Subprocessors

This page lists the third parties that RED Atlas Inc. ("RED Atlas") engages to process Customer Personal Data on Customer's behalf, as required by Section 5 of the RED Atlas Data Processing Addendum ("DPA"). It is the page referenced in that Section, and it is where we publish advance notice of changes.

1. Scope

A subprocessor is a third party engaged by RED Atlas that processes Personal Data within Customer Data — that is, data for which Customer is the controller and RED Atlas acts as processor under the DPA. Providers that process personal data for RED Atlas's own purposes, where RED Atlas is an independent controller, are outside the DPA under Section 1 of it and are described in our Privacy Policy and Cookie Notice instead. Section 5 of this page explains that boundary.

RED Atlas imposes data-protection obligations on each subprocessor no less protective than those in the DPA, and remains responsible for their performance.

Each provider below is named by the legal entity that contracts with RED Atlas. Every one of these providers assigns the contracting entity by the customer's location, and RED Atlas Inc. is a Puerto Rico corporation, so the United States entity applies in each case.

2. Current Subprocessors

International transfers. Where a subprocessor processes Customer Personal Data outside the European Economic Area, the United Kingdom, or Switzerland, the transfer is made under the mechanisms set out in Section 9 of the Data Processing Addendum — the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and the adaptations required by the FDPIC for Swiss transfers.

Payment processing

Payments are handled by Stripe, LLC (the Stripe entity for accounts located in the Americas). Stripe determines the purposes and means of processing payment data for its own regulatory, fraud-prevention, and anti-money-laundering obligations, and therefore acts as an independent controller rather than as a subprocessor of RED Atlas. It is listed here for transparency. Stripe processes payer name, email address, billing address, and payment instrument details; card numbers are collected by Stripe directly and are never received or stored by RED Atlas. Stripe's own privacy terms govern that processing. See Stripe's Data Processing Agreement and Privacy Center.

3. Pending Additions

Subprocessors we intend to engage are listed here for at least thirty (30) days before they begin processing Customer Personal Data, so that the notice period in Section 5 of the DPA runs in public.

There are no pending additions as of the Last Updated date above.

4. Notice of Changes and How to Object

Notice. RED Atlas will give at least thirty (30) days' notice before adding or replacing a subprocessor, by updating this page and, where Customer has subscribed, by email.

Subscribing. To receive these notices by email, write to privacy@atlas.red with the address to notify. We recommend subscribing an alias monitored by more than one person rather than an individual mailbox.

Objecting. Customer may object to a new subprocessor on reasonable data-protection grounds within the notice period by writing to privacy@atlas.red. The parties will work in good faith to resolve the objection; if it cannot be resolved, Customer may terminate the affected Service and receive a prorated refund of prepaid fees, as set out in Section 5 of the DPA.

5. Not on This List

Some providers process personal data in connection with our websites and our own business, but not on Customer's behalf, so they are not subprocessors under the DPA. These include analytics, mapping, and bot-protection providers described in our Cookie Notice, and the providers involved in the property and contact records that RED Atlas publishes as an independent controller, described in our Privacy Policy.

Providers that process only RED Atlas personnel or corporate data — such as payroll and human-resources systems — are also outside this list, as that processing involves no Customer Personal Data.

Questions about this list: privacy@atlas.red.