating to access to, rectification, erasure or data portability in respect of that person’s personal data or an objection from or on behalf of a data subject to the processing of its personal data. A Data Subject Request can be sent to privacy@alda.co
“Sub-Processor” means any other processors used by Data Processor to process the Personal Data in order to provide the Service, for example the storage of Personal Data.
2. GENERAL
Scope
This agreement is in addition to, and does not relieve, remove or replace, a party's obligations under the Data Protection Legislation. This agreement (as amended from time to time) consists of:
(a) this DPA;
(b) Annex 1 which describes the subject matter, duration, nature and purpose of processing, Personal Data categories and Data Subject types in respect of which Data Processor may process in order to fulfil its obligations pursuant to the Terms of Service;
(c) Annex 2 which contains the list of Data Processor’s data security measures.
3. DATA CONTROLLER OBLIGATIONS
3.1 The Data Controller is responsible for fulfilling its obligations pursuant to the Data Protection Legislation and any rules and regulations implemented on their basis.
3.2 Data Controller has the right and obligation to decide the purpose and ensure the legitimacy of the transfer of Personal Data to the Data Processor and the processing thereof.
3.3 Without prejudice to the generality of clause 3.1, Data Controller shall especially:
(a) ensure the Personal Data is and remains complete, true and accurate;
(b) rely on a fair and lawful basis in respect of all processing; and
(c) ensure it has and maintains all necessary and desirable authorities, registrations, consents and permissions (including those required under Data Protection Legislation) in relation to its acquisition of the personal data, the transmission of the personal data to Data Processor and Data Processor’s processing of the personal data under this DPA.
(d) Ensure that Data Subjects are informed of their rights, in accordance with Articles 15-22 of the GDPR.
4. DATA PROCESSOR OBLIGATIONS
4.1 Data Processor shall only process Personal Data on behalf of the Data Controller to the extent necessary to provide the service according to the Terms of Service, as described in Annex 1, in full accordance with the Data Protection Legislation.
4.2 Without prejudice to the generality of clause 4.1, where Data Processor processes Personal Data in relation to this DPA, it shall (and shall ensure that all its personnel):
(a) ensure that it has in place appropriate technical and organisational measures, cf. Articles 32-36 GDPR, which have been reviewed and approved by the controller, to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data. The Data Processor shall ensure that such measures are appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development. At the date of this DPA, those measures include (as a minimum) the data security measures referred to in Annex 2;
(b) implement without delay, such other technical and organisational measures that the relevant Data Controller may reasonably require;
(c) provide the Data Controller (and its agents) with information, assistance and co-operation to verify its (and any Sub-Processor’s) compliance with this DPA, which assistance and co-operation will include, for example:
i. keeping complete, true and accurate records of its performance of this DPA;
ii. providing and allowing the controller (and its agents) to make copies of any such records to the controller;
iii. by providing reasonable access to any facilities at which personal data is processed;
(d) enable the Controller to conduct, or have a third-party conduct on their behalf, audits of the processing activities carried out by the Processor and provide the Controller with due assistance in such audits. The purpose of auditing is to ascertain that the Processor and, where appropriate, Sub-processors are complying with the obligations under this DPA, including as regards internal control, security and obligations under the Data Protection Legislation;
(e) ensure that all its personnel and other persons authorized to process Personal Data have committed themselves to confidentiality or are under appropriate statutory obligations of confidentiality;
(f) process Personal Data only for the duration of the DPA between the parties, although the party acting as a processor may retain Personal Data to the extent required by applicable laws and only to the extent and for such period as required by applicable laws and always provided that the Data Processor shall ensure the confidentiality of all such personal data and shall ensure that such Personal Data is only processed as necessary for the purposes specified in the applicable laws requiring its storage.
4.3 Notwithstanding the foregoing, the Data Processor may retain aggregated, non-identifiable data collected through the provision of the Service for the purpose of improving their Services, as described in Annex 1.
4.4 Data Processor shall notify the Data Controller if the Data Processor receives a Data Subject Request and provide assistance, cooperation, information and access as the Data Controller may reasonably request to enable the Data Controller to respond to such requests.
4.5 If the Processor considers that instructions and/or requests from the Data Controller violate the Data Protection Legislation, he shall inform the Data Controller thereof without delay.
4.6 In the event of any suspected or actual breach of this clause 4, or other data protection or privacy breach, Data Processor shall (at its own expense):
(a) notify the Data Controller immediately; and
(b) provide such information, assistance and cooperation and do such things as the controller may request to
(i) investigate and defend any claim or regulatory investigation;
(ii) mitigate, remedy and/or rectify such breach; and
(iii) prevent future breaches.
