Privacy Policy
This notice explains what personal data we process in ATLAS, why we process it, who it is shared with, and the rights you have over it.
Draft — pending legal review. This document is a working draft. Passages in square brackets are placeholders that must be completed, and the text has not yet been approved by legal counsel.
1. Who is responsible for your data
[Legal entity name](“Atalora”, “we”, “us”), registered at [registered address], company number [registration number], is the data controller for the personal data described in this notice.
For any privacy question or to exercise your rights, contact us at [privacy mailbox]. [If a Data Protection Officer is appointed, add their contact details here.]
2. What ATLAS is
ATLAS is Atalora’s internal workspace. It hosts our CRM and related business applications and is available only to Atalora staff signing in with an @atalora.com Google account. It is not a public service and cannot be signed up for.
3. Whose data we process
This notice covers two groups of people:
- ATLAS users — Atalora employees and authorised collaborators who sign in to the application.
- Business contacts — people recorded in our CRM because they work for a client, prospect, supplier or subcontractor. If you are in this group you will not have an ATLAS account, and this notice is published openly so that you can still read it.
4. What data we process
For ATLAS users
- Account and profile data — name, work email address, the identifier issued by Google for your account, and the role assigned to you within ATLAS.
- Session data — authentication cookies that keep you signed in.
- Activity data — records of the entries you create or modify, together with server logs generated by our hosting and database providers (including IP address, timestamp and the page requested).
For business contacts
- Identification and contact details — name, job title, employer, email address, telephone number and, where relevant, postal address.
- Commercial relationship data — the accounts, opportunities, orders and invoices you are linked to, plus notes and correspondence recorded by our team.
We do not knowingly process any special category data (health, religion, political opinions, biometrics and similar) in ATLAS, and it should never be entered into the system.
5. Why we process it, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Giving staff access to the workspace and its applications | Contract with the employee — Art. 6(1)(b) |
| Managing client, supplier and subcontractor relationships in the CRM | Performance of a contract — Art. 6(1)(b) — or our legitimate interest in running and developing the business — Art. 6(1)(f) |
| Issuing, receiving and retaining invoices | Legal obligation (accounting and tax law) — Art. 6(1)(c) |
| Keeping the platform secure, diagnosing faults and preventing misuse | Legitimate interest — Art. 6(1)(f) |
Where we rely on legitimate interest, we have weighed that interest against your rights and freedoms, and you may object at any time (see section 10).
6. Where your data is stored
Our database and application servers are located in the European Union. Data is encrypted in transit using TLS and encrypted at rest by our database provider. Access is restricted by row-level security policies so that each user reaches only the records their role permits.
7. Who we share data with
We do not sell personal data and we do not share it for advertising. We use the following service providers, who process data on our instructions under a data processing agreement:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication and backups | European Union |
| [Hosting provider] | Application hosting and server logs | European Union |
| Sign-in with your work Google account, and delivery of the web fonts used by the interface | United States | |
| Atlassian (Jira) | Bug reports and feature requests — only when you choose to open one of the feedback forms | United States |
We may also disclose data to professional advisers, or to public authorities where the law requires it.
Web fonts
The ATLAS interface currently loads fonts from Google’s servers. When a page loads, your browser contacts Google directly and Google receives your IP address, browser identification and the address of the page you are viewing. No account or CRM data is transmitted in this request.
8. Transfers outside the EU
The providers listed above as being located in the United States may process data outside the European Economic Area. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses together with supplementary safeguards. You may request a copy of the relevant safeguards from us.
9. How long we keep it
- User accounts — for as long as you work with Atalora, and deactivated shortly after you leave.
- CRM records — for the duration of the business relationship and for [retention period] afterwards, so that we can handle queries and defend legal claims.
- Invoices and accounting records — for the period required by tax law, being [statutory period].
- Server and security logs — for [log retention period].
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and obtain a copy;
- have inaccurate or incomplete data corrected;
- have your data erased in the circumstances the law allows;
- restrict how we process your data;
- receive the data you provided in a portable, machine-readable format;
- object to processing based on our legitimate interests, including profiling.
To exercise any of these, write to [privacy mailbox]. We will respond within one month. We may ask for information to confirm your identity before we act.
If you believe we have handled your data improperly you may lodge a complaint with your national data protection authority ([supervisory authority and link]).
11. Cookies and local storage
ATLAS uses only what is strictly necessary to work. We do not use analytics, advertising or tracking cookies, and there are no third-party trackers in the application.
- Session cookies — set by our authentication provider to keep you signed in and to protect against request forgery. Without them the application cannot function.
- Local storage — a single interface preference (the width of the assistant panel), kept in your browser and never sent to us.
12. Automated decision-making
ATLAS does not make decisions producing legal or similarly significant effects about you by automated means alone.
13. Changes to this notice
We may update this notice as the platform evolves. The date at the top of the page shows when it was last revised, and we will tell users about significant changes through the application.
14. Contact
Questions about this notice or about how we handle personal data: [privacy mailbox], or write to us at [registered address].