GDPR & UK GDPR

⚠ Held back from publication

Same two dependencies as the Privacy Policy: Article 27 representatives and a live CMP.

This page is noindex and excluded from the sitemap until that is resolved. Fields still to complete: [NAME] [ADDRESS IN EEA MEMBER STATE] [EMAIL] [UK ADDRESS] [NAME AND CONTACT]

Last Updated: August 17, 2026

At a Glance

This summary is for convenience only. The full page below governs.

This page covers your rights under the EU and UK GDPR. It sits alongside our Privacy Policy, which carries the detail on retention, security, and sub-processors.

If your business contact details are in our database and you've never dealt with us, go to Section 6. It sets out where we got your data, why we hold it, and how to get it removed. You don't need an account and there's no fee.

Your right to object to marketing is absolute. If you tell us to stop, we stop. We don't weigh it against our interests, because the law doesn't let us.

We do profile. Our system scores contacts for fit and engagement. Section 8 explains the logic and your rights over it.

We're not in the EU. Our representatives there are named in Section 3, and you can complain to your own national authority — Section 11.

Timescales. We acknowledge within 5 business days and answer within one month.

1. Scope of This Page

This page supplements the Marketing Titan Privacy Policy with information specific to the General Data Protection Regulation (EU) 2016/679 and the UK GDPR and Data Protection Act 2018.

It applies if you are in the European Economic Area or the United Kingdom and either:

you are a Marketing Titan customer or user; or
you are a business contact whose information appears in our database but who has no relationship with us. Section 6 is written for you.

Where this page and the Privacy Policy address the same subject, this page governs for EEA and UK data subjects. For retention periods, sub-processor identities, and security measures, this page links to the Privacy Policy rather than restating them.

2. Who We Are

Controller AtmosAI, Inc. 30 N Gould St, Ste. R Sheridan, WY 82801 United States

2.1 Our Role

We act as a controller for our own account data, service telemetry, and the Marketing Titan business contact database. We act as a processor for CRM records, campaign audiences, message content, and creative assets that customers put into the Service. Section 2 of the Privacy Policy sets out the full split. This distinction determines which rights below apply to which data.

Where we act as processor, we will forward your request to the relevant customer — the controller — without undue delay and assist them in responding.

3. Data Protection Officer and Representatives

3.1 Data Protection Officer

[NAME] dpo@marketingtitan.ai 30 N Gould St, Ste. R, Sheridan, WY 82801

Our Data Protection Officer operates independently, reports to the highest level of management, and may be contacted directly and confidentially by any data subject or supervisory authority.

[NAME] [ADDRESS IN EEA MEMBER STATE] [EMAIL]

EEA data subjects and supervisory authorities may contact our EU Representative on all matters relating to the processing of personal data.

[NAME] [UK ADDRESS] [EMAIL]

4. Legal Bases for Processing

Processing activity	Legal basis
Providing the Service under your subscription	Contract — Art. 6(1)(b)
Billing, invoicing, collections	Contract — Art. 6(1)(b); Legal obligation — Art. 6(1)(c)
Compiling, verifying, and maintaining the business contact database	Legitimate interests — Art. 6(1)(f). Our interest: operating a lawful B2B data service that enables business development. See Section 6.
Making contact records available to customers	Legitimate interests — Art. 6(1)(f). See Section 6.
Verifying email deliverability and phone validity	Legitimate interests — Art. 6(1)(f): accuracy, and reducing misdirected contact
Lead scoring and audience segmentation	Legitimate interests — Art. 6(1)(f). See Section 8.
AI content and creative generation	Contract — Art. 6(1)(b)
Security, fraud prevention, abuse detection	Legitimate interests — Art. 6(1)(f); Legal obligation — Art. 6(1)(c)
Product analytics and Service improvement	Legitimate interests — Art. 6(1)(f)
Marketing to you about our products	Consent — Art. 6(1)(a), or soft opt-in where available
Non-essential cookies	Consent — Art. 6(1)(a) and ePrivacy/PECR
Call recording	Consent — Art. 6(1)(a), obtained by the customer as controller
Retaining consent and opt-out records	Legal obligation — Art. 6(1)(c); Legitimate interests — Art. 6(1)(f)
Responding to legal process	Legal obligation — Art. 6(1)(c)

Legitimate Interest Assessments. Where we rely on Art. 6(1)(f), we assess and record the balance between our interests and the rights and freedoms of the individuals concerned, and we review that assessment when processing changes materially.

Special category data. We do not process Art. 9 special category data through the Service, and customers are contractually prohibited from uploading it absent a separate written agreement.

5. Categories of Data and Recipients

For the full description of what we collect, see Sections 3 and 6 of the Privacy Policy. In summary, we process account and identity data, service usage and telemetry, CRM and campaign data as processor, AI prompts and generated outputs, and business contact records.

