Data Processing Agreement

Effective 22 July 2026

This data processing agreement (per Art. 28 GDPR and Icelandic Act No. 90/2018) forms part of the Fivesay terms of service and applies automatically to all registered customers. It is published openly — nobody has to ask for it.

1. Parties and scope

This agreement is between the customer (the company of a registered user) as controller and Nómi ehf., Reykjavík, as processor. It covers the processing of personal data that Nómi ehf. performs on the customer's behalf when using Fivesay — primarily storing mailing lists and delivering surveys to staff.

Anonymous survey answers fall outside this agreement: they contain no personal identifiers and do not constitute personal data once submitted.

2. Details of the processing

Item	Description
Purpose	Delivering pulse surveys to the customer's staff and managing mailing lists
Nature of processing	Storage, email delivery, deletion
Categories of data	Staff work email addresses (on the same domain as the customer's account)
Data subjects	The customer's employees and contractors
Duration	For the duration of the customer relationship, see section 7

3. Processor obligations

Nómi ehf. commits to:

process personal data only on the customer's documented instructions — use of the service constitutes such instructions — and never for its own purposes,
ensure that personnel with access are bound by confidentiality,
implement appropriate technical and organizational security measures (Art. 32 GDPR), including encryption in transit and at rest, access controls and data minimization,
assist the customer in responding to data subjects exercising their rights,
notify the customer without undue delay of any personal data breach affecting the processing,
make available the information reasonably necessary to demonstrate compliance with Art. 28 GDPR and allow audits on reasonable notice,
delete or return personal data at the end of the service, see section 7.

4. Subprocessors

The customer grants general authorization for the following subprocessors:

Provider	Role	Location
Neon Inc.	Database	EU
Vercel Inc.	Hosting and runtime	Compute in the EU; global CDN
Resend Inc.	Email delivery	United States

Changes to this list will be announced to registered users with reasonable notice so that objections can be raised. Subprocessors are bound by obligations equivalent to those set out here.

5. Transfers outside the EEA

The service's database is located in the EU. Where processing occurs in the United States (email delivery, parts of hosting), transfers rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses (SCCs).

6. Customer responsibilities

The customer warrants that it has a lawful basis for processing its staff's email addresses, that it informs staff about surveys in line with Arts. 13–14 GDPR, and that it uses the service in accordance with the terms of service.

7. Deletion at end of service

Upon deletion of a mailing list or account, or at the end of the customer relationship, Nómi ehf. deletes the personal data processed on the customer's behalf without undue delay, unless law requires continued retention. Anonymous aggregate answers, which contain no personal identifiers, may persist.

8. Term and precedence

This agreement applies for as long as Nómi ehf. processes personal data on the customer's behalf. In case of conflict with the terms of service, this agreement prevails with respect to the processing of personal data. It is governed by Icelandic law.