Data processing
These terms apply when an agency or other customer puts personal data of third parties into Atlas, for example client brand data and leads. They are a draft of a data processing agreement under Article 28 GDPR. They become binding when the customer accepts them or signs a copy.
1. Parties and roles
The customer (the agency) is the controller of the personal data in the workspaces it manages, including client brand workspaces. Promi New Face UG (haftungsbeschränkt) ("Atlas") is the processor. Where Atlas processes its own account and billing data, it is a controller. That is covered by the privacy page.
2. Subject matter and duration
Atlas provides the content dashboard described in the terms. This agreement runs as long as the customer's subscription and for the deletion period afterwards.
3. Data and people covered
- Types of data: names, emails, social handles and messages of leads and audience; brand content; analytics from connected accounts; team and client user accounts.
- People: the customer's team members, the customer's clients and their staff, leads and audience members.
Purpose: to run Atlas for the customer. Atlas processes the data only on the customer's documented instructions, which are these terms and the customer's use of the app. Atlas tells the customer if it thinks an instruction breaks the law.
4. Atlas obligations
- Staff with access are bound to confidentiality.
- Technical and organisational measures: encryption in transit, AES-256-GCM encryption of stored API keys, workspace separation at the database level, role-based access, access limited to what is needed. A fuller list is available on request by email to prominewface@gmail.com.
- Atlas helps the customer answer data subject requests, and with security, breach notification and impact assessments, as far as reasonable.
- Atlas tells the customer without undue delay after it learns of a personal data breach that affects the customer's data.
- On request, Atlas gives the customer the information needed to show compliance and allows audits. Audits are agreed in advance, limited in scope and run in a way that does not harm other customers.
5. Sub-processors
The customer agrees to the sub-processors listed on the privacy page: Supabase (Ireland), Vercel (Dublin), AWS (Frankfurt), Resend, Mollie and the AI and data providers in use (Anthropic, OpenAI, Apify, Zernio, Sandcastles, Notion if connected). Atlas requires each of them to protect the data on terms comparable to these. Atlas tells the customer before it adds or replaces a sub-processor. The customer may object on reasonable grounds within 14 days.
Providers that the customer connects with its own key are chosen by the customer. The customer has its own agreement with them.
6. International transfers
Primary storage is in the EU (Ireland and Frankfurt). Where a sub-processor transfers data outside the EEA, it relies on the EU-US Data Privacy Framework or Standard Contractual Clauses.
7. Deletion and return
When the agreement ends, Atlas deletes the customer's data, or returns an export first if the customer asks, within 30 days, unless the law requires storage.
8. Customer obligations
The customer is responsible for having a legal basis to put the data into Atlas, for informing the people concerned, and for the agreements with its own clients. For client brands, the agency must have a processing agreement with each client that covers Atlas as a sub-processor.
9. Liability and law
Liability follows the terms. German law applies.
10. Contact
Questions or a signed copy: prominewface@gmail.com.