Data processing agreement
Version 2026-11-11. Applies from 11 November 2026. Under Article 28 of Regulation (EU) 2016/679 (GDPR). Accepted together with the terms.
1. Parties and roles
The customer (the firm) is the controller. Aldorock AB, company number 559607-5985, VAT number SE559607598501, Gammelgårdsvägen 58, 112 64 Stockholm, Sweden is the processor.
2. Purpose and duration
The processor processes personal data only to provide Aldorock Underlag: send checklists to the customer's clients, receive details about uploaded files, send reminders and summaries and show status to the customer. This agreement runs for as long as the customer uses the service.
3. Data and data subjects
- Data subjects: the customer's clients and their contact persons, the customer's users.
- Data: name, e-mail address, the contact person's name (also used in the mails to the client), the request's title and checklist, file name, file size and file type, comments, times and ids in the event log.
- The processor does not process the content of files. Files are uploaded from the client's browser straight to the customer's Microsoft 365.
- The service never asks clients for a personal identity number. Special categories of personal data must not be written in fields or comments. Documents the client uploads may contain such data but end up only with the customer.
4. The processor's obligations
- Process the data only on the customer's documented instructions, which are this agreement and the customer's settings.
- Make sure everyone with access is bound by confidentiality.
- Secure the data: all traffic uses TLS, links to clients are stored only as hashes, keys and tokens are encrypted, every database query is tied to the customer, and access is limited to what the service needs.
- Not use AI or language models on the data.
- Tell the customer at once if, in the processor's view, an instruction infringes the GDPR or other data protection law.
- Help the customer with data subjects' rights and with the duties in Articles 32 to 36: security, breach notification, impact assessments and prior consultation.
- Notify the customer of a personal data breach without undue delay and within 48 hours.
5. Storage and deletion
- Details about a request (the client's name and e-mail, the checklist, file names and sizes, comments, reminders) are deleted when the period the customer has chosen has passed after the request was closed. The default is 90 days, the customer chooses between 7 and 3650 days.
- A client with no request left is deleted when the same period has passed.
- The customer can delete a client with no open request at any time.
- An open request whose link has expired is closed by the service 30 days later, and then deleted like other closed requests.
- Everything the firm has at Aldorock is deleted at once when an administrator asks for it in Settings, and otherwise 30 days after a paid subscription ended if nobody has signed in since. A receipt goes to the firm's e-mail.
- The event log holds only ids and events, no names, and is deleted after 400 days.
- The sample page on the website keeps no files. The file passes through the service and is thrown away at once. The details about it are deleted within an hour.
- The content of files is never stored at Aldorock. It sits in the customer's own Microsoft 365 and the customer decides for how long.
6. Sub processors
| Provider | What | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting of the service (Workers) and the database (D1). | The database is stored in the EU (D1 with EU jurisdiction). Requests are handled in Cloudflare's network close to the user. Transfers to the USA rely on the EU standard contractual clauses and the EU US Data Privacy Framework. |
| Plus Five Five, Inc. (Resend) | Sending reminders to clients and summaries to the firm: the recipient's name and e-mail, the firm's name, the request's title, the checklist items and the link. Resend keeps the mails, link included, for a limited time under its data processing agreement. | Sending from the EU (Ireland). Transfers to the USA rely on the EU standard contractual clauses. |
The customer hereby gives a general written authorisation for the processor to engage sub processors. The processor tells the customer by e-mail at least 30 days before adding or replacing one. The customer may object and end the agreement. The processor imposes the same data protection obligations as in this agreement on every sub processor and remains fully liable to the customer for their processing. Microsoft is not a sub processor: the customer's Microsoft 365 is the customer's own.
7. Transfers outside the EEA
Data is transferred only with a valid mechanism under Chapter V of the GDPR.
8. Audit
The processor gives the customer the information needed to show compliance with this agreement and allows a reasonable audit with 30 days' notice.
9. When the agreement ends
The customer chooses whether the data is returned or deleted. Return: the customer exports requests and items as CSV in the service, and the files are already in the customer's Microsoft 365. Deletion: an administrator deletes everything at once in Settings, and otherwise the processor deletes the customer's data 30 days after a paid subscription ended if nobody has signed in since. A receipt goes to the customer's e-mail. Data the law requires the processor to keep, such as invoices, is kept as long as the law requires.
10. Law
As in the terms.