Data Processing Agreement

The organisation using ATLAS to manage its workforce is the Data Controller. Shift Craft | ATLAS is the Data Processor, acting only on the Controller's documented instructions for the purpose of providing roster scheduling, compliance validation and related operational services.

Processing covers staff identity, contact, operational and audit data for the duration of the organisation's active subscription, and for any additional period required to meet statutory retention obligations or as agreed in writing.

Shift Craft | ATLAS may engage sub-processors (including hosting and infrastructure providers) to support the service. Sub-processors are bound by data protection terms no less protective than those set out here. A current list of sub-processors is available on request.

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, audit logging and regular security review. Details of our security posture are available on request from your account contact.

Shift Craft | ATLAS will provide reasonable assistance to the Controller in responding to data subject access, correction, deletion and portability requests relating to data processed under this agreement.

Personal data is processed within the UK and European Economic Area. Where a transfer outside this area is necessary, it will be made subject to an appropriate safeguard recognised under UK GDPR, such as the UK International Data Transfer Addendum.

On termination of the subscription, the Controller may export operational data prior to account closure. Data is deleted from active systems in line with the retention terms agreed with the Controller, except where retention is required by law.

The Controller may request evidence of compliance with this agreement. Where a formal audit is required, this will be arranged by mutual agreement on reasonable notice.

For a signed copy of this agreement or questions relating to data processing, please contact your account representative or your organisation's data protection officer in the first instance.