Data Processing Agreement (DPA)

Version 2026-07-17. This agreement forms part of the Terms of Service and applies to all processing where the customer is the controller and Atlas Holly the processor.

1. Roles and subject matter

The customer is the controller for the personal data processed inside the customer's website and tools - typically end customers' names, contact details, bookings, messages and reviews. Atlas Holly processes this data as processor, solely to provide the service under the Terms of Service.

2. Instructions

We process the data only on the customer's documented instructions, the Terms of Service and the customer's use of the service's features constituting those instructions. If we consider an instruction to violate data protection law, we inform the customer without delay.

3. Confidentiality

Only authorised personnel under confidentiality obligations have access to customer data. Support access to the customer's administration interface is time-limited and logged visibly to the customer.

4. Security measures

• All traffic is encrypted (TLS); storage is within the EU (AWS eu-north-1, Stockholm).
• Role-based access control, two-factor authentication and full event logging.
• Daily encrypted backups with automated restore verification, pruned after 35 days.
• Abuse and intrusion protection, suppression lists and continuous error monitoring.

5. Subprocessors

The customer approves the following subprocessors. We give at least 30 days' notice of changes or additions; the customer may object and is then entitled to terminate the service.

6. Assistance to the controller

We assist the customer with data subjects' rights (the service includes self-service export and deletion), with impact assessments and with prior consultations, to the extent reasonable given the nature of the processing.

7. Personal data breaches

We notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with the information needed for the customer's own notification obligations.

8. Third-country transfers

Normal processing takes place within the EU. Should a third-country transfer be required, it is carried out under a valid transfer mechanism, primarily the EU Commission's standard contractual clauses.

9. Deletion and return

On termination the customer's personal data is deleted. The customer may export their data via the service beforehand. Data in backups expires through the ordinary pruning cycle (35 days). Invoice records we must keep by law are archived in de-identified form.

10. Audits

On request we provide the information reasonably necessary to demonstrate compliance with this agreement, and enable audits to the extent required by data protection law.

11. Duration

This agreement applies for as long as we process personal data on the customer's behalf.