Atlan personnel do not have access to any customer instance unless specifically provided by the customer. Accordingly, in the event that a customer instance contains personal data and Atlan personnel are provided access to that instance, Atlan may act as a personal data processor. In addition, depending on whether the customer is a data controller or processor, Atlan may act as a data processor or subprocessor, respectively.
For this purpose, where Atlan customers intend to crawl any personal data into the platform, Atlan enters into a data protection agreement with its customers, and as applicable: a Standard Contractual Clauses (SCC) under EU GDPR, an International data transfer agreement (IDTA) under UK GDPR, or a HIPAA Business Associate Agreement (BAA) when dealing with personal health information governed by HIPAA regulations.