1.1 Atom9 account controller
Atom9 is controller for account creation, login, security, provider linking, service notices, direct support, and direct account relationship data.
GDPR AND DATA ROLES
Atom9 defines data roles by the actual processing context.
Atom9 can be the account provider, a workspace platform, a processor for customer data, and the login layer for customer apps. The GDPR role depends on who decides the purpose and means of the processing.
Operating principle
Atom9 applies GDPR requirements as binding operating rules: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.
GDPR 1
The same person can interact with Atom9 in more than one role.
Role chainThe role changes when the purpose changes.
Atom9 accountAtom9 is controllerLogin, security, provider linking, notices, and direct support.
Same personUses several contextsA person can be an Atom9 user, team member, and customer-app user.
Customer appCustomer is controllerService KYC, bookings, forms, eligibility, notices, and retention.
ControllerDecides purposeAtom9 for Atom9 account data. Customer for its service data.
ProcessorFollows instructionsAtom9 processes workspace and customer-app data under the configured service and DPA.
Sub-processorSupports serviceHosting, email, files, search, AI, payment, monitoring, and support providers.
Legal anchors: GDPR 1.1 to 1.4 define the roles, and GDPR 4.1 defines the data processing agreement path.
1.2 Workspace controller
The customer is controller for its workspace content, projects, contacts, files, team records, customer records, and customer service decisions. Atom9 processes that customer-controlled data to provide the service.
1.3 Customer app controller
The customer app owner is controller for its users, KYC fields, bookings, forms, service eligibility, customer notices, consent text, and retention choices.
1.4 Connected tools
Infrastructure, email, search, file storage, AI providers, analytics, payment, monitoring, and support systems act as processors or sub-processors according to configuration and contract.
GDPR 2
GDPR terms map directly to product behaviour.
2.1 Personal data
Personal data is information about an identified or identifiable person, including name, email, login events, messages, forms, bookings, files, support requests, and audit records.
2.2 Special-category and restricted data
Health, biometric, political, religious, union, sex life, sexual orientation, racial or ethnic origin, and similar protected categories are restricted processing. Atom9 requires appropriate configuration and lawful basis before this data is used.
2.3 Processing
Processing means collecting, storing, reading, changing, transmitting, deleting, exporting, generating, analysing, or otherwise using personal data.
2.4 Controller, processor, and sub-processor
A controller decides why and how personal data is processed. A processor processes personal data for the controller under documented instructions. A sub-processor is a provider used by a processor.
GDPR 3
Atom9 records and separates the lawful basis for different processing purposes.
3.1 Contract
Atom9 uses contract as a legal basis for account access, workspace service delivery, billing, support, project work, and customer commitments.
3.2 Legitimate interests
Atom9 uses legitimate interests for security, fraud prevention, abuse prevention, service reliability, audit trails, internal administration, and product safety where rights and freedoms are balanced.
3.3 Legal obligation
Atom9 uses legal obligation for accounting, tax, legal requests, incident duties, compliance records, and obligations imposed by applicable law.
3.4 Consent
Atom9 uses consent where required for optional analytics, marketing, certain cookies, optional communications, or customer-app flows that rely on consent. Consent can be withdrawn where consent is the legal basis.
3.5 Customer instructions
When Atom9 acts as processor, the customer defines the legal basis for its workspace or customer-app data and Atom9 processes that data according to documented instructions.
GDPR 4
Atom9 operates processor work under documented instructions.
4.1 Data processing agreement
For production customers, Atom9 provides or operates under a data processing agreement covering processor instructions, confidentiality, security measures, sub-processors, rights assistance, incident support, deletion, return, retention, and transfer safeguards.
- The DPA defines the customer's documented instructions and Atom9 processor obligations.
- The DPA defines confidentiality, security, sub-processor, incident, audit information, deletion, and return duties.
- The DPA defines transfer safeguards when data is processed outside the EU/EEA.
4.2 Instructions
Atom9 processes customer-controlled data according to the configured service, agreement, and documented customer instructions. Atom9 does not use customer processor data for unrelated purposes.
4.3 Confidentiality
Atom9 limits access to people and providers who need it for service operation, support, security, compliance, or legal duties.
4.4 End of service
Atom9 deletes, returns, anonymises, or retains data according to the agreement, law, backup lifecycle, security requirements, and customer instructions.
GDPR 5
Customer KYC belongs to the customer app flow, not the basic Atom9 account.
5.1 Atom9 account scope
Atom9 keeps its own account data limited to what is needed for login, verification, security, sessions, notices, workspace access, support, and platform operation.
5.2 Customer-app scope
A customer app can require extra information to deliver its own service, such as address, booking details, company profile, documents, eligibility checks, consent records, or sector KYC.
5.3 Explanation at collection
Service-specific data is collected at the customer app boundary, explained to the user, and controlled by the customer unless Atom9 is separately acting as controller for a specific Atom9 account purpose.
GDPR 6
Atom9 supports GDPR rights through account, workspace, and customer-app channels.
6.1 Rights handling
Requests can include access, rectification, erasure, restriction, objection, portability, withdrawal of consent, complaint handling, and information about automated processing.
6.2 Controller requests
Atom9 responds to requests where Atom9 is controller and verifies identity and authority before changing or disclosing data.
6.3 Processor assistance
When a customer is controller, Atom9 forwards, assists, or acts according to the data processing agreement and product workflow.
6.4 Exceptions
Atom9 applies legal exceptions for security, identity verification, legal claims, accounting, compliance, backup ageing, and customer controller instructions where applicable.
GDPR 7
Atom9 keeps compliance evidence instead of relying on trust alone.
7.1 Security measures
Atom9 uses authentication controls, session controls, role boundaries, service authentication, logging, backups, provider controls, and operational monitoring.
7.2 Personal data breach process
Atom9 investigates suspected personal data breaches, contains the issue, assesses risk, preserves evidence, and notifies customers, users, or authorities where required.
7.3 Records of processing
Atom9 keeps records for important processing purposes, approvals, AI actions, provider settings, transfer safeguards, and compliance decisions where accountability requires evidence.
7.4 DPIA support
Atom9 assists customers with information needed for data protection impact assessments where the customer use case is likely to create high risk.
7.5 Transfers and sub-processors
Atom9 selects providers with attention to security, confidentiality, location, transfer safeguards, service purpose, and customer notice requirements.
GDPR 8
Atom9 connects GDPR controls with AI Act controls where AI affects personal data.
8.1 AI literacy and explanations
Atom9 explains what the agent is doing, what context it uses, what tools it used, what decision is needed, and what a human must approve before important outcomes continue.
8.2 Transparency
Atom9 makes AI-generated content, AI chat, tool use, model/provider identity, and automated actions visible in the product history where relevant.
8.3 Risk routing
Atom9 routes high-risk sectors, regulated workflows, unusual data requests, special-category data, and high-impact decisions into stronger questions, approvals, compliance checks, and launch gates.
8.4 Human control
Atom9 requires human approval before the agent publishes, launches, or changes sensitive workflows where human control is required.
8.5 Evidence trail
Atom9 saves prompt history, approvals, tests, compliance checks, launch decisions, provider settings, and relevant tool results with the project.