Personal data processing policy

This Personal Data Processing Policy (the “Policy”) informs natural persons how SIA “Atlas Aerospace” processes their personal data in the course of its business, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and the Personal Data Processing Law of the Republic of Latvia. Atlas Aerospace designs and manufactures professional unmanned systems and is part of the XTEND group.

1. Controller and contact details

Controller: SIA “Atlas Aerospace”, registration No. 40103911104, legal address Ulbrokas iela 19A, Rīga, LV-1021, Latvia (“Atlas Aerospace”, “we”).

Contact for data protection matters: info@atlasdynamics.eu, phone +371 661 000 46, or by post to the address above, marked “Data protection”.

2. Whom this Policy applies to

This Policy applies to the personal data of:

current, potential and former customers who are natural persons;
representatives and contact persons of our customers, distributors, suppliers and other business partners;
end users of our products, where their data is needed for export control or product support;
users of our website and information systems;
participants of our events, trainings and marketing activities;
visitors to our premises;
employees, visitors, contractors, suppliers and other persons who enter or pass through areas subject to video surveillance by Atlas Aerospace.

It covers data processed through our offices, information systems, website www.atlasuas.com and our social media pages on LinkedIn and YouTube. Information specific to website visitors and job applicants is given in our Privacy Policy, and about cookies in our Cookie Policy.

3. Categories of personal data

Depending on our relationship with you, we may process:

4. Purposes and legal bases of processing

Purpose

Legal basis (GDPR)

Preparing offers, concluding and performing contracts, deliveries, warranty and product support

Performance of a contract or steps before entering into it (Art. 6(1)(b)); our legitimate interest where the contract is with the company you represent (Art. 6(1)(f)).

Invoicing, payments and accounting

Legal obligation under Latvian accounting and tax law (Art. 6(1)(c)).

Export control, sanctions and end-user compliance

Legal obligation (Art. 6(1)(c)).

Customer service, consultations and informing customers about product updates

Performance of a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)).

Marketing, newsletters and events

Consent (Art. 6(1)(a)) or legitimate interest in informing existing customers about similar products (Art. 6(1)(f)).

Business analysis, planning and service improvement

Legitimate interest (Art. 6(1)(f)); we use aggregated data wherever possible.

Security of premises, people and IT systems (see section 5 for video surveillance)

Legitimate interest (Art. 6(1)(f)).

Responding to authorities and establishing, exercising or defending legal claims

Legal obligation (Art. 6(1)(c)) or legitimate interest (Art. 6(1)(f)).

Our legitimate interests include running and developing our business, maintaining good relationships with customers and partners, promoting our products, preventing financial, legal and security risks, and protecting our rights. Where we rely on legitimate interests, we assess that they are not overridden by your interests and rights. Where processing is likely to result in a high risk to you, we carry out a data protection impact assessment under Article 35 GDPR.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

5. Video surveillance

Atlas Aerospace carries out video surveillance at its premises and their immediate surroundings for the purposes of protecting its premises, property, production equipment, materials and products, as well as preventing, detecting and investigating unauthorised access, arson, vandalism, sabotage and other physical security incidents.

The legal basis for video surveillance is our legitimate interests under Article 6(1)(f) GDPR, namely ensuring physical security, protecting property and safeguarding our legal interests.

Video surveillance may include real-time monitoring and video recording. Audio recording, facial recognition, biometric identification, automated person tracking and profiling are not used.

Video surveillance is not used for systematic monitoring of employees’ working time, performance, productivity or behaviour.

Access to video recordings is restricted to authorised persons on a need-to-know basis. Security service providers may have access to live video images only to the extent necessary for the provision of security services.

Persons are informed of video surveillance by clearly visible signs that identify Atlas Aerospace and refer to this Policy, placed before entering the monitored area.

6. Sources of personal data

We receive personal data mainly from you. We may also receive it from the company you represent, our customers, distributors and business partners, public registers (such as the Latvian Register of Enterprises), sanctions lists, and publicly available professional sources.

7. Recipients of personal data

Your data is accessible to our employees who need it for their work. We may disclose it to:

companies of the XTEND group;
service providers acting as processors under a data processing agreement: IT, hosting and cloud service providers (for example Microsoft 365 or Google Workspace), website and analytics providers, IT consultants;
postal, courier and logistics companies;
banks and payment service providers;
insurers, legal advisers, auditors, debt collection agencies;
security service providers;
state institutions where required by law, for example the State Revenue Service, the Strategic Goods Control Committee, courts, law enforcement authorities and notaries.

8. Transfers outside the EU/EEA

We process personal data mainly in the EU/EEA. Where data is transferred to a country outside the EU/EEA, including to group companies or service providers, we ensure an appropriate level of protection: an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework for certified US companies) or the European Commission’s Standard Contractual Clauses with additional safeguards where necessary. You can request a copy of the relevant safeguards by contacting us.

9. Retention periods

We keep personal data only as long as necessary for the purpose it was collected for, or as long as required by law. In particular:

contract data — for the term of the contract and afterwards until the limitation period for claims expires (generally up to 10 years);
accounting documents — for the periods set by the Latvian Accounting Law;
export control records — for the periods set by export control and sanctions laws;
enquiries that do not lead to a contract — up to 3 years after the last communication;
marketing data — until you withdraw consent or object;
video surveillance recordings — no longer than 28 days, after which they are automatically deleted or overwritten. Where a specific security incident is identified, the relevant recording may be kept separately for as long as objectively necessary to investigate it, protect our legal interests or provide it to a competent authority.

After the retention period ends, the data is deleted or anonymised.

10. Your rights

Access — to find out whether we process your data and receive a copy of it and information about the processing.
Rectification — to have inaccurate or incomplete data corrected.
Erasure — to have your data deleted, for example when it is no longer needed, you have withdrawn consent, or it was processed unlawfully. This right does not apply where we must keep the data by law or need it to establish, exercise or defend legal claims.
Restriction — to have processing restricted while the accuracy or lawfulness of the data is being checked, or when you need the data for a legal claim.
Objection — to object to processing based on our legitimate interests; we will stop unless we have compelling legitimate grounds or need the data for legal claims. You can object to direct marketing at any time, and we will then stop using your data for this purpose.
Withdrawal of consent — at any time, without affecting processing carried out before the withdrawal.
Data portability — to receive data you provided to us in a structured, machine-readable format, or have it transmitted to another controller, where processing is based on consent or a contract and carried out by automated means.
Complaint — to lodge a complaint with the Data State Inspectorate of Latvia (Datu valsts inspekcija, Elijas iela 17, Rīga, LV-1050, www.dvi.gov.lv) or the supervisory authority of your EU country of residence.

To exercise your rights, contact us using the details in section 1. We may ask you to confirm your identity. We will respond within one month of receiving your request; this may be extended by two further months for complex requests, in which case we will inform you. Requests are handled free of charge unless they are manifestly unfounded or excessive.

11. Security

We apply appropriate technical and organisational measures to protect personal data, including access control, encryption, backup, staff confidentiality obligations and data processing agreements with our service providers. If a personal data breach occurs that is likely to result in a high risk to you, we will inform you and the supervisory authority as required by the GDPR.

12. Updates to this Policy

We review this Policy at least once a year and after significant changes in legislation or in our operations. The current version is always available on this page, and the date of the latest update is shown at the top.