Data Processing Addendum

Definitions

• “Data Protection Laws” means the laws on the protection of personal data that apply to the processing under this DPA, which may include the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, U.S. state privacy laws, Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties and Brazil’s LGPD.
• “GDPR” means Regulation (EU) 2016/679.
• “Personal Data” means personal data included in Customer Data.
• “Personal Data Breach” means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
• “Subprocessor” means a third party aldo engages to process Personal Data.
• “Standard Contractual Clauses” or “SCCs” means the clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

Roles and scope

The Customer is the controller of Personal Data and aldo is its processor. If the Customer is itself a processor for a third party, aldo acts as its subprocessor. Annex 1 describes the processing.

This DPA does not cover data aldo processes as a controller, such as account, billing, website and marketing data. The Privacy Policy covers that data.

Customer instructions

aldo processes Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use and configuration of the Service are its complete instructions. aldo will tell the Customer if, in its opinion, an instruction infringes Data Protection Laws.

The Customer is responsible for having a legal basis for the processing, for informing the people whose data it uploads, and for the accuracy of the Personal Data.

aldo’s obligations

• Confidentiality. aldo ensures that the people it authorizes to process Personal Data are bound by confidentiality obligations.
• Security. aldo implements the technical and organizational measures described in Annex 2.
• Use of data. aldo does not sell Personal Data and does not use, keep or disclose it for any purpose other than providing the Service to the Customer. aldo does not use Personal Data, and does not allow its Subprocessors to use it, to train artificial intelligence models.

Subprocessors

The Customer authorizes aldo to engage Subprocessors. Annex 3 lists the categories of Subprocessors aldo uses. The current list of Subprocessors is available on request at compliance@wearealdo.com.

aldo will give at least 30 days’ notice before adding or replacing a Subprocessor, by notifying the Account Owners by email. The Customer may object on reasonable data protection grounds within that period. If aldo and the Customer cannot resolve the objection, the Customer may cancel its subscription under the Terms.

aldo engages each Subprocessor under a written contract with data protection obligations no less protective than this DPA, and remains responsible for its Subprocessors’ performance.

Assistance

• Requests from individuals. If aldo receives a request from a person about Personal Data, it will forward it to the Customer and will not respond directly, except to direct the person to the Customer. aldo will reasonably help the Customer respond, mainly through the Service’s features.
• Assessments. aldo will provide reasonable information to help the Customer carry out data protection impact assessments and consult supervisory authorities, where Data Protection Laws require it.

Personal Data Breaches

aldo will notify the Customer without undue delay after becoming aware of a Personal Data Breach. The notice will describe, as far as known, the nature of the breach, the data and people affected, the likely consequences and the measures taken or proposed. aldo will take reasonable steps to contain the breach and reduce its effects.

Return and deletion

When the Terms end, the Customer may export Customer Data for 60 days as described in the Terms. After that period, aldo deletes or anonymizes Personal Data within a reasonable time, unless the law requires it to keep it. Backup copies are deleted in their ordinary cycle.

Audits

aldo will make available the information reasonably needed to show compliance with this DPA, such as security documentation and the results of third-party audits, if any. If that information is not enough, or a supervisory authority requires it, the Customer may carry out an audit once every 12 months. The Customer must give at least 30 days’ notice, bear its costs, keep the information confidential and avoid disrupting aldo’s operations.

International transfers

aldo hosts the Service in the United States. When Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree as follows:

• European Economic Area. The SCCs apply and are incorporated by reference, Module Two (controller to processor) or Module Three (processor to processor), as applicable. Clause 7 applies. Under Clause 9, option 2 applies with the notice period in section 5. The optional wording in Clause 11 does not apply. Under Clauses 17 and 18, the law and courts of Ireland apply. Annexes 1, 2 and 3 of this DPA complete Annexes I, II and III of the SCCs.
• United Kingdom. The UK Addendum applies, completed with the information in this DPA. Either party may end it as allowed by its section 19.
• Switzerland. The SCCs apply with the adaptations required by Swiss law, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.

If aldo adopts another transfer mechanism recognized by Data Protection Laws, such as the EU-U.S. Data Privacy Framework, it may rely on it instead.

Liability and order of precedence

Each party’s liability under this DPA is subject to the Terms. If this DPA conflicts with the Terms, this DPA prevails. If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

Term

This DPA applies for as long as aldo processes Personal Data on the Customer’s behalf.

Annex 1: Description of the processing

• Data exporter. The Customer, as controller. Contact: the Account Owners.
• Data importer. We Are Aldo Inc., as processor. Contact: compliance@wearealdo.com.
• Data subjects. The Customer’s employees, contractors and Users; people named in Customer Data, such as KPI owners; and people whose data comes from tools the Customer connects.
• Categories of data. Name, work email, job title, department, role, permissions, profile photo and sign-in identifiers; comments and other content in Customer Data; data imported from connected tools; technical and usage logs; issue report recordings.
• Sensitive data. None intended. The Customer should not upload sensitive data.
• Frequency. Continuous, while the Customer uses the Service.
• Nature and purpose. Hosting, storing, calculating and displaying the Customer’s strategy and KPIs; syncing connected tools; providing support; and providing features that use artificial intelligence.
• Duration. The term of the Terms, plus the export and deletion period in section 8.

Annex 2: Security measures

aldo implements technical and organizational measures appropriate to the risk, as required by Article 32 of the GDPR. These include measures to protect the confidentiality, integrity and availability of Personal Data, access to Customer Data controlled by roles and permissions, backups, and an incident response process. aldo reviews these measures periodically and may update them, provided the overall level of protection is not reduced.

Annex 3: Subprocessors

Categories of Subprocessor and their purpose:

• Hosting and cloud infrastructure. Hosting the Service in the United States.
• Database and authentication. Storing data and signing Users in.
• Email delivery. Sending invitations, notifications and other emails.
• Artificial intelligence. Providing features that use artificial intelligence.
• Screen recording. Recording issue reports, only while the person keeps the recording on.
• Analytics. Measuring usage of the Service in aggregate.