5.1 Recipients

Personal data is disclosed to:

Marketing Titan customers. Business contact records in our database are made available to subscribing businesses for B2B sales and marketing. This is the principal disclosure of contact data and is described in Section 6.
Sub-processors, listed with name, function, and processing location at marketingtitan.ai/subprocessors.
Advertising platforms, where a customer instructs us to upload audience data. The customer is controller of that disclosure.
Third-party platforms you connect via OAuth or API. These are independent controllers, not our sub-processors.
Professional advisers, auditors, and insurers, under confidentiality obligations.
Public authorities, where required by valid legal process.

5.2 Sub-Processors

A complete and current list of our sub-processors, including each entity's name, processing function, and processing location, is maintained at marketingtitan.ai/subprocessors.

We give at least 30 days' notice before adding or replacing a sub-processor. Customers may subscribe to change notifications and may object on reasonable data protection grounds, as set out in the Data Processing Addendum.

5.3 Retention

Retention periods are set out at Section 15 of the Privacy Policy.

6. Notice to Business Contacts — Article 14

This section is for you if you are not a Marketing Titan customer but your business contact information appears in our database.

We may hold information about you even though you have never interacted with us. Under Art. 14 you are entitled to the following information.

What we hold. Your name; business email address; business phone number, which in some cases is a mobile number; job title and seniority; employer name, location, industry, and size; professional profile URLs; and derived attributes including inferred role category and engagement or fit scores generated by our systems.

Where it came from. Publicly accessible business sources — company websites, public filings and registries, professional and business networking profiles, published directories, press sources, and event materials — together with records licensed from third-party data suppliers. Contact details are checked through specialist verification providers.

Why we process it and on what basis. To enable lawful business-to-business commerce: helping companies identify relevant business contacts and ensuring contact details are accurate. Our legal basis is legitimate interests under Art. 6(1)(f), supported by a documented balancing assessment that considers the professional rather than private character of the data, your reasonable expectations, and the availability of an unconditional opt-out.

Who receives it. Marketing Titan customers — businesses subscribing to the Service — and the sub-processors listed at marketingtitan.ai/subprocessors.

How long we keep it. Records are reviewed on a 24-month cycle and removed when they can no longer be verified.

International transfer. Your data is transferred to the United States under the safeguards described in Section 9.

Your rights. All the rights in Section 7 apply to you, including an unconditional right to object to direct marketing.

6.1 How to Exercise Your Rights If You Are Not a Customer

You do not need an account and you will not be asked to create one. Email privacy@marketingtitan.ai or use the form at marketingtitan.ai/opt-out. There is no fee.

Provide only the identifiers you want us to search for — typically an email address, or a name and employer. We will not require identity documents or additional personal data beyond what is necessary to locate your record and confirm the request is genuinely yours.

Deletion is permanent. When we delete your record we remove it and retain no copy. Because our database is compiled on an ongoing basis from public and licensed sources, information about you may be collected again from those sources in future. If that happens, you may submit a further request and we will delete it again.

Copies already exported. Customers who exported your record before your request hold their own copies and are controllers of those copies. We will notify customers known to hold your record and instruct them to delete it, and we will identify them to you on request so that you can approach them directly.

7. Your Rights

Access (Art. 15) — a copy of your personal data and information about how and why it is processed
Rectification (Art. 16) — correction of inaccurate or incomplete data
Erasure (Art. 17) — deletion, subject to limited legal exceptions
Restriction (Art. 18) — restriction of processing in defined circumstances, such as while accuracy is contested
Portability (Art. 20) — your data in a structured, commonly used, machine-readable format, and transmission to another controller where technically feasible
Objection (Art. 21) — see below
Automated decision-making (Art. 22) — see Section 8
Withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of prior processing
Complain to a supervisory authority (Art. 77) — see Section 11

7.1 The Right to Object

Objection to direct marketing (Art. 21(2)–(3)). Where you object to processing for direct marketing purposes, including profiling related to direct marketing, we will stop. This right is absolute. We do not assess your reasons, we do not weigh competing interests, and there is no exception we can invoke.

Objection to other processing based on legitimate interests (Art. 21(1)). Where you object to processing that relies on Art. 6(1)(f) for a purpose other than direct marketing, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or that the processing is needed to establish, exercise, or defend legal claims. Where we rely on this, we will explain our reasoning to you in writing.

7.2 How to Exercise Your Rights

If you are a customer or user: email privacy@marketingtitan.ai from your account email address, or use marketingtitan.ai/privacy-request.

If you are not a customer: see Section 6.1. No account is required.

7.3 Timescales

We acknowledge requests within 5 business days and respond substantively without undue delay and within one calendar month of receipt, as required by Art. 12(3).

