Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Terms”) between Atlo ApS, CVR 46356993, Copenhagen, Denmark (“Atlo”, the “Processor”) and the customer that has subscribed to the Service (the “Customer”, the “Controller”). It applies whenever Atlo processes personal data on the Customer’s behalf in providing the Service.

It is entered into to meet the requirements of Article 28(3) of Regulation (EU) 2016/679 (the “GDPR”). Where this DPA conflicts with the Terms on a data protection matter, this DPA prevails, as set out in section 19.6 of the Terms.

1. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in the GDPR. “Data Protection Law” means the GDPR, the Danish Data Protection Act (databeskyttelsesloven) and any other data protection law that applies to the processing. Capitalised terms not defined here have the meanings given in the Terms.

“Customer Personal Data” means personal data contained in Customer Data that Atlo processes on the Customer’s behalf under the Terms.

“Sub-processor” means a third party engaged by Atlo that processes Customer Personal Data.

2. Roles and scope

2.1 The Customer is the controller and Atlo is the processor of Customer Personal Data. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

2.2 This DPA does not apply where Atlo acts as controller. That includes the collection of Market Data from publicly accessible sources and the administration of the Customer’s account, which are governed by the Privacy Policy as stated in section 14 of the Terms.

2.3 The Customer is responsible for having a lawful basis for the processing it instructs, for the accuracy of the Customer Personal Data it provides and for informing data subjects where Data Protection Law requires it.

3. Instructions

3.1 Atlo processes Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers to third countries, unless required to do otherwise by EU or EU member state law. In that case Atlo will inform the Customer of the legal requirement before processing, unless the law prohibits it on important grounds of public interest.

3.2 The Terms, this DPA and the Customer’s configuration and use of the Service are the Customer’s complete instructions at the effective date. Further instructions must be in writing and consistent with the Terms.

3.3 Atlo will inform the Customer without undue delay if, in its opinion, an instruction infringes Data Protection Law. Atlo may suspend the affected processing until the instruction is confirmed or changed.

4. Confidentiality

Atlo ensures that every person authorised to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law, and processes it only as needed to provide the Service.

5. Security

5.1 Atlo implements the technical and organisational measures set out in Annex 2 to ensure a level of security appropriate to the risk, as required by Article 32 GDPR.

5.2 Atlo may update the measures as technology and risks develop, provided the overall level of security is not reduced.

6. Sub-processors

6.1 The Customer gives Atlo general written authorisation to engage Sub-processors. The Sub-processors in use at any time are listed on the Sub-processors page.

6.2 Atlo will notify the Customer by email at least 30 days before adding or replacing a Sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection in good faith, the Customer may terminate the affected part of the Service before the change takes effect and receive a pro rata refund of prepaid fees for the remaining term.

6.3 Atlo imposes on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA. Atlo remains fully liable to the Customer for the performance of each Sub-processor’s obligations.

7. Transfers outside the EU and EEA

7.1 Atlo will transfer Customer Personal Data to a country outside the EU or EEA only where the transfer complies with Chapter V of the GDPR. That means an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified recipients, or appropriate safeguards under Article 46 GDPR such as the European Commission’s Standard Contractual Clauses, supplemented by additional measures where needed.

7.2 On request, Atlo will tell the Customer which transfer mechanism applies to a given Sub-processor.

8. Assistance to the Customer

8.1 Taking into account the nature of the processing, Atlo will assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights under Chapter III of the GDPR. If a data subject contacts Atlo directly about Customer Personal Data, Atlo will refer them to the Customer and will not respond on the Customer’s behalf without instruction.

8.2 Atlo will provide reasonable assistance with the Customer’s obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to Atlo.

9. Personal data breaches

9.1 Atlo will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 The notice will, as far as then known, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Atlo will provide further information in phases as it becomes available.

9.3 Atlo will take reasonable steps to contain and remedy the breach and will cooperate with the Customer so that it can meet its own notification obligations. Notifying a breach is not an acknowledgement of fault or liability.

10. Return and deletion

10.1 On termination of the Service, the Customer may export Customer Data for 30 days, as set out in section 11.4 of the Terms.

10.2 Atlo will then delete Customer Personal Data, including existing copies, within a further 60 days, unless EU or EU member state law requires Atlo to keep it. Copies in backups are deleted on the normal backup cycle and are kept isolated and protected until then.

10.3 On request, Atlo will confirm the deletion in writing.

11. Audits and information

11.1 Atlo will make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, including this DPA, its security documentation and answers to reasonable security questionnaires.

11.2 Where that information is not enough to show compliance, the Customer may audit Atlo, by itself or through an independent auditor bound by confidentiality, no more than once in any 12-month period unless a supervisory authority requires it or a personal data breach has occurred. The Customer will give at least 30 days’ written notice, agree the scope with Atlo in advance, conduct the audit during business hours without unreasonably disrupting Atlo’s operations, and bear its own costs.

12. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in section 17 of the Terms, except where Data Protection Law does not allow liability to be limited.

13. Duration

This DPA applies for as long as Atlo processes Customer Personal Data on the Customer’s behalf, and ends automatically when all Customer Personal Data has been deleted or returned under section 10.

14. Governing law

This DPA is governed by the laws of Denmark. Disputes are subject to the jurisdiction set out in section 20 of the Terms.

15. Contact

Questions about this DPA, notices under it and requests for a countersigned copy go to hello@atlo.io.

---

Annex 1. Description of the processing

Subject matter. Provision of the Service under the Terms.

Duration. The term of the Customer’s subscription, plus the export and deletion periods in section 10.

Nature and purpose. Hosting, storing, structuring and displaying Customer Data so that the Customer can monitor its products at its Retail Partners, prepare order proposals and communicate with its Retail Partners. Providing support at the Customer’s request.

Categories of data subjects.

• The Customer’s Users.
• Contact persons at the Customer’s Retail Partners, where the Customer adds them to the Service.
• Other individuals named in Customer Data the Customer chooses to upload.

Types of personal data.

• Name, business email address, phone number, job title and employer.
• User account and log-in data, and activity logs within the Service.
• Order history and correspondence the Customer stores in the Service, insofar as it relates to an individual.

Special categories of data. None. The Customer must not upload special categories of personal data or data about criminal convictions.

Frequency. Continuous, for the duration of the subscription.

Annex 2. Technical and organisational measures

Access control.

• Access to production systems and Customer Data is limited to named Atlo staff who need it to run the Service.
• Access follows least privilege and is removed when no longer needed.
• Staff accounts are protected by multi-factor authentication where the system supports it.

Encryption.

• Data is encrypted in transit with TLS.
• Data is encrypted at rest by the hosting provider.

Separation. Each Customer’s data is logically separated from that of other customers.

Availability and resilience. Data is backed up regularly. Restores are tested periodically.

Logging and monitoring. Access to production systems is logged and monitored for unusual activity.

Development. Changes are reviewed before deployment. Production data is not used for testing unless it has been anonymised.

People. Staff are bound by confidentiality and are instructed in data protection and security.

Sub-processors. Sub-processors are selected for their security practices and bound by written data protection terms.

Incident response. Atlo maintains a procedure for detecting, assessing, containing and notifying personal data breaches, in line with section 9.