01Scope and roles
In shortYou decide what happens to your contacts’ data; we handle it only to run Atomiq for you.
This agreement applies when Atomiq processes personal data on your behalf in providing the service (“Customer Personal Data”). You are the controller and Atomiq is your processor. Annex 1 describes the processing.
It forms part of the Terms of service and applies for as long as Atomiq processes Customer Personal Data for you.
02Your instructions
Atomiq processes Customer Personal Data only on your documented instructions. The Terms, this agreement and the way you configure and use the service are those instructions. If an instruction appears to break data protection law, we tell you.
You are responsible for having a lawful basis for the processing, including the consent of the people you email where it is needed.
03Confidentiality
Everyone at Atomiq who can access Customer Personal Data is bound by confidentiality and accesses it only as needed to provide the service or support you.
04Security
Atomiq maintains the technical and organisational measures in Annex 2. We may improve them over time but will not reduce the overall level of protection.
05Sub-processors
In shortWe name every provider that touches your data and tell you before adding one, so you can object.
You authorise Atomiq to use the sub-processors listed on the Sub-processors page (Annex 3). We bind each one to data protection obligations at least as protective as these, and remain responsible for them.
We give at least 30 days’ notice before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that time; if we cannot address the objection, you may end the affected service without penalty.
06Helping with data subject requests
The service lets you find, export, correct and erase a contact’s data and suppress their address. If a person contacts Atomiq directly about data you control, we pass the request to you without undue delay and do not answer it ourselves unless you ask us to.
07Personal data breaches
Atomiq notifies you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes what happened, the data and people concerned, the likely consequences and what we are doing about it, and we update it as we learn more.
08Impact assessments and consultations
Taking into account the information available to us, we help you with data protection impact assessments and prior consultations with authorities where they concern the service.
09Return and deletion
You can export your contacts at any time. When the Terms end, Atomiq deletes Customer Personal Data within 30 days, and from backups as they expire after 7 days, unless the law requires us to keep it.
10Information and audits
We make available the information needed to show compliance with this agreement and answer reasonable security questionnaires. Where that is not enough, you may audit Atomiq, or appoint an independent auditor bound by confidentiality, with 30 days’ notice, at your cost, no more than once a year unless a breach or an authority requires it.
11International transfers
Customer Personal Data is stored in the European Union. Where a sub-processor processes it outside the European Economic Area, the transfer is covered by an adequacy decision or by the European Commission’s Standard Contractual Clauses, together with any additional measures needed.
Where you are outside the EEA and the GDPR applies to the transfer to you, the Standard Contractual Clauses (Module 4, processor to controller) apply between us.
12Liability and precedence
Each party’s liability under this agreement is subject to the limits in the Terms. If this agreement conflicts with the Terms on the processing of personal data, this agreement prevails.
13Annex 1: Details of the processing
| Controller | You, the Atomiq customer (details in your account) |
|---|---|
| Processor | MARSA Agency d.o.o., Ulica Hrvatske Republike 17B, 31000 Osijek, Croatia, OIB 53873550189 |
| People concerned | Your subscribers, customers and website visitors who sign up or are imported; your team members |
| Personal data | Contact details (email, name, phone, country, language, time zone); fields you add; consent and subscription status with time and source; email engagement (sends, opens, clicks, bounces, complaints); order and product activity synced from your store; storefront activity and sign-up form answers; predictions derived from them (such as likelihood to buy again) |
| Special categories | None intended. Do not upload health, religious or other special-category data. |
| Nature and purpose | Storing, segmenting and emailing your contacts and reporting on the results, as you direct in the service |
| Frequency | Continuous, for as long as you use Atomiq |
| Duration | The term of the agreement, then deletion as in “Return and deletion” |
14Annex 2: Security measures
Access and identity
- Passwords hashed with Argon2; two-factor sign-in with authenticator apps and hashed recovery codes.
- Team roles (owner, admin, editor, viewer) limit what each member can do.
- Sessions can be reviewed and revoked; refresh tokens rotate and a reused token revokes the whole session family.
Separation and encryption
- Each customer’s data is separated in the database by row-level security, forced on every table that holds it, for an application role without superuser rights.
- HTTPS for all traffic; store credentials and two-factor secrets encrypted with AES-256-GCM.
- Database and cache reachable only from inside the hosting network.
Operations
- An audit log of account changes, team invitations, API keys, erasures and suppression changes.
- Rate limits on sign-in, the API and public endpoints such as sign-up forms.
- Database backups, kept for 7 days on a disk separate from the database.
- One-click unsubscribe and a suppression list checked before every send.
15Annex 3: Sub-processors
The current list of sub-processors, with what each does and where, is on the Sub-processors page.