Atlas Intel Data Processing Addendum

Effective date: October 29, 2026

This Data Processing Addendum (the "DPA") is part of the Atlas Intel Terms of Service (the "Terms") between Atlas Sales AI LLC ("Atlas") and Customer. Capitalized terms not defined here have the meaning in the Terms.

1. Definitions

• "Data Protection Laws" means all United States privacy and data security laws that apply to the processing of Personal Information under the Terms, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (together, "CCPA"), and comparable state laws such as those of Colorado, Connecticut, Virginia, Utah, Texas, and Oregon.
• "Personal Information" means any information in Customer Data that identifies, relates to, or could reasonably be linked to an individual, and that is protected under Data Protection Laws.
• "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information that Atlas processes.
• "Subprocessor" means a third party Atlas engages to process Personal Information on Customer's behalf.
• "Business," "service provider," "processor," "controller," "sell," "share," and "consumer" have the meanings given in the Data Protection Laws.

2. Roles

2.1 For Personal Information in Customer Data, Customer is the business or controller and Atlas is the service provider or processor.

2.2 For information about Customer's account contacts that Atlas uses to run its own business, such as billing and account communications, Atlas acts as a business. The Atlas Privacy Policy covers that information, not this DPA.

2.3 Connected Sources that Customer chooses and contracts with directly, such as Customer's call recorder, CRM, or payment processor, are Customer's own vendors and not Atlas Subprocessors.

3. Processing Instructions

3.1 Atlas will process Personal Information only on Customer's documented instructions. The Terms, this DPA, and Customer's configuration of the Service are Customer's complete instructions. Annex A describes the processing.

3.2 Atlas will tell Customer if it believes an instruction violates Data Protection Laws, and may decline to follow it.

3.3 Customer is responsible for having a lawful basis for the processing and for giving every notice and getting every consent that Data Protection Laws and recording laws require, including as set out in the Call Recording and Consent Addendum.

4. CCPA Service Provider Terms

Atlas will not:

(a) sell or share Personal Information;

(b) retain, use, or disclose Personal Information for any purpose other than the business purposes specified in the Terms, including for any commercial purpose other than providing the Service;

(c) retain, use, or disclose Personal Information outside the direct business relationship between Atlas and Customer;

(d) combine Personal Information received from Customer with personal information Atlas receives from or on behalf of any other person, or collects from its own interactions with consumers, except as the CCPA permits a service provider to do;

(e) use Personal Information to train artificial intelligence models, except after it has been converted to De-identified Data as described in Section 4A; or

(f) sell, rent, lease, license, or otherwise monetize Customer Data or any data derived from it, including in aggregated or de-identified form, or use it for advertising, profiling, or marketing to anyone.

Atlas will comply with the CCPA's obligations that apply to service providers, give Personal Information the level of protection the CCPA requires, and notify Customer if it determines it can no longer meet its obligations. Customer may take reasonable steps to stop and remediate unauthorized use of Personal Information. Atlas certifies that it understands and will comply with these restrictions.

4A. De-identified Data

4A.1 Customer authorizes Atlas to de-identify Personal Information, so that it is "deidentified" within the meaning of the CCPA and comparable Data Protection Laws, and to use the resulting De-identified Data (as defined in the Terms) only to develop, train, test, and improve the Service.

4A.2 Atlas will (a) take reasonable measures to ensure De-identified Data cannot be associated with Customer, its Users, or any individual; (b) publicly commit to keep it in de-identified form and not to re-identify it or attempt to; (c) contractually require any Subprocessor that receives it to do the same; and (d) never sell, license, or disclose it to any third party, or use it for advertising.

4A.3 De-identified Data is not Personal Information or Customer Data. Section 10 deletion does not apply to it.

5. Atlas Personnel

Atlas will limit access to Personal Information to personnel and contractors who need it to provide the Service, who are bound by written confidentiality obligations, and who are trained on their data protection responsibilities. Atlas will remove access promptly when it is no longer needed.

5A. Government and Third-Party Requests

If a government authority or other third party asks Atlas for Customer Data, Atlas will redirect the request to Customer where possible. If Atlas is legally compelled to disclose, it will notify Customer first, unless the law forbids it, and will disclose only the minimum required. Atlas will challenge requests it reasonably believes are unlawful.

6. Security

6.1 Atlas will maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of the Personal Information, including the measures in Annex B.

6.2 Customer is responsible for the security of its own systems, Connected Sources, User credentials, and the seat permissions it assigns.

7. Subprocessors

7.1 General authorization. Customer authorizes Atlas to use Subprocessors in the categories listed in Annex C. Atlas will give Customer the current list of named Subprocessors on request.

