Your privacy and your data, explained

This Privacy Policy explains how Atlas FieldOps ("Atlas FieldOps," "we," "us," or "our") collects, uses, discloses, and protects information when you visit atlasfieldops.com (the "Website"), use our web application (the "Platform"), or use our Android mobile application (the "Mobile App"), together the "Services."

We provide a field data collection, monitoring, and operations platform used by organizations such as NGOs, government agencies, donors, healthcare providers, agricultural programs, and other businesses ("Customers") to manage forms, submissions, entities or records, field visits, media evidence, and reporting. Because of this, this policy describes two different relationships:

• Visitors and prospects who browse our Website or submit a contact, demo, careers, or resource request — for this information, Atlas FieldOps is the data controller.
• Customer organizations and their authorized users (such as field officers, supervisors, and administrators) who use the Platform and Mobile App to collect and manage operational data ("Customer Data") — for this information, the Customer is generally the data controller and Atlas FieldOps acts as a data processor or service provider, as described in Section 13.

• "Personal Data" means any information that identifies, relates to, or could reasonably be linked to an identified or identifiable individual.
• "Customer Data" means data submitted to the Platform or Mobile App by a Customer or its authorized users in connection with their use of the Services, including form responses, GPS coordinates, photos, audio, video, signatures, attachments, entity records, indicators, and reports.
• "Account Data" means information about Customers and their authorized users used to provision and administer access to the Services, such as name, email address, organization, role, and login activity.
• "Device Data" means information collected from the Mobile App and the device it runs on, such as device identifiers, app version, operating system version, sync status, and diagnostic logs.

3.1 Information from website visitors and prospects

When you submit a form on our Website — for example a contact request, demo booking, resource download, careers application, or newsletter signup — we collect the information you provide, which may include your name, work email address, organization, job title, country or region, phone number, and the content of your message.

3.2 Account Data

When a Customer creates an organization or invites users to the Platform, we collect Account Data such as name, email address, organization name, assigned role and permissions, and authentication activity (such as login timestamps and device registration).

3.3 Customer Data

Customers and their authorized users may submit Customer Data to the Services, including form responses, GPS coordinates and maps, photos, audio recordings, video, signatures, file attachments, and records about entities, or other individuals relevant to the Customer's programs. Customer Data may include sensitive information depending on how a Customer configures and uses their forms (for example, health, demographic, or location information about program participants). Customer Data is controlled by the Customer; see Section 13 for more on this relationship.

3.4 Device and usage data

We automatically collect certain technical information when you use the Services, including IP address, browser type, device type, operating system, pages viewed, referring URLs, and timestamps. The Mobile App additionally collects Device Data such as a device identifier, app version, operating system version, sync queue status, and diagnostic information used for support and troubleshooting.

3.5 Cookies and analytics

The Website uses cookies and similar technologies as described in Section 6.

We use the information described above to:

• Provide, operate, maintain, and improve the Website, Platform, and Mobile App;
• Create and administer Customer organizations, user accounts, roles, and permissions;
• Enable offline data collection, synchronization, media uploads, and reporting features;
• Respond to inquiries, demo requests, support tickets, and careers applications;
• Send service communications, such as account notices, security alerts, and sync or device status updates;
• Send marketing communications about our products and services, where permitted, and in line with your preferences;
• Monitor, detect, investigate, and prevent fraud, abuse, unauthorized access, and security incidents;
• Analyze usage trends to improve performance, reliability, and the design of our Services; and
• Comply with legal obligations and enforce our agreements, including our Terms of Service.

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction that requires a legal basis for processing Personal Data, we rely on the following bases:

• Contract: to provide the Services a Customer has subscribed to and to manage Account Data for authorized users;
• Legitimate interests: to secure our Services, respond to inquiries, improve our products, and communicate with prospects and Customers about relevant offerings;
• Consent: where required, such as for certain cookies, marketing communications, or device permissions on the Mobile App (for example, camera, microphone, or precise location); and
• Legal obligation: where we must retain or disclose information to comply with applicable law, regulation, legal process, or governmental request.

We use cookies and similar technologies on the Website to operate core functionality (such as keeping you signed in), remember preferences, and understand how visitors use our site so we can improve it. The Mobile App does not use advertising cookies; it stores data locally on the device to support offline data collection and synchronization.

Categories of cookies we may use include:

• Essential cookies — required for authentication, security, and basic site functionality;
• Preference cookies — remember settings such as language or display preferences; and
• Analytics cookies — help us understand aggregate usage of the Website so we can improve content and navigation.

You can control cookies through your browser settings, including blocking or deleting cookies. Blocking essential cookies may affect the availability of certain features.

