Data Processing Addendum

Customer means the client contracting with Atlas for the Services.

Personal Data means any information relating to an identified or identifiable natural person processed by Atlas on behalf of the Customer.

Processor means Atlas Contractor Systems acting on the Customer's documented instructions.

Subprocessor means a third-party engaged by Atlas to assist in processing Personal Data.

This Data Processing Addendum ("DPA") applies to Atlas's processing of Personal Data on behalf of the Customer in connection with the Services.

Where a conflict arises, this DPA controls conflicting personal-data processing terms over the main Terms of Service.

The Customer is the controller or business. Atlas is the processor or service provider.

Atlas processes Personal Data only on the Customer's documented instructions, including with regard to transfers of Personal Data to a third country, unless required by law.

The subject matter of processing is the Personal Data uploaded by the Customer to the Platform.

The duration of processing is the term of the Customer's active Subscription, plus any retention period required by law or described in this DPA.

The nature and purpose of processing is to provide the Services, including website hosting, CRM, communications, automations, and related tools.

Categories of Personal Data include identifiers (name, email, phone number), commercial information, and inferences drawn by the Customer's use of the Platform.

Categories of data subjects include the Customer's leads, prospects, and customers.

Atlas ensures that personnel authorized to process Personal Data are subject to confidentiality obligations.

Atlas implements appropriate technical and organizational measures to protect Personal Data, including access controls, encryption in transit, and least-privilege access. Details are described in the Security Measures Schedule below.

Atlas assists the Customer in fulfilling access, correction, deletion, and portability requests where applicable, taking into account the information available to Atlas.

Atlas will notify the Customer of a confirmed personal-data breach affecting Customer data without undue delay after Atlas becomes aware of it.

Atlas cooperates with legally required data-protection assessments and consultations, taking into account the nature of the processing and the information available to Atlas.

Atlas authorizes subprocessors only under written contracts that require protection no less protective than this DPA. The current subprocessors are described in the Subprocessor Schedule below.

Atlas will provide reasonable notice of subprocessor changes. The Customer may object to a new subprocessor on reasonable grounds, in which case Atlas may address the objection or, if it cannot, the Customer may terminate the affected Services.

Atlas operates from Canada and uses service providers that may process data in the United States. Cross-border transfers are subject to the protections in our provider agreements.

If Atlas receives a government or legal request for Customer Personal Data, Atlas will notify the Customer where legally permitted and will not disclose more than is legally required.

On termination of the Services, Atlas will return or delete Personal Data at the Customer's choice, subject to legal retention obligations and routine backups that are overwritten in the ordinary course.

The Customer has a reasonable right to information and audit assistance to verify Atlas's compliance with this DPA, provided that the audit protects other customers' data and Platform security. The Customer may use a qualified third-party auditor under a confidentiality obligation.

Atlas's liability under this DPA is subject to the limitation of liability provisions in the Terms of Service.

The confidentiality, security, and audit provisions survive termination of this DPA for so long as Atlas retains Personal Data.

For DPA questions, contact support@atlascontractorsystems.com.

Subject matter: Personal Data uploaded by the Customer to the Platform.

Duration: The active Subscription term plus any legal retention period.

Nature and purpose: Providing the Services.

Personal Data categories: Identifiers, commercial information, inferences.

Data subjects: The Customer's leads, prospects, and customers.

Access controls and least-privilege access to Personal Data.

Encryption of Personal Data in transit.

Confidentiality obligations for authorized personnel.

Regular review of access permissions.

Platform, phone, and SMS delivery: our platform provider.

Payments: Stripe.

Email: Google.

Demo and support calls: Zoom.

A current list of subprocessors is available on request. If the subprocessor chain cannot be verified for a particular service, Atlas will disclose that rather than making assumptions.