Data Processing Agreement

Effective date: 2026-10-16 · Version 1.0

This DPA applies where Atlasia processes personal data on a customer's behalf. For enterprise customers who need a countersigned copy, contact legal@atlasia.us.

This DPA forms part of the Terms of Service between Atlasia SAS ("Atlasia", the "Processor") and the Customer (the "Controller"), and applies where Atlasia processes personal data on the Controller's behalf. It implements Article 28 GDPR. If it conflicts with the Terms on data protection, this DPA prevails.

1. Roles and scope

For Customer Content containing personal data, the Controller determines the purposes and means of processing, and Atlasia acts only as Processor. Atlasia processes such personal data only to provide the Service and only on the Controller's documented instructions, including the Terms, this DPA and the Controller's use of the Service's settings and features. Atlasia will inform the Controller if, in its opinion, an instruction breaches the GDPR or other EU/Member-State data-protection law.

2. Processor obligations

Atlasia will:

1. process personal data only on the Controller's documented instructions, including for transfers, unless required by law (in which case it will inform the Controller first, unless law prohibits it);
2. ensure persons authorised to process the data are under a duty of confidentiality;
3. implement the technical and organisational security measures in Annex 2;
4. respect the sub-processor conditions in Section 3;
5. assist the Controller, taking into account the nature of processing, to respond to data-subject rights requests;
6. assist the Controller with its obligations on security, breach notification, data-protection impact assessments and prior consultation (Arts. 32–36);
7. at the Controller's choice, delete or return all personal data at the end of the services, and delete existing copies unless law requires retention (Section 7);
8. make available information needed to demonstrate compliance with Art. 28 and allow for and contribute to audits (Section 6).

3. Sub-processors

The Controller gives general authorisation for Atlasia to engage the sub-processors listed in Annex 3 to process personal data. Atlasia imposes data-protection obligations on each sub-processor equivalent to those in this DPA and remains liable for their performance. Atlasia will give the Controller advance notice of any intended addition or replacement of a sub-processor, giving the Controller a chance to object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Controller may terminate the affected Service.

4. International transfers

Where Atlasia or a sub-processor processes personal data outside the EEA, the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses (and, where relevant, supplementary measures), which the parties agree are incorporated by reference. Annex 3 identifies which sub-processors are outside the EEA and the safeguard relied on.

5. Personal data breach

Atlasia will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's personal data, and will provide the information the Controller reasonably needs to meet its own notification duties under Arts. 33–34.

6. Audits

Atlasia will make available information necessary to demonstrate compliance with this DPA and allow audits, including inspections, by the Controller or an auditor it mandates, no more than once per year except after a breach or where a supervisory authority requires it, on reasonable notice, during business hours, and subject to confidentiality. Atlasia may satisfy audit requests by providing relevant third-party certifications or reports where available.

7. Return and deletion

On termination of the Service, or earlier on the Controller's request, Atlasia will, at the Controller's choice, return or delete the personal data it processes as Processor, and delete existing copies within 30 days, unless EU/Member-State law requires continued storage. The Controller may export Customer Content during the post-termination export window set out in the Terms.

8. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms, to the extent permitted by the GDPR.

Annex 1 — Details of processing

• Subject-matter: provision of the Atlasia supply-chain ESG compliance platform.
• Duration: for the term of the Service and the deletion period in Section 7.
• Nature and purpose: hosting, storage, organisation, display, transmission, backup and AI-assisted analysis of compliance documents and related data, so that Controllers and the organisations they authorise can manage supplier ESG compliance.
• Types of personal data: names, business contact details, job titles and roles of organisation users; and any personal data contained in uploaded compliance documents (for example individuals named as signatories, contacts or responsible persons on certificates, codes of conduct, self-assessment questionnaires and declarations). The Controller must not upload special-category data unless agreed in writing.
• Categories of data subjects: the Controller's and its suppliers' personnel and representatives, and individuals named in uploaded documents.

Annex 2 — Security measures

Atlasia maintains measures appropriate to the risk, including: encryption of data in transit (TLS); access control with per-organisation isolation (multi-tenant authorisation) and role-based permissions; authenticated, access-controlled document storage served only through authorised, access-checked requests (documents are not publicly reachable); hashed passwords and protection against common web vulnerabilities (including CSRF protection and rate limiting); audit logging of security-relevant events; regular backups held in the EU; and least-privilege administrative access, reviewed periodically.

Annex 3 — Sub-processors