Data Processing Addendum
- Version1.0
- Updated
- Effective
How we process personal data held in a customer's workspace, on that customer's behalf and under its instructions.
1. Scope and roles
This addendum forms part of the Terms of Service between Ovolo IT Building Solutions Private Limited (“we”) and the Customer. It applies to personal data in Customer Content that we process to provide Atom (“Customer Personal Data”).
The Customer is the data fiduciary of Customer Personal Data and we are its data processor. Personal data we control ourselves, such as account details we need to run Atom, is covered by the Privacy Policy instead.
2. Details of the processing
| Purpose | Providing, securing and supporting Atom for the Customer. |
|---|---|
| Duration | The term of the agreement, then until deletion as set out in Return and deletion. |
| People concerned | The Customer's users, employees and job candidates, and people named in its records, such as clients, vendors and contacts. |
| Kinds of data | Identity and contact details; work content such as tasks, messages, voice messages, notes, files and calendar entries; leave and attendance records; finance records; and, where the HR module is used, employment details, bank account details, tax identifiers, salary and payroll, performance reviews and résumés. |
| Sensitive data | Atom does not ask for special categories of data. The Customer decides whether to record any — for example health details in a leave reason — and is responsible for the lawful basis. |
3. Processing on instructions
We process Customer Personal Data only on the Customer's documented instructions — these terms, and the Customer's use and configuration of Atom — unless the law requires otherwise, in which case we will tell the Customer first where the law allows. We will tell the Customer if we believe an instruction breaks data protection law.
4. Confidentiality
People we authorize to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide and support Atom.
5. Security
We maintain the technical and organizational measures described on our Security page, including encryption in transit, server-side permission checks on every action, private storage for Drive and HR files with short-lived signed links, hashed passwords and two-factor authentication. We may update these measures as long as protection is not reduced.
6. Sub-processors
The Customer authorizes us to use the sub-processors below. We will give notice of a new sub-processor at least 30 days in advance, and the Customer may object on reasonable data protection grounds. Each sub-processor is bound by data protection obligations no less protective than this addendum, and we remain responsible for its performance.
| Provider | What they do for Atom | Data involved |
|---|---|---|
| Vercel | Hosting for the website and the web app; aggregate page-view analytics for the web app | All data sent to and from the web app, request metadata such as IP address |
| Neon | Primary database | Account details and workspace content |
| Amazon Web Services (S3) | Private storage for Drive and HR files | Files uploaded to Drive and the HR module |
| Cloudflare R2 | Storage for profile photos, workspace logos, project resources and finance attachments | Those files |
| Ably | Real-time delivery of messages and updates | Messages, notifications and identifiers in transit |
| Inngest | Background jobs: email delivery, reminders, scheduled reports, deletions | Identifiers, names and email addresses in job payloads |
| Zoho Mail | Sending account and notification email | Name, email address, email content |
| Google Firebase Cloud Messaging | Push notifications to browsers and Android devices, and to iOS through Apple's push serviceAfter you turn on notifications | Device push token, notification content |
| Sentry | Error reports from the web app | Technical details of an error, browser and device information, IP address |
| Better Auth Infrastructure | Sign-in activity monitoring | Account identifiers and sign-in events |
7. Helping the Customer
Taking into account the nature of the processing, we will help the Customer respond to requests from people exercising their rights, and with security, breach notification and data protection impact assessments. If we receive a request directly about Customer Personal Data, we will pass it to the Customer rather than answer it ourselves.
8. Personal data breaches
We will notify the Customer within 72 hours after becoming aware of a breach affecting Customer Personal Data, with the information the Customer needs to meet its own obligations, and will take reasonable steps to contain it.
9. Return and deletion
During the agreement, the Customer can download its files and export reports from Atom. When the agreement ends, we will export Customer Personal Data on request and delete it after 30 days, unless the law requires us to keep it. Backups are kept for up to 7 days and then overwritten.
10. Information and audits
We will make available the information reasonably necessary to show compliance with this addendum, and allow audits by the Customer or an independent auditor it appoints, on reasonable notice.
11. Where data is stored
Customer Personal Data is stored in India (Mumbai) and Singapore, and transferred outside India only as Indian law permits.
12. Signed copies and precedence
This addendum applies without a signature. A countersigned copy is available from contact@occulus.in. If it conflicts with the Terms of Service, this addendum prevails for the processing of Customer Personal Data.
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | First published version. |
Related policies
Questions about this document
- Provider of Atom
- Ovolo IT Building Solutions Private Limited
House No. 113, Double Phatak, Meerut Road, Roorkee, Uttarakhand 247667, India - Legal and contracts
- contact@occulus.in
- Privacy and data requests
- contact@occulus.in
- Support
- contact@occulus.in