Introduction

This statement summarises the personal information we collect and how we use it.
It distinguishes between:

·       Personal information we collect for our own purposes (Atamis acts as Data Controller).

·       Personal information we receive and process on behalf of customers (Atamis acts as Data Processor).

If you are not a current customer or user of our services, the Controller section will be most relevant.
If you are a customer—or wish to understand how we handle customer data—please review the Processor section.

Definition of Personal Data

Personal data is information relating to an identified or identifiable individual.
Information that directly identifies someone (e.g. name) or could indirectly identify them (e.g. unique ID linked to another dataset) is personal data.

Where this policy applies

This policy applies to:

·       Information you provide via our website, an Atamis system, email, phone or in person.

·       Personal data we receive from customers or partners while delivering our services.

It does not apply to processing activities of other organisations, even if we reference them.

Information Where we are the Controller

Where Atamis gathers information for its own business purposes, it is defined as the Controller of that data. Data controllers are responsible for ensuring that they gather, hold, and process data in a responsible manner, in line with legal requirements. This section describes how we treat such data, and what rights you have if we control your data.

Types of Information We Collect

Atamis collects a number of types of personal information under certain circumstances. These include:

• Usage data from the Atamis website (via Google Analytics).
• Information you provide directly to us (any medium).
• Records of communications between you and Atamis.
• Information from third parties (e.g. customers, partners).

How We Use this Information

Atamis may use your information for the following purposes:

• Store it securely on the Salesforce platform hosting Atamis business functions.
• Generate website-usage metrics.
• Grant access to content and documentation.
• Send you relevant content (with your consent).
• Contact you about our services (with your consent).
• Organise events and manage attendee lists.
• Control access to Atamis systems and protect stored data.
• Produce internal marketing statistics.

Disclosure of Your Data to Third Parties

Atamis will only disclose your information to third parties under specific circumstances. These are:

• Where required by law.
• To trusted partners acting under this policy and the law.
• Never for third-party direct marketing.

Retention Schedule

The length of time for which data is retained depends upon the type of information:

Type of Personal Data	Retained Until
Prospective-customer contact details	2 years after last successful contact or immediately upon confirmation that details are out of date
Active/former-customer contact details	5 years after last successful contact or immediately upon confirmation that details are out of date
Primary contact for Atamis trial systems	2 years after last successful contact or immediately upon confirmation that details are out of date
‘Do not Contact’ requests	All data except the email address/phone number is deleted when the request is actioned. The email/phone number is retained indefinitely to honour the request.
Job Applications & CVs	2 years after receipt. Personal information of successful candidates is handled as per Atamis Information Security Policy.

Your Rights

You may:

• Request correction or deletion of incorrect, incomplete or outdated information.
• Request a copy of all information we hold about you.
• Request deletion or restriction of processing (subject to legal grounds).
• Control how we contact you.
  • If you ask us not to contact you, we will keep only the minimal details required to honour that wish.

Use the Contact Details section to exercise these rights.

Information Where We Are the Processor

Types of Information We Receive:

• Personal data provided by customers.
• Personal data contained within customer-supplied datasets.
• Communications with users of Atamis Services and Systems.
• Information you provide via online forms or registrations.
• System-usage data.

(See Appendix 1 for typical data categories.)

How We Use and/or Process this Information

We may:

• Generate system-usage data statistics
• Control access to Atamis Systems and safeguard stored data
• Deliver services, data products, and analysis in line with the customer contract
• Contact you on the customer’s behalf as contractually agreed

Disclosure of personal information to third parties

We disclose personal data only:

• Under the customer’s written instruction (they are the Data Controller).
  • We will advise the customer if an instruction risks breaching law or contract.
• Where legally required.
• To Salesforce Inc. (data storage on the Force.com platform) in line with Atamis Standard Terms & Conditions.
• Where strictly necessary to fulfil contracted services (e.g. supplier research supporting customer deliverables).

Retention Schedule

• Customer data is stored only for the duration agreed with the customer and deleted within one month of contract end, unless otherwise agreed.
• Contact information for former customers is retained solely for audit/accountability—not for marketing.

Your Rights

Data subjects may:

• Ask us to transfer their personal data to another organisation (where feasible).
• Request correction, deletion or a copy of personal data we hold.

Because Atamis acts as Processor, we may need to consult the customer (Controller) before responding.
Requests may therefore be answered by the customer in accordance with their remit.

General Enquiries

Email:info@atamis.co.uk
Telephone:+44(0)2922809277
Address: Southgate House, Wood Street, Cardiff, CF10 1EW

Data Protection Officer (DPO)

Email:mark.corbisiero@atamis.co.uk
Telephone: +44 (0) 7897921622

Complaints

If you believe we have mishandled your personal data:

1.        Please contact our DPO in the first instance.

2.        You may also lodge a complaint with the UK Information Commissioner’s Office (ICO).