Definitions
This Data Processing Addendum applies when Atlas HR processes personal data on behalf of a Team or Enterprise customer. Controller, Processor, Personal Data, Data Subject, Processing, Subprocessor, and Supervisory Authority have the meanings given under applicable data protection law, including GDPR where applicable.
Subject Matter and Duration
Atlas HR processes customer personal data to provide HR workspace, document, Copilot, Mini-HRIS, community, billing, support, and related services. Processing lasts for the subscription term and any retention period required by law or agreed deletion workflow.
Nature and Purpose of Processing
Processing includes hosting, storing, transmitting, organising, retrieving, generating, analysing, securing, backing up, deleting, and supporting customer data. The purpose is to provide Atlas HR under the customer's instructions.
Data Subjects
Data subjects may include customer administrators, employees, candidates, contractors, community users, invited teammates, HR contacts, and support contacts.
Categories of Personal Data
Personal data may include names, emails, job titles, departments, countries, salaries, leave records, performance notes, onboarding records, policy acknowledgements, generated documents, support communications, usage logs, and account metadata.
Atlas HR Obligations as Processor
Atlas HR will process personal data only on documented instructions, ensure confidentiality, implement reasonable security measures, assist with data subject requests where possible, support breach notification duties, maintain relevant records, and delete or return customer personal data at the end of services subject to legal retention.
Customer Obligations as Controller
The customer is responsible for lawful basis, employee notices, data accuracy, role permissions, instructions, compliance decisions, and ensuring that data uploaded to Atlas HR may lawfully be processed.
Security Measures
Atlas HR security measures include TLS, infrastructure encryption at rest where available, access controls, RBAC, service-role separation, webhook signing, audit-oriented logging, restricted production access, dependency updates, incident response processes, and periodic security review.
Subprocessors
Atlas HR may use a limited set of subprocessors for managed hosting, authentication, storage, payments, tax, transactional email, AI processing, analytics where enabled, error monitoring, and operational support. The current provider register, locations, and processing details are available to customers on request under a DPA or appropriate procurement review.
International Transfers
Where customer personal data is transferred internationally, Atlas HR will rely on appropriate transfer mechanisms such as Standard Contractual Clauses, adequacy decisions, or other safeguards required by applicable law.
Audits and Inspections
Upon reasonable written request, Atlas HR will provide information necessary to demonstrate compliance. Audits must be scoped, scheduled, confidential, and avoid compromising other customers or platform security.
Liability
Liability under this DPA is subject to the limits in the Terms of Service unless applicable law requires otherwise.
Term and Termination
This DPA remains in effect while Atlas HR processes customer personal data. Upon termination, Atlas HR will delete or return personal data according to product capabilities, retention obligations, and backup lifecycle.
Annex I: Description of Processing
Atlas HR processes HR operations data to generate documents, manage team HR records, support AI-assisted workflows, deliver notifications, and operate subscription services.
Annex II: Technical and Organisational Measures
Measures include encryption in transit, managed infrastructure controls, least-privilege access, authentication, role-based permissions, logging, backup practices, secure secret handling, incident response, and vendor review.
Annex III: List of Subprocessors
The current subprocessor register is available to customers on request. Atlas HR does not publish exact provider names publicly, but will disclose relevant provider, purpose, location, and transfer information during customer procurement or DPA review.