1. Parties, roles, and precedence
This draft Data Processing Agreement is intended to supplement a finalized Atomic service agreement when the provider processes personal data on a customer’s behalf. The customer acts as controller or as a processor authorized by its controller; the provider acts as processor or subprocessor respectively.
The provider’s own account, billing, and business-contact processing is separately described in its Privacy Notice. This DPA should prevail for conflicts concerning the processing it covers; mandatory transfer clauses take precedence where required.
To finalize: identify both legal parties, the underlying agreement, applicable data-protection laws, and the acceptance or signature mechanism. This draft is not an executed DPA.
2. Documented instructions
The provider shall process customer personal data only on documented instructions to provide the agreed service, including instructions about international transfers, unless applicable law requires otherwise. Where legally permitted, it shall inform the customer of a mandatory processing requirement before processing.
The provider shall promptly inform the customer if, in its opinion, an instruction infringes applicable data-protection law. The customer is responsible for lawful instructions, required notices, and a valid basis for providing the personal data.
3. Confidentiality and security
The provider shall ensure that persons authorized to process personal data are subject to appropriate confidentiality obligations and receive access only as needed for their duties.
The provider shall implement appropriate technical and organizational measures proportionate to the processing risks. The completed security annex must describe actual safeguards, including access controls, encryption where appropriate, tenant separation, vulnerability management, recovery, and review of security effectiveness.
To finalize: complete Annex B with verified measures and operational owners. This draft does not certify that a particular control is currently implemented.
4. Subprocessors
The proposed arrangement is general written authorization for the specifically disclosed subprocessors in the completed register, with advance written notice of additions or replacements and a meaningful opportunity for the customer to object on data-protection grounds.
The provider shall impose equivalent applicable data-protection obligations on subprocessors and remain responsible to the customer for their performance as required by law.
To finalize: the initial approved list, notice period, notification channel, objection process, and resolution or termination rights. No unidentified vendor is approved by this draft.
5. Assistance and rights requests
Taking account of the nature of processing and information available, the provider shall assist the customer with data-subject requests, security obligations, breach notifications, impact assessments, and prior consultation with authorities where required.
The provider shall notify the customer of relevant requests received directly and shall not respond on the customer’s behalf except as instructed or required by law. Any fees for assistance beyond the agreed service must be specified in the final agreement and must not prevent compliance with mandatory obligations.
6. Personal-data breaches
The provider shall notify the customer without undue delay after becoming aware of a personal-data breach affecting the covered data. Notification shall include available information about its nature, affected categories and approximate scale, likely consequences, mitigation, and a contact point.
Information may be provided in phases as it becomes available. The provider shall cooperate in investigation, containment, and remediation. The customer remains responsible for controller notifications to authorities and individuals unless otherwise required by law.
To finalize: incident contacts, secure notification channel, escalation process, and any shorter contractual notification target.
7. International transfers
The provider shall not transfer covered data in violation of applicable transfer rules. Required safeguards must be identified and completed before the transfer, including the appropriate module and annexes of Standard Contractual Clauses or other applicable mechanisms where needed.
To finalize: actual locations, remote-access locations, transfer mechanism, assessments and supplementary measures, and any UK or Swiss adaptations. Merely linking to standard clauses does not complete their incorporation.
8. Return and deletion
At the customer’s choice at the end of the processing service, the provider shall return or delete covered personal data and delete existing copies unless law requires retention. Any lawfully retained information remains protected and restricted to the required purpose.
To finalize: supported return format, export window, live-data deletion deadline, backup deletion schedule, and confirmation process. A source-code download is not a return of all customer personal data.
9. Demonstrating compliance
The provider shall make available information necessary to demonstrate compliance with its applicable processor obligations and allow and contribute to appropriate audits and inspections by the customer or an authorized auditor.
Reasonable confidentiality, security, notice, and scheduling arrangements may apply, but must not defeat statutory rights or urgent regulatory requirements. The final agreement must define an operational process for these requests.
Annex A · Processing details
Subject matter: the agreed Atomic app-building, preview, publishing, and hosting services, limited to the features actually contracted.
Nature and purpose: receipt, storage, organization, retrieval, transmission, and deletion of customer-directed data to provide those services, as applicable.
To finalize: duration; customer instructions; actual service scope; categories of data subjects and personal data; frequency of transfers; retention; authorized contacts; and any expressly permitted sensitive data with additional safeguards. Typical possibilities such as app users or booking records are not a substitute for a completed customer-specific description.
Annex B · Security measures
To finalize before execution: document and verify identity and access management, privileged access, transport and storage protection, isolation, logging, vulnerability handling, incident response, backup and recovery, deletion, personnel confidentiality, and security review practices. Record the applicable deployment and any customer configuration responsibilities.
Annex C · Subprocessors and transfers
Complete the subprocessor register with provider legal names, functions, processing locations, data categories, and transfer mechanisms. Attach any required transfer clauses with populated annexes. The current register is a review worksheet, not an approved production vendor list.