Where a request is complex, or where we have received a number of requests from you, we may extend by up to two further months, giving a maximum of three months in total. We will tell you within the first month if we extend, and why.

Requests are free. Where a request is manifestly unfounded or excessive, particularly if repetitive, we may charge a reasonable administrative fee or refuse to act, under Art. 12(5). We bear the burden of demonstrating that a request meets that threshold, and we will explain our reasoning and your right to complain.

8. Profiling and Automated Decision-Making

We do carry out profiling. The Service generates derived attributes about business contacts, including lead scores, ideal-customer-profile match indicators, and engagement predictions. These are profiling within the meaning of Art. 4(4).

The logic involved. Scores are generated by models that weigh publicly sourced professional attributes — role seniority, function, and employer characteristics such as industry and size, and where available engagement signals — against criteria a customer specifies when describing their target audience. A higher score indicates a closer match to those stated criteria. Scores do not incorporate special category data.

Significance and consequences. A score influences whether a customer chooses to contact you. It does not by itself determine access to any good, service, credit, employment, or benefit.

Article 22. Where a score informs a human decision about whether to make contact, we do not consider Art. 22(1) to be engaged. Where any feature acts on a score without human review, you have the right not to be subject to that decision, and we provide human intervention on request. In either case you may request human review, express your point of view, contest the outcome, and object to the profiling entirely under Section 7.1.

8.1 EU AI Act Transparency

Separately from the GDPR, Article 50 of Regulation (EU) 2024/1689 requires that individuals be told when they are interacting with an AI system, and that synthetic audio, image, video, and text be marked as artificially generated. These obligations apply from 2 August 2026. Section 7.5 of the Privacy Policy sets out how we meet them and what falls to our customers as deployers.

8.2 AI Model Training

We do not train artificial intelligence or machine learning models on customer data. We do not develop our own models; our AI features are powered by third-party providers, configured to disable training on customer data where that option is available. See Section 7 of the Privacy Policy.

9. International Transfers

AtmosAI, Inc. is established in the United States. Personal data from the EEA and the UK is transferred to the United States and to other jurisdictions where our sub-processors operate.

EEA transfers are made under the European Commission's Standard Contractual Clauses (Decision 2021/914), using the modules appropriate to each relationship, together with supplementary technical and organisational measures.

UK transfers are made under the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs, as issued by the Information Commissioner under s.119A(1) of the Data Protection Act 2018.

Transfer impact assessments. We assess the legal framework of each recipient country and the effectiveness of our safeguards, and we document those assessments. Copies of the transfer mechanisms are available on request.

9.1 Government Access Requests

Unless legally prohibited, we will notify you of any legally binding request from a public authority for your personal data, challenge requests that are unlawful or overbroad, and provide only the minimum data legally required.

10. Data Protection Impact Assessments

We carry out Data Protection Impact Assessments under Art. 35 where processing is likely to result in a high risk to individuals' rights and freedoms, and we review them whenever processing changes materially. Areas subject to assessment include compilation and licensing of the business contact database, automated lead scoring and audience profiling, AI-assisted voice calling, and AI content generation.

11. Complaints and Supervisory Authorities

Please raise concerns with our Data Protection Officer first — we would rather resolve them directly. You are not required to do so, and doing so does not affect your rights.

You may lodge a complaint with a supervisory authority in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

United Kingdom: Information Commissioner's Office
EEA: your national authority. A current list is maintained by the European Data Protection Board.

You also have the right to an effective judicial remedy under Arts. 78 and 79, and to mandate a not-for-profit body to act on your behalf under Art. 80.

12. Records, Breach, Security, and Cookies

Records of processing (Art. 30). We maintain written records of our processing activities and make them available to supervisory authorities on request.

Personal data breaches (Arts. 33–34). We notify the competent supervisory authority within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals' rights and freedoms, and we notify affected individuals without undue delay where the breach is likely to result in a high risk. Where we act as processor, we notify the controller without undue delay. Detection, investigation, and escalation procedures are documented and routed to the Data Protection Officer and security team on discovery.

Security (Art. 32). Measures are described at Section 13 of the Privacy Policy.

Cookies. Non-essential cookies are set only after you give consent through our consent banner, with category-level granularity. Consent can be withdrawn at any time at marketingtitan.ai/cookie-preferences, as easily as it was given.

13. Contact

AtmosAI, Inc. 30 N Gould St, Ste. R Sheridan, WY 82801

Data Protection Officer: dpo@marketingtitan.ai Privacy and rights requests: privacy@marketingtitan.ai Non-customer opt-out: marketingtitan.ai/opt-out

EU Representative: [NAME AND CONTACT] UK Representative: [NAME AND CONTACT]