Privacy Policy
- Legal name
- ATLAS COMMERCE ONLINE LIMITED
- Trading as
- Atlas Automations
- Legal form
- Private company limited by shares
- Registry
- Companies Registry, Hong Kong
- Registration no.
- 81140198
- Incorporated
- 1 September 2026
- Registered office
- Unit 903, 9/F, Cameron Commercial Centre, 458-468 Hennessy Road, Causeway Bay, Hong Kong
- Telephone
- +1 315 756 2281
- info@theatlasautomations.com
- Website
- theatlasautomations.com
1. Who is responsible
The controller is ATLAS COMMERCE ONLINE LIMITED, whose details appear at the top of this page. Questions about this policy, or any request about your data, go to info@theatlasautomations.com.
2. Which rules apply
The company is registered in Hong Kong SAR and is subject there to the Personal Data (Privacy) Ordinance, which governs how personal data is collected, held, used and erased.
For the purposes of data protection the company also has an establishment in Slovakia, from which the business is carried on. The General Data Protection Regulation therefore applies to us directly, and no representative under Article 27 is required. This is stated here because a reader is entitled to know which rules govern their data and why.
That establishment is a private residence, so its address is provided on request rather than published. Write to info@theatlasautomations.com and you will have it; a supervisory authority receives it without having to ask. The registered office shown at the top of this page remains the address for formal service.
Our clients are businesses in the European Union, and the personal data we handle for them is generally their own staff contact details and, within a project, records belonging to their customers. Where that is the case the client remains the controller and we act on their instructions, as set out in article 5.
3. What we process, and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Enquiries and proposals | Name, company, email, telephone, description of the project | Steps taken at your request before a contract (Art. 6(1)(b)) | 3 years from last contact if nothing follows |
| Proposals and invoices | Identity, billing details, engagement contents, the acceptance you sent | Performance of the contract (Art. 6(1)(b)) | 7 years, as accounting records |
| Client project work | Business contact details, correspondence, technical credentials | Performance of the contract (Art. 6(1)(b)) | Term of the engagement, then 5 years |
| Complaints | Identity, subject of the complaint, correspondence | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) | 5 years from closure |
| Site security | IP address, server connection logs | Legitimate interest in keeping the site secure (Art. 6(1)(f)) | Set by the hosting provider, 12 months at most |
We do not sell, rent or exchange personal data, and we do not use it for advertising.
4. No payment data on this site
Invoices are settled by bank transfer, or — for the short pieces of work — by card through the payment page on this site. In both cases the payment is processed by a licensed payment provider: no card number is ever entered on this site and none is stored by us. We receive only the amount, the currency, the status and a reference.
5. Who else sees your data
Your data is handled by us and by the processors we rely on to run the business: the site hosting provider, the email provider for our domain, our accounting software, and the payment provider that processes card settlements. Each acts on our instructions under a written contract.
Where we handle personal data belonging to a client during a project — their staff records, or their own customers' details — the client remains responsible for that data and we act only on their instructions. A written data processing agreement is signed before the work begins, setting out what is processed, for how long, and what happens to it at the end.
That agreement is a data processing agreement within the meaning of Article 28 GDPR, and it is written to the requirements the client's own supervisory authority imposes. We never use data handled on a client's behalf for any purpose of our own.
6. Where data is held, and transfers outside the Union
Operational data — proposals, invoices, correspondence and project files — is held with hosting and email providers located within the European Union. A current list is available on request.
Hong Kong is not covered by an adequacy decision of the European Commission. Where data has to reach the registered office there, the transfer is covered by the European Commission's Standard Contractual Clauses, together with the supplementary measures the transfer impact assessment calls for. In practice this is rare: the work is carried out from the establishment within the Union.
Where an engagement requires data to stay within a particular country, say so before it starts: it is usually straightforward to arrange, and impossible to fix afterwards.
7. Your rights
You may ask for access to your data, for it to be corrected or erased, for processing to be restricted, for a copy in a portable format, and you may object to processing based on our legitimate interests. You may also withdraw any consent you have given, without that affecting what was done beforehand.
Write to info@theatlasautomations.com. We reply within one month, which may be extended by two further months for complex requests — we will tell you if that happens. Exercising these rights is free. We may ask you to confirm your identity where there is genuine doubt.
If you are in the European Union and believe your rights are not being respected, you may complain to the supervisory authority of your country of residence, work or of the place where the problem occurred.
8. How we keep it safe
The site is served over HTTPS only. Administrative access is restricted and authenticated. Client credentials are held in an encrypted secrets manager, separate from the site, and deleted at the end of each engagement. Access to client data is limited to the people who need it to do their work.
If a breach occurs that is likely to create a risk to your rights, we notify the competent supervisory authority within 72 hours and tell you directly where the risk is high.
9. Automated decisions and children
We take no decision with legal effect about you by automated means, and we do not profile you.
Our products are not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.