5. TERMINATION AND DELETION OF DATA
5.1 This DPA forms part of the Terms of Service and shall apply for as long as the Service is provided. It is therefore not permissible to terminate the DPA while the Service is still being provided.
5.2 On termination of the Terms of Service, the Data Processor shall, at the choice of the Data Controller, delete or return all Personal Data to the Controller and delete existing copies, unless further storage of the Data is required by law.
5.3 The Data Controller my at any time instruct the Processor wo delete or return Personal Data the Controller. Such requests shall be responded to by the Processor as quickly as possible.
6. SUB-PROCESSING
6.1 Data Controller grants Data Processor a general authorisation to appoint and remove sub-processors of the personal data. Data Processor will give Data Controller notice and provide Data Controller with a mechanism to obtain notice if any changes occur in the appointments of Sub-processors, i.e., at least thirty (30) days in advance of providing a new Sub-Processor access to Personal Data.
6.2 The Data Processor shall:
(a) restrict the sub-processor’s access to personal data only to what is necessary for the purpose;
(b) enter into a written agreement with each sub-processor before permitting the sub-processor to process personal data and such written agreement shall comply with the Data Protection Legislation; and
(c) remain responsible for the acts and omissions of its sub-processors as provided for in the GDPR.
7. PERSONAL DATA BREACHES AND REPORTING PROCEDURES
7.1 The Data Processor shall notify the Data Controller without undue delay after becoming aware of a Personal Data Breach concerning the Personal Data processed pursuant to this DPA and the Terms of Service. If the nature of the processing is such as to pose a likely risk to the rights and freedoms of data subjects, the Processor shall assist the Data Controller in a risk assessment, including an assessment of the impact on data protection in accordance with the provisions of the Data Protection Act, cf. Art 4.2 (d).
7.2 Each party shall comply with their obligation to report a personal data breach to the Supervisory Authority and (where applicable) data subjects under Article 33 of the GDPR.
7.3 The parties agree to provide each other with such reasonable information, cooperation and assistance as is necessary to facilitate the handling of any Personal Data Breach in an expeditious and compliant manner.
8. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES
8.1 Data Processor shall not transmit Personal Data (or allow personal data to be transmitted) outside the European Economic Area without the Controller’s prior written consent (and then only subject to Standard Contractual Clauses and other appropriate safeguards or on the basis of an adequacy decisions, cf., Articles 46 and 45 GDPR). For the avoidance of doubt, the Data Controller does, inter alia by accepting the Terms of Service, approve the transmittance of Personal Data to specified Sub-Processors operating in the territories set out in Annex 1 to this DPA for the purposes specified (and subject to the terms of this DPA);
9. FINAL PROVISIONS
9.1 This DPA shall be governed by Icelandic law.
9.2 Disputes arising from this DPA shall be referred to the District Court of Reykjavík.
ANNEX 1
Data Processing under the DPA
General description of the data to be processed:
a. Data categories:
i. Employee data of Data Controller’s employees
1. Personal information: E-mail address and/or phone number;
2. Anonymous responses to survey
b. Processing:
i. Examining and communicating to Data Controller statistical information on the well-being and experience of employees
c. Method of processing:
i. Administration of anonymous survey to employees of Data Controller
Purpose of the data processing Data Processor processes employee data in order to perform a contract, i.e., providing the Service. Data Processor may also retain anonymous aggregated data collected through the anonymous surveys in order to create benchmarks and improve their own service on the basis of legitimate interests.
Sub-processors
AWS, Database and hosting services, No transfer outside the EEA
ANNEX 2
Data Processor’s organisational and technical measures
Description of data security measures and how the data is anonymised and aggregated.
Data Processor has implemented the following technical and organizational security measures to protect personal data:
● Pseudonymization of personal data, replacing identifiable information like Company names with a random number, when extracting Data Controller’s data for Data Processor’s benchmarking database.
● End-to-end encryption of personal data, decryption key stored within EU.
● Employee training on information security, at least once a year.
● Written information security policies and procedures, documented and presented to all employees.
● Physical access controls, with locked offices outside of office hours and a finite list of employees that have keys.
● System access controls, with structured roles within AWS and backup MFA device for root admin stored physically in a safety deposit box.
● Data access controls, by forcing unique passwords and MFA on all accounts that should have access to Data Controller’s data.
● Data backups, with scheduled regular backups.
● Data segregation, by separating tenants in AWS thoroughly and ensuring strong access controls.
● All sub processors of Data Processors have the ISO27001 verification and follow GDPR guidelines.
● Anonymised survey data is gathered via Data Processor’s own survey system, not through a 3rd party surveying system.