Your information deserves careful handling.

1. Who this policy covers

This policy covers the Atlas marketing website, authorised customer web and Android access, platform administration and agreed evaluations. Access currently remains controlled; public registration and Live payments require separate activation.

Atlas is a product operated under the CTRY Labs trading brand. CTRY Labs is not a registered limited company.

Business address: 1331 Sarnia Road, Durban, KZN, South Africa. General enquiries: hello@ctrylabs.com. Customer support: support@ctrylabs.com. Privacy: privacy@ctrylabs.com.

Legal supplier: Dylan Charl Trytsman, trading as CTRY Labs, a sole proprietor.

Customer-contact telephone: +27814270960.

2. Our role and your organisation’s role

For account, security, billing and direct enquiry information, CTRY Labs determines why and how information is processed. For employee, payroll, leave, loan, document and other business records entered by a customer organisation, that organisation ordinarily determines the purpose of processing and CTRY Labs processes the information to provide Atlas. Your organisation remains responsible for having an appropriate legal basis, giving required notices and configuring authorised access.

3. Information processed by Atlas

The information processed depends on the modules your organisation enables and the information it supplies.

• Account and identity data, including names, email addresses, roles, authentication events and limited device/session information.
• Organisation and employee records, including contact and emergency-contact details, employment, payroll, timesheet, leave and employer-loan information. Leave evidence or uploaded files may contain health information.
• Documents and files uploaded to enabled modules, together with metadata, scan status and audit history.
• Financial and subscription records where billing is enabled; full payment-card details are handled by the payment provider and are not stored by Atlas.
• Usage, diagnostic, security, support and audit information required to operate and protect the service.
• Mobile notification tokens and delivery state when mobile notifications are enabled.

4. Why we process information

We process information to provide, secure and support Atlas; authenticate users; enforce company and module permissions; calculate and record requested business operations; deliver transactional messages; investigate incidents; maintain reliable audit history; improve the service; and meet legal obligations. We do not sell personal information or use customer business data for behavioural advertising.

5. Legal grounds

Processing may be based on performance of our agreement with the customer organisation, steps requested before entering an agreement, legal obligations, consent where specifically requested, and legitimate interests in securing and improving Atlas. Customer organisations are responsible for the lawful basis applicable to the employee and business information they place in Atlas.

6. Providers and subprocessors

The current service uses the providers below for the stated functions. Enabled features determine which providers receive information. Their accounts and processing arrangements must meet the requirements applicable to the customer’s approved service scope. We will communicate material provider changes affecting customer records.

• Hetzner: application and PostgreSQL hosting in Helsinki, Finland, plus encrypted off-host backup storage in Helsinki, Finland.
• Cloudflare: public website hosting, content delivery, DNS and security; technical requests may be processed across its network.
• Amazon Web Services: private document storage in Cape Town, South Africa (af-south-1), and enabled Textract processing using temporary copies in Ireland (eu-west-1).
• Resend: transactional message recipients, message content and delivery events. Email open and click tracking is disabled.
• Zoho Mail: business enquiries, support and privacy correspondence sent to our email addresses.
• Expo and Google Firebase Cloud Messaging: enabled Android notification registration, delivery and limited notification content; Expo also supports application builds and distribution.
• Grafana Cloud and Better Stack: service-health metrics, uptime checks, alerts and filtered operational diagnostics. The off-server log projection excludes raw application messages and sensitive fields; it is not a customer-record archive.
• Paystack, only when payments are activated: billing email, amount, currency, an opaque transaction reference and the callback URL. Atlas does not send employee, payroll or document records, or internal company/invoice identifiers as payment metadata.

7. Storage locations and international transfers

Atlas is not a South-Africa-only hosting service. Account and company databases and encrypted platform backups are hosted in Finland. Private AWS document originals are stored in Cape Town. Enabled extraction uses temporary AWS Ireland copies, removed after processing with one-day lifecycle expiry as a safety net.

Email, website delivery, monitoring and mobile notification providers may process information internationally. The named locations above do not mean every provider copy stays in those countries. Ask privacy@ctrylabs.com for information needed to assess your organisation’s requirements before onboarding.

We and your organisation must establish the applicable processing agreements and lawful transfer basis for the authorised service scope. Publishing this policy or accepting the service terms does not itself establish overseas statutory-record authorisation. Any required record-storage authorisation must be resolved before relying on Atlas for that statutory purpose.

8. Cookies and tracking

Atlas uses strictly necessary cookies and similar storage for authentication, security and user-requested preferences. Web refresh tokens use secure, HTTP-only cookies. We do not use advertising cookies. Transactional email open and click tracking is disabled by design. If optional analytics are introduced, we will update this policy and request consent where required.

9. Retention and deletion

Customer business records follow the organisation’s lawful instructions, module rules and applicable obligations. Locked payroll, financial records, audit evidence, shared files and legal holds require an individual retention assessment; cancelling access is not automatic erasure.

Our billing-record policy retains invoices, credits, payments and financial audit for seven years after the relevant financial year end, or longer where an applicable filing, audit, dispute or hold requires it. Unnecessary raw payment-provider payloads have a 90-day retention policy; required transaction evidence is retained separately. Removal requires reviewed eligibility and hold checks, not an indiscriminate age-based purge.

After Document Vault cancellation takes effect at the paid-period end, the policy provides 30 days of read/download/export access without new uploads, then restricted recovery until eligible Vault-specific data can be deleted from day 60 total after that paid-period end. Advance notice, verified eligibility and legal/shared-record safeguards apply; day 60 is not a promise that all records or backups are erased.

Encrypted platform backups use rolling retention of 14 daily, 8 weekly and 12 monthly restore points. A copy can satisfy more than one interval, and the newest two verified copies are protected. Separate Storage Box snapshots and legal holds may retain copies beyond live-record removal. Backup information is restricted to recovery and expires under its separate retention controls, not immediately on an account-deletion request.

Request access, correction or deletion through privacy@ctrylabs.com or the public deletion instructions above. We verify the requester and scope, coordinate with the organisation and explain eligible removal, retained data and applicable periods. Removing Atlas access does not automatically delete a shared CTRY Identity account or other applications.

10. Security and access

Atlas uses encrypted transport, role-based company access, server-side validation, secure session handling, multi-factor protection for platform administration, malware scanning for uploads, private file storage, audit logging, backups and least-privilege operational access. Customers are responsible for assigning appropriate roles, protecting credentials and promptly reporting suspected misuse. No service can guarantee absolute security.

11. Your rights

Depending on applicable law, individuals may have rights of access, correction, deletion, restriction, portability, objection and withdrawal of consent. Employees should ordinarily contact their organisation first because it controls their business records. You may also email privacy@ctrylabs.com. We will coordinate with the relevant organisation and may verify identity before acting. You may complain to the Information Regulator of South Africa or another competent authority.

12. Children, automated decisions and changes

Atlas is a business service and is not directed to children. Atlas does not make solely automated decisions that produce legal or similarly significant effects on individuals. Organisations review and approve business actions and remain responsible for their decisions. We will communicate material policy changes through appropriate channels.

13. Contact

Privacy questions and data-subject requests: privacy@ctrylabs.com. Product enquiries: atlas@ctrylabs.com. Customer support: support@ctrylabs.com. Do not send passwords, PINs, MFA codes or unnecessary identity documents by email.