Data Processing Agreement

Last updated: 23 October 2026

Under Art. 28 GDPR, between the customer (Controller) and Atlassia (Processor). It forms part of the Terms of Service and applies when the customer publishes catalogs with Atlassia.

1. Subject and duration

1.1 This agreement governs the processing of personal data by Badii Boukalane, Milser Str. 65, 33729 Bielefeld, Germany (Processor) on behalf of the customer (Controller) when the Controller publishes catalogs with Atlassia.

1.2 It runs for as long as the Terms of Service between the parties, and ends with them. Obligations on deletion and confidentiality continue as long as the Processor holds data under this agreement.

1.3 Account holders' own data (sign-in, saved projects) is processed by Atlassia as controller under the privacy policy, not under this agreement.

2. Nature, purpose, data and data subjects

The data subjects are visitors of the Controller's published catalogs. The Processor processes their data only for the activities below.

Activity	Personal data	Purpose	Kept for
Quote requests	Name, email address; optionally company, phone, message; requested parts and quantities; catalog and time	Store the request and make it available to the Controller in Atlassia	Until the Controller deletes the request, the catalog or the account
Quote notifications	The same request data	Send each new request to the Controller: by email through Resend if the Controller turned this on, and/or to a webhook the Controller set	Not stored beyond delivery; a delivery error message is kept with the request
Delivering catalog pages	IP address, time, requested page, browser user agent	Serve the catalog and keep the service secure	Hosting logs: one hour
Abuse protection	One-way hash of IP address and current hour	Limit quote requests, passcode attempts and events per client	At most one hour

Catalog usage statistics (opens, part views, basket adds, AR starts) are stored only as daily totals per catalog and part, with no cookies, IP address or identifier, and are therefore not personal data. The quote basket and a passcode unlock are kept only in the visitor's own browser.

3. Instructions and the Controller's responsibilities

3.1 The Processor processes personal data only on documented instructions from the Controller. The settings the Controller chooses in Atlassia (enabling the quote basket, email or webhook notifications, passcodes, hiding, revoking or deleting a catalog or a request) are such instructions. Further instructions are given in text form.

3.2 If the Processor considers an instruction to breach data protection law, it tells the Controller without delay and may suspend it until it is confirmed or changed.

3.3 The Controller is responsible for the lawfulness of the processing, for informing its visitors (for example through its own privacy policy linked in the catalog), and for the services its webhook sends requests to. Those services are the Controller's own recipients, not subprocessors of the Processor.

4. Confidentiality, assistance and breaches

4.1 Everyone authorised to process the data is bound to confidentiality. Today only the Processor himself has access.

4.2 The Processor implements the technical and organisational measures in the Annex and keeps them up to date. Changes may not lower the level of protection.

4.3 The Processor assists the Controller with data subjects' requests (Art. 15–22 GDPR), security, breach notifications and data protection impact assessments, as far as its processing is concerned. Requests from data subjects that reach the Processor are forwarded to the Controller. In Atlassia the Controller can itself view and delete each quote request.

4.4 The Processor notifies the Controller without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting the Controller's data, with the information required by Art. 33 (3) GDPR as far as available.

5. Subprocessors and transfers

5.1 The Controller authorises the following subprocessors:

Subprocessor	What it does with visitors' data	Location	Transfer basis
Vercel Inc.	Hosts the catalog pages and the API; processes IP addresses to deliver pages	USA	EU-U.S. Data Privacy Framework / Standard Contractual Clauses
Supabase Pte. Ltd.	Database and file storage holding quote requests	EU (Ireland)	Within the EU
Upstash Inc.	Rate limiting with hashed IP and hour, kept one hour	EU	Within the EU
Resend Inc.	Sends quote-request emails to the Controller, if the Controller turned email on	USA	EU-U.S. Data Privacy Framework / Standard Contractual Clauses

5.2 The Processor informs the Controller at least 30 days before adding or replacing a subprocessor, by email or in the app. The Controller may object for a reason related to data protection; if no solution is found, the Controller may end the contract.

5.3 The Processor binds each subprocessor to obligations equivalent to this agreement.

6. Audits, deletion and return

6.1 The Processor provides the Controller with the information needed to demonstrate compliance with this agreement, primarily through this document, its Annex and current subprocessor certifications. On-site audits are possible with four weeks' notice, during business hours, at the Controller's cost, and at most once a year unless there is a specific reason.

6.2 When the contract ends, the Processor deletes the Controller's data. The Controller can do this itself at any time: deleting a quote request, a catalog or the whole account removes the related data immediately. Copies in backups are overwritten after a short period. Before deleting, the Controller can export its projects; quote requests are visible in the app and can be copied from there.

Annex: technical and organisational measures

Area	Measure
Data minimisation	CAD files are read in the browser and never uploaded, except files the customer asks a connected AI assistant to send, which wait in a private import inbox for at most 24 hours. Hidden parts are not uploaded. Catalog statistics are daily totals without identifiers. IP addresses are used for rate limiting only as a one-way hash with the current hour, kept one hour.
Access control	Sign-in by one-time email link. Row-level security limits projects and their files to their owner. Quote requests, notification settings and contact messages are readable only by the server, never directly by browsers.
Published files	Stored privately. The catalog API checks status, revocation, passcode and revision on every request, then hands out a signed link valid for 30 minutes.
Passcodes and tokens	Passcodes are stored only as salted scrypt hashes. Access tokens are HMAC-signed and versioned, so changing a passcode invalidates all earlier ones. Management tokens are stored as hashes.
Transmission	HTTPS only, with HSTS. Webhooks go only to public https addresses, without redirects. Files an AI assistant asks us to download are fetched only from public https addresses, and every redirect is checked again. Emails are sent over TLS by Resend.
Abuse protection	Rate limits per client on quote requests (5 per hour per catalog), passcode attempts, contact messages and publishing; a hidden field rejects automated form submissions.
Application security	Security headers on every response, including an enforced content security policy. Inputs are validated on the server. Automated tests cover access rules.
Availability and recovery	Hosting on Vercel and Supabase, with database backups by Supabase. A daily job removes files left behind by interrupted uploads and import inboxes not opened within 24 hours.
Deletion	Controllers delete requests, catalogs or their account themselves; deletion removes stored files first, then records. Catalog statistics older than 400 days are dropped.
Organisation	Production access is limited to the Processor himself.