Our Privacy Policy

Last updated 3 August 2026

1. Who we are

Atlas is provided by Darren Docherty, a sole trader trading as Delgato.

No formal data protection officer has been appointed. Privacy enquiries should be sent to the email address above.

2. Scope of this policy

This Privacy Policy explains how we handle personal data when we act as controller, including information about Atlas account users, prospective customers, billing contacts, support contacts and visitors to Atlas.

It also explains our role when a Customer uses Atlas to manage employee, absence, case and document information.

3. When we are controller and processor

We act as an independent controller for personal data used for our own purposes, including:

• creating and administering Atlas accounts;
• managing Subscriptions and payments;
• responding to support and business enquiries;
• keeping Atlas secure and preventing misuse;
• sending operational service messages;
• measuring website and application performance; and
• meeting legal, tax and accounting duties.

For employee, absence, case, note, document and similar information entered by a Customer, the Customer is normally the controller and we are its processor. The Customer decides why that information is used, who may access it and how long it should be kept.

Employees or other data subjects seeking to exercise rights over Customer Data should normally contact the relevant Customer or Organisation Owner first.

4. Personal data we collect as controller

Depending on a person's relationship with Atlas, we may collect:

• name, email address, profile image and account identifier;
• Organisation, role, membership and Site-access information;
• authentication, session and account-security information supplied through Clerk;
• Subscription, invoice, payment-status and billing-contact information;
• support requests, correspondence and feedback;
• device, browser, IP address, timestamps, audit events and security logs;
• website and feature usage information collected by cookieless Vercel Web Analytics;
• performance information collected through Vercel Speed Insights; and
• information needed to investigate misuse, disputes or legal claims.

Stripe processes full payment-card or bank details. Atlas does not receive or store complete card or bank credentials.

5. Customer Data processed on behalf of Customers

Customer Data may include:

• employee names, employee numbers and Site assignments;
• absence dates, reasons, notes and return-to-work information;
• health information and other special-category data;
• allegations, investigations, grievances, disciplinary matters and outcomes;
• information about alleged or actual criminal conduct where a Customer records it lawfully;
• case notes, activity, access permissions, letters, signatures and documents; and
• user details and audit information connected with those records.

We process this information only to provide and secure Atlas, follow the Customer's instructions, provide support and comply with law.

6. How we obtain personal data

We receive personal data:

• directly from users and prospective Customers;
• from Organisation Owners and other authorised users;
• from Clerk when an account is created or managed;
• from Stripe about payment and Subscription status;
• automatically when Atlas is used; and
• from Customers when they submit Customer Data.

7. Purposes and lawful bases

Where consent is the appropriate basis, it may be withdrawn at any time without affecting earlier lawful processing.

8. Special-category and criminal-offence data

We do not use Customer special-category or criminal-offence data for our own marketing or profiling. We process it as a processor only on the Customer's documented instructions, subject to the Data Processing Agreement.

The Customer is responsible for identifying a valid UK GDPR Article 6 basis and, where relevant, an Article 9 condition or legal authority for criminal-offence data.

9. Who receives personal data

We may share personal data with:

• the Customer and its authorised users;
• service providers listed below;
• professional advisers where reasonably necessary;
• regulators, courts, law enforcement or public authorities where legally required; and
• a buyer or successor if the Atlas business is reorganised, sold or transferred, subject to appropriate confidentiality protections.

We do not sell personal data.

10. Service providers

These providers may change as Atlas develops. Material sub-processor changes are handled under the Data Processing Agreement.

11. International transfers

The primary Atlas production database on Railway is hosted in the United Kingdom. Some providers, including Clerk, Stripe and Vercel, may process information in the United Kingdom, European Economic Area, United States or other countries where they or their sub-processors operate.

Where UK personal data is transferred internationally, we use an appropriate lawful safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another mechanism permitted by UK data-protection law.

12. Security

We use measures designed to protect personal data, including access controls, authentication, encrypted connections, restricted database access, audit logging and provider security controls.

No system can be guaranteed completely secure. Users must protect their accounts and report suspected unauthorised access promptly to hello@delgato.co.uk.

13. Retention

We keep personal data only for as long as reasonably necessary for the relevant purpose.

Limited information may be retained longer where required by law or needed for a dispute, fraud investigation, security incident or legal claim.

Atlas does not use a separate customer backup provider. Infrastructure providers may retain short-lived technical copies under their normal resilience and secure-deletion processes. Those copies are not available as a customer recovery service.

14. Rights over Customer Data

If personal data about an employee or other individual was entered by an Atlas Customer, requests to access, correct, delete, restrict or object should normally be made to that Customer. We will assist the Customer as required by the Data Processing Agreement.

We will not independently alter or disclose Customer Data unless instructed by the Customer or required by law.

15. Rights where we are controller

Depending on the circumstances, individuals may have the right to:

• ask for access to their personal data;
• ask for inaccurate information to be corrected;
• ask for deletion;
• ask for processing to be restricted;
• object to processing based on legitimate interests;
• receive portable data where the right applies;
• withdraw consent; and
• complain to a supervisory authority.

These rights are not absolute. We may need to verify identity before acting on a request.

Requests should be sent to hello@delgato.co.uk.

16. Automated decision-making

We do not use controller-held personal data to make solely automated decisions that have legal or similarly significant effects.

Atlas may calculate statistics, identify configured absence trigger conditions or generate operational suggestions. The Customer is responsible for human review and for any employment decision made using those features.

17. Service communications and marketing

We may send essential account, security, billing and service messages. These are not marketing and may be necessary to operate an account.

We do not currently use advertising analytics or behavioural advertising. If this changes, we will update this policy and introduce consent controls where required.

18. Cookies and analytics

Atlas uses strictly necessary authentication and security technologies. Vercel Web Analytics is configured as cookieless analytics, and Speed Insights collects technical performance information.

We do not currently set non-essential marketing or advertising cookies, so Atlas does not currently display a cookie-consent banner. More information is in the Cookie Policy.

19. Children's data

Atlas is a business service and is not directed to children. A Customer may only record information about a person under 18 where it has a lawful employment-related reason and appropriate safeguards.

20. Changes to this policy

We may update this Privacy Policy when Atlas, our providers or legal requirements change. The latest version will be published with a revised Last updated date. We will give reasonable notice of material changes where appropriate.

21. Complaints

Please contact us first at hello@delgato.co.uk so we can try to resolve a concern.

Individuals may also complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. The right to complain is not affected by contacting us first.

22. Contact