7.2 Obligations. Atlas will have a written agreement with each Subprocessor that requires it to protect Personal Information at least as well as this DPA requires. Where a Subprocessor offers an option to exclude customer data from its own model training, Atlas will use it. Atlas remains responsible for its Subprocessors' performance.

7.3 Changes. Atlas will give Customer at least 30 days' notice by email before adding or replacing a Subprocessor. Customer may object in writing on reasonable data protection grounds within that period. The parties will try to resolve the objection in good faith. If they cannot, Customer may cancel the affected Service and receive a refund of any prepaid fees for the period after cancellation.

8. Security Incidents

8.1 Atlas will notify Customer without undue delay, and in any event within 72 hours, after confirming a Security Incident affecting Customer's Personal Information.

8.2 The notice will describe, as far as then known, the nature of the incident, the categories and approximate number of individuals and records affected, likely consequences, and steps taken or proposed. Atlas will update Customer as more becomes known.

8.3 Atlas will take reasonable steps to contain and remediate the incident and will reasonably assist Customer in meeting any legal obligation to notify regulators or individuals. Customer decides whether and how to notify affected individuals, except where the law requires Atlas to notify directly.

8.4 Notice of a Security Incident is not an admission of fault or liability.

9. Assistance with Requests

9.1 If Atlas receives a request from an individual to exercise privacy rights over Customer's Personal Information, Atlas will forward it to Customer and will not respond except to direct the individual to Customer, unless the law requires otherwise.

9.2 Atlas will provide reasonable assistance, taking into account the nature of the processing, so that Customer can respond to requests to access, correct, delete, or limit Personal Information, including by deleting a specific call, transcript, or person from Customer's account on request.

9.3 Atlas will provide reasonable information Customer needs to complete a risk assessment or impact assessment that Data Protection Laws require.

10. Retention, Return, and Deletion

10.1 During the subscription, Customer Data is retained while Customer's account is active, unless Customer deletes it sooner or sets a shorter retention period with Atlas.

10.2 For 30 days after the subscription ends, Customer may request an export of Customer Data.

10.3 Within 90 days after the subscription ends, Atlas will delete Customer Data from its active systems. Copies in backups will be deleted as the backups expire in their normal rotation. Until deleted, backups remain protected under this DPA.

10.4 Atlas may keep Personal Information longer only where the law requires, and then only for that purpose.

11. Audits

11.1 Once a year, on 30 days' written notice, Atlas will answer a reasonable written security questionnaire from Customer and provide information needed to show compliance with this DPA.

11.2 If a regulator requires it, or after a Security Incident, Customer may conduct a further review at its own cost, at a mutually agreed time, in a way that does not disrupt the Service or expose other customers' data.

12. Data Location and Transfers

Atlas processes and stores Customer Data in the United States. The Service is not designed for, and Customer will not submit, Personal Information that is subject to the EU or UK General Data Protection Regulation unless the parties first sign a supplemental agreement with appropriate transfer terms.

13. Data Not to Be Submitted

Unless the parties agree otherwise in writing, Customer will not submit to the Service: payment card data; Social Security, driver's license, or passport numbers; health information subject to HIPAA; financial account credentials; or data about children under 16.

14. General

This DPA lasts as long as Atlas processes Personal Information for Customer. The liability limits in the Terms apply to this DPA. If this DPA conflicts with the Terms on the processing of Personal Information, this DPA controls.

Annex A. Description of Processing

Annex B. Security Measures

1. Customer isolation. Each customer's data is separated at the database level by account, enforced by row-level security policies. Credentials for each customer's Connected Sources are stored and used per account and are never shared across accounts.
2. Access control. Users see only the data their assigned role and account allow. Atlas staff access to Customer Data is limited to what is needed to operate and support the Service.
3. Encryption. Data is encrypted in transit using TLS. Data is encrypted at rest by Atlas's hosting providers. Connected Source credentials are stored encrypted.
4. Payment card redaction. Transcripts and stored text are scanned for payment card numbers, which are redacted before storage, display, or automated scoring.
5. Least data. Where a Connected Source can provide a link to a recording instead of the recording itself, Atlas stores the link. Access to such links remains controlled by the Connected Source.
6. Monitoring and tamper evidence. Automated jobs are monitored, and failures alert Atlas. Sensitive actions are written to an audit log protected by a hash chain and checked nightly against a record held outside the database, so edits or deletions of the log are detected.
7. Change control. Changes to the Service go through code review and testing, including automated tests of the access rules, before release.

Annex C. Subprocessor Categories

The current named list is available to Customer on request at legal@atlassales.io.