Privacy Policy

1. Data Controller

Company Name

Atlas Cloud S.L.

NIF

B-87364709

Registered address

Madrid, Spain

Activity

Technology services, consulting, and cybersecurity

Email

info@atlascloud.es

DPO / Privacy

dpo@atlascloud.es

Website

www.atlascloud.es

Atlas Cloud S.L. has appointed a Data Protection Officer (DPO) in accordance with Article 37 of the GDPR, available at dpo@atlascloud.es for any matter related to the processing of personal data.

2. Scope of application

This policy governs the processing of personal data carried out by Atlas Cloud S.L. as Data Controller with respect to its clients, users, commercial contacts, candidates, suppliers, and website visitors.

It does not govern the processing of data carried out by Atlas Cloud on behalf of its clients as a Data Processor, which is governed by the Data Processing Agreement (DPA) entered into with each client in accordance with Article 28 of the GDPR.

3. Data processed, purposes, and legal bases

Atlas Cloud processes only the data necessary for each purpose, in accordance with the data minimisation principle of Article 5.1(c) of the GDPR:

Purpose

Data processed

Legal basis

Retention

Contract management and service delivery

Identification, contact, contractual, and access-related technical data

Art. 6.1(b) — Performance of contract

Contract + 5–6 years

Billing and tax obligations

Identification, billing, and financial data

Art. 6.1(b) + 6.1(c) — Contract and legal obligation

6 years / 4 fiscal years

Information and systems security

Access logs, security events, and device data

Art. 6.1(f) + Art. 32 — Legitimate interest and security

Up to 5 years in archive

Personal data breach management

Data of individuals affected by the breach

Art. 6.1(c) — Legal obligation (Arts. 33 and 34 GDPR)

5 years

Commercial communications

Name and email address

Art. 6.1(f) — Legitimate interest / Art. 21 LSSI-CE

Until objection is exercised

Applications and recruitment

Name, contact details, CV, and experience

Art. 6.1(b) + 6.1(f) — Pre-contractual and legitimate interest

1 year

Compliance with legal obligations

Those required by applicable law

Art. 6.1(c) — Legal obligation

As required by applicable law

Atlas Cloud S.L. does not, as a general rule, process special categories of data as defined in Article 9 of the GDPR.

4. Recipients and international transfers

Atlas Cloud does not sell or transfer personal data to third parties for their own purposes. Data may be disclosed to:

  • Technology service providers acting as Data Processors in accordance with Article 28 of the GDPR, bound by a data processing agreement and confidentiality and security obligations equivalent to those of Atlas Cloud.
  • Competent authorities (AEPD, tax authorities, courts and tribunals, law enforcement) when there is a legal obligation or well-founded formal request.

When international transfers of data are made outside the European Economic Area, Atlas Cloud ensures that they are carried out through the mechanisms provided for in Chapter V of the GDPR: European Commission adequacy decisions, Standard Contractual Clauses, or other appropriate safeguards in accordance with Article 46 of the GDPR.

5. Rights of data subjects

Data subjects may exercise at any time the rights recognized by the GDPR and the LOPDGDD:

Right

Content

Access

To know whether Atlas Cloud processes your data and to obtain a copy of it (Art. 15 GDPR).

Rectification

To correct inaccurate or incomplete data (Art. 16 GDPR).

Erasure

To request the deletion of your data when it is no longer necessary or there is no legal basis (Art. 17 GDPR).

Objection

To object to processing based on legitimate interest. In the case of commercial communications, this right is absolute (Art. 21 GDPR).

Restriction

To restrict processing in the cases provided for in Article 18 of the GDPR.

Portability

To receive your data in a structured, machine-readable format, when processing is based on contract or consent (Art. 20 GDPR).

Consent

To withdraw consent at any time, without this affecting the lawfulness of processing prior to withdrawal.

How to exercise your rights

Send your request to dpo@atlascloud.es indicating the right you wish to exercise and attaching a copy of your identity document. Atlas Cloud will respond within a maximum period of one month.

If you believe that the processing of your data violates applicable regulations, you may lodge a complaint with the Spanish Data Protection Agency: www.aepd.es · 900 293 183

6. Security and data breaches

Atlas Cloud implements technical and organizational measures appropriate to the risk in accordance with Article 32 of the GDPR, within the framework of its Information Security Management System aligned with the ISO/IEC 27001:2022 standard.

In the event of a personal data breach, Atlas Cloud will notify the AEPD within a maximum period of seventy-two hours from becoming aware of it when required in accordance with Article 33 of the GDPR, and will inform the affected data subjects when the risk is high in accordance with Article 34 of the GDPR.

To report a security incident: security@atlascloud.es

7. Cookies

The website www.atlascloud.es uses technical cookies necessary for its operation and, with the user’s prior consent, analytical or preference cookies. The user can manage or revoke their consent at any time through the cookie panel available on the website. For complete information, please consult Atlas Cloud’s Cookie Policy.

8. Updates

La presente política será revisada con periodicidad mínima anual o ante cambios normativos u organizativos relevantes. Las modificaciones significativas serán comunicadas a los interesados afectados a través del sitio web o por correo electrónico. La fecha de última actualización figura en el encabezado del documento.