Data protection (GDPR)

Our Commitment to Data Protection

Atumo is committed to full compliance with the General Data Protection Regulation (GDPR). As an EU-based company working on visibility in AI answers and AI work automation, we build data protection into our work from the start.

How We Handle Your Data

Transfers outside the EU

We do not transfer personal data outside the EU/EEA without appropriate safeguards as required by GDPR Chapter V.

Data Minimisation

We collect and process only the minimum data necessary for each specific automation. We do not collect data "just in case": everything we collect has a defined purpose.

No Model Training on Your Data

Your business data is never used to train external AI models. Automations we build for you process your data to deliver results — they do not pass it on for training general-purpose AI systems.

Data Processing Agreements

When our work for you involves personal data, we sign a Data Processing Agreement (DPA) that covers how data is handled, security measures, breach notification and sub-processors.

Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you
• Right to Rectification (Art. 16): Request correction of inaccurate personal data
• Right to Erasure (Art. 17): Request deletion of your personal data
• Right to Restriction (Art. 18): Request restriction of processing of your data
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing of your personal data
• Right to Withdraw Consent (Art. 7): Withdraw previously given consent at any time

To exercise any of these rights, contact us at hello@atumo.lv. We will respond within 30 days as required by GDPR.

Security Measures

We implement appropriate technical and organisational measures, including:

• Encrypted connections (TLS) and service providers that store data encrypted
• Access to data only for those who need it for the work
• A defined procedure for responding to and reporting data breaches

Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.

Sub-Processors

We use established service providers (for example, for email, hosting and analytics) that commit to GDPR-compliant data processing. We will send you the list of sub-processors on request.

Contact

For any questions about how we comply with GDPR, data processing practices, or to exercise your data subject rights:

Email: hello@atumo.lv

You also have the right to lodge a complaint with your local data protection supervisory authority.