Data processing agreement

The controller is the rental company that uses Mellow, called “you” or “the rental”.

The processor is Strange Solutions ehf., kennitala 690822-0570, Holtsvegur 6, 210 Garðabær, Iceland, called “we” or “Mellow”.

This agreement is part of the terms of service. You accept it when you accept the terms. When this agreement and the terms differ about personal data, this agreement wins.

We process personal data for you only to give you Mellow, as the terms describe.

This agreement lasts as long as we process personal data for you: the subscription, then the 30 days for your export, then the deletion in section 12.

We process the personal data only on your documented instructions. The terms, this agreement, the settings you choose in Mellow and the actions your staff take in Mellow are your instructions.

We also process it where EU or Icelandic law requires it. Then we tell you first, unless that law forbids it.

If we think an instruction breaks the GDPR or other data protection law, we tell you at once.

Everyone at Mellow who can reach the personal data has agreed to keep it secret, or has a legal duty to do so.

Our staff open your rental only to give support or to fix a fault. They are asked for a reason, and Mellow logs each visit.

We protect the personal data with technical and organisational measures that fit the risk, as article 32 of the GDPR requires. Today they include:

• Mellow's database and files are stored in the EU, with Cloudflare. Data travels only over encrypted connections.
• Each rental sees only its own data. An automated test makes sure that every query in the code fetches only its own rental's data.
• Staff roles limit what each person can see and do.
• Two-step sign-in, which you can require of all your staff, and limits on sign-in attempts.
• Cloudflare Turnstile checks sign-in and public forms for bots.
• Keys you save for your own providers, such as your payment provider, are encrypted with AES-GCM. API keys are stored only as hashes.
• Card numbers never reach Mellow.
• Licence photos are deleted 90 days after the booking ends, and Mellow logs each staff view of one.
• Automated checks run on every change, and a security check runs every week.

We can change these measures, but never to a lower level of protection.

You give us general written authorisation to use sub-processors. The privacy policy lists each one, what it does, the data it receives and where it is.

Before we add or replace a sub-processor, we email the account owner and update the list, at least 30 days before the change.

An add-on can need a sub-processor of its own, such as Stefna ehf. for Rental Relay. When the order form names that sub-processor, you approve it when you order the add-on, and the 30-day notice does not apply. It processes data only for the rentals that ordered the add-on.

You can object on reasonable data protection grounds within those 30 days. Then we try to find a fix with you. If we find none, you can end the subscription before the change takes effect.

Each sub-processor has a written contract with us that gives it the same data protection duties as this agreement. We stay liable to you for its work.

A service that you connect with your own account, such as your payment provider, WhatsApp or Keycafe, is not our sub-processor. You have your own agreement with it, and we send it data on your instructions.

Some sub-processors store or process data outside the EEA. Each transfer rests on an EU adequacy decision, the EU-US Data Privacy Framework, or the EU Standard Contractual Clauses. The privacy policy names the basis for each one.

Your customers send requests about their data to you. If one comes to us, we pass it to you and do not answer it ourselves, unless you ask us to.

Mellow has tools for the usual requests. You can export one customer's data, correct it, and anonymise the customer. Anonymising removes the names, contacts, ID number, date of birth, messages and files. It keeps the booking and payment rows that bookkeeping law requires.

If the tools are not enough, we help you answer within the time limits of the GDPR.

We help you with security (article 32), breach notices (articles 33 and 34), impact assessments (article 35) and consultation with Persónuvernd (article 36), as far as the information we hold allows.

This help is free when it uses Mellow's own tools or takes normal effort. Help that takes much more work costs a price we agree with you before we start.

If a breach affects personal data we process for you, we email the account owner without undue delay, and at most 48 hours after we learn of it. You then have time to tell Persónuvernd within 72 hours, where the law requires it.

We tell you what we know: what happened, which data and how many people it affects, the likely result, and what we do about it. We send more as we learn more.

We act at once to stop the breach and to limit its harm.

When the subscription ends, you have 30 days to export your data. Then we delete the personal data we process for you, unless EU or Icelandic law requires us to keep it.

Copies in the database's restore history are gone after 30 more days.

On request, we confirm the deletion in writing.

We give you the information you need to show that we keep this agreement. Ask at privacy@mellow.is.

If that information is not enough, you can audit us once a year, and again after a breach. Give us 30 days' notice, use an auditor who is bound to keep secrets, and pay the cost. The audit must not reach other rentals' data, or disturb Mellow more than it needs to.

Liability under this agreement follows the terms of service, with their limits, as far as the GDPR allows. The limits do not change what a data subject can claim under article 82 of the GDPR.

Icelandic law governs this agreement. Héraðsdómur Reykjavíkur (the Reykjavík District Court) hears any dispute about it.

This agreement exists only in English. The English text is the binding one, also when someone translates it.

• Personal data and this agreement: privacy@mellow.is
• Post: Strange Solutions ehf., Holtsvegur 6, 210 Garðabær, Iceland