We do not sell Personal Data or Customer Data. We may share information in the following circumstances:

• Service providers and subprocessors who host, store, transmit, or process information on our behalf, such as cloud infrastructure, application hosting, email delivery, analytics, and customer support tooling providers, under contractual confidentiality and security obligations;
• Within a Customer organization, Customer Data and Account Data are visible to authorized users of that organization according to the roles and permissions configured by the Customer's administrators;
• Corporate transactions, such as a merger, acquisition, financing, or sale of assets, where information may be transferred as part of that transaction, subject to standard confidentiality arrangements;
• Legal and safety reasons, where we believe disclosure is necessary to comply with applicable law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Atlas FieldOps, our Customers, or others; and
• With your direction or consent, such as when you ask us to share information with a named third party.

The Atlas FieldOps Mobile App is designed for field officers and other authorized users who need to collect data offline and synchronize it when connectivity is available. To support this, the Mobile App may request the following device permissions. You can manage these permissions in your device settings at any time; disabling a permission may limit related features.

• Location (precise and approximate): to record GPS coordinates for form submissions, field visits, and boundary mapping;
• Camera: to capture photo and video evidence attached to form submissions and field visit records;
• Microphone: to record audio responses or notes attached to form submissions;
• Photos and media storage: to attach existing photos or files to form submissions and to store captured media and offline data on the device;
• Network state: to detect connectivity and manage offline queuing and synchronization; and
• Notifications: to alert you about sync status, assignments, or returned submissions that need attention.

Data collected through these permissions is stored locally on the device until it is synchronized to the Platform as part of Customer Data, and is then handled as described in Sections 3.3 and 13. We recommend that Customers configure permission requirements and consent language appropriate to their own program and applicable law before deploying the Mobile App to field staff.

We retain Account Data and Customer Data for as long as the related Customer organization maintains an active subscription, plus a reasonable period afterward to allow for export, account recovery, backup rotation, and legal or audit requirements, unless a different retention period is agreed in a Customer contract or required by law.

Information submitted through Website forms (such as contact or demo requests) is retained for as long as necessary to respond to your inquiry, maintain business records, and comply with legal obligations, after which it is deleted or anonymized.

On the Mobile App, drafts and queued submissions remain on the device until they are successfully synchronized; previously synced data can be cleared from the device at any time from the app's settings without affecting data already stored on the Platform.

We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction, including encryption of data in transit, role-based access controls, audit logging of sensitive actions, and tenant separation between Customer organizations.

No system can be guaranteed to be completely secure. If we become aware of a security incident affecting Personal Data, we will notify affected Customers and individuals as required by applicable law and our Customer agreements.

Atlas FieldOps and the service providers we use to deliver the Services may process and store information in countries other than the country where you or a Customer's program operates. Where we transfer Personal Data internationally, we use appropriate safeguards required by applicable data protection law, such as standard contractual clauses, to protect that information.

Depending on your location and relationship with us, you may have rights to access, correct, export, or delete Personal Data we hold about you, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.

• Website visitors and prospects: you can exercise these rights by contacting us using the details in Section 16, or by using any unsubscribe link included in our marketing communications.
• Customer platform users: because Customer Data and Account Data are controlled by the Customer organization, requests to access, correct, or delete that information should generally be directed to your organization's administrator. We will assist Customers in responding to such requests as required by our agreements and applicable law.

When a Customer organization uses the Platform and Mobile App to collect and manage Customer Data (including data about entities, program participants, or other individuals), the Customer determines what data is collected, how it is configured within forms, who within their organization can access it, and how long it is retained on the Platform.

In this relationship, the Customer acts as the data controller and Atlas FieldOps acts as a data processor or service provider, processing Customer Data only as necessary to provide the Services and according to the Customer's instructions and our agreement with the Customer. Customers are responsible for ensuring they have an appropriate legal basis to collect Customer Data (including any necessary consents from entities or program participants) and for configuring access controls, retention settings, and consent or safeguarding workflows appropriate to their program and applicable law.

If you are an individual whose data was collected by an organization using Atlas FieldOps (for example, as a program participant or survey respondent), please direct privacy requests to that organization, as Atlas FieldOps does not have a direct relationship with you and may not be able to identify your records without the Customer's assistance.

The Website, Platform, and Mobile App are intended for business and organizational use by adults and are not directed to children. We do not knowingly collect Personal Data from children through the Website for our own purposes. Where Customer Data collected through the Platform or Mobile App includes information about minors (for example, entity records in health, education, or protection programs), that data is controlled by the Customer organization as described in Section 13, and Customers are responsible for ensuring such collection complies with applicable law, including any required parental or guardian consent and safeguarding obligations.

We may update this Privacy Policy from time to time to reflect changes to our Services, legal requirements, or practices. If we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, provide additional notice to Customers (such as by email or in-app notice). Continued use of the Services after a revised policy takes effect indicates acceptance of the changes.

If you have questions, requests, or concerns about this Privacy Policy or our data practices, contact us:

• Email: privacy@atlasfieldops.com
• General support: support@atlasfieldops.com
• Via our contact page