Atomic Campus
The compliance pack
Last updated: September 22, 2026
The documents your data-protection officer, your procurement office and your counsel open before a class goes live. The text that binds Atomic Reps is on this site and needs no account to read. We send the rest by email, and this page says which is which so nobody waits on a document that is already a click away.
Read now, no account
DPA Schedule E is the Article 28 instrument for a provisioned seat. Send it first. It names the controller for each seat type, the categories of data, the retention window, the sub-processors and their regions, and the route a student rights request takes.
The privacy policy carries the commitment that no answer is used to train a model, sold or shared. The security page covers access, encryption and incident handling.
Four answers your reviewer wants first
- Controller per seat. For seats the institution provisions, the institution is controller. A student who buys their own account with a verified school email never appears in any institution's console. Schedule E, clause E1.
- No score, level, rank, risk flag or recommendation. The console reports observed facts and computes nothing about a student. The limit is a signed clause and a pinned automated test. Schedule E, clause E3.
- Class rows have an end date. We delete them 90 days after the term end recorded on the course, or sooner if the institution sets a shorter window. Schedule E, clause E4.
- Class data is stored in the EU. In Ireland, in pseudonymous tables keyed by account id, with the EU Standard Contractual Clauses covering vendor support access from the United States. Sign-in identity sits with Clerk in the United States under the EU-US Data Privacy Framework. Schedule E, clause E5.
What is in the pack
10 documents. Each row says who opens it and what it settles, so your reviewer can ask for the two they need rather than the set.
DPA Schedule E, Atomic Campus
On this siteLegal and procurement
The Article 28 terms for a provisioned seat: who is controller on each side of the door, what an instructor can see, how long class rows live, which sub-processors touch them, and how a student rights request is routed and answered.
Schedule A to the order form
By emailProcurement
The never-build list as a clause you counter-sign, with termination for breach. The list itself is already public in Schedule E, clause E3.
DPIA template, Article 35
By emailDataskyddsombud
The assessment pre-filled with the processor's side of the facts, so the institution completes its own fields and signs as controller instead of starting from an empty form.
Data inventory
By emailDataskyddsombud
Field by field: what is stored, in which table, why it is there, how long it stays, and whether the school or the vendor can read it. It is also the answer when someone asks what you hold about our students.
Transfer impact assessment
By emailDataskyddsombud
The Chapter V assessment for every sub-processor, and where class data physically sits. Schedule E clause E5 names the sub-processors and the regions.
Position: the instructor console is not an AI system
By emailLegal
The argument that the console falls outside Article 3(1) of the AI Act, and the two product changes that would reopen the question. Schedule E clause E3 carries the commitment the argument rests on.
The published constants
By emailDataskyddsombud and procurement
Every number the class re-ask runs on, dated and versioned: how big a week's returning set is, how far back the two lags reach, the rates a tutor may set and their ceiling, and the class-size floor below which no count is shown at all. Schedule A section 6 points at this page for them.
Fundamental-rights impact assessment, Article 27
By emailA public deployer
A short skeleton for a public university whose own process asks for a fundamental-rights assessment. Short on purpose.
FERPA school-official rider
By emailUnited States counsel
The school-official designation under 34 C.F.R. Part 99: institutional function, direct control, purpose limitation, and deletion on termination, written the way most institutions word it.
Två sidor för dataskyddsombudet
By emailDataskyddsombud
Vad som behandlas, vem som är personuppgiftsansvarig, var uppgifterna ligger och vilken rättslig grund som gäller. Finns även i en variant för arbetsgivare, med noten om MBL 11 §.
Asking for a document
Email legal@atomicreps.com with the institution, the course and the documents you want. Markdown or PDF, whichever your review process files. Schedule E clause E5 already names this route for the transfer impact assessment, and the rest of the pack comes the same way.
A document marked by email is a draft under counsel review. When counsel clears one for publication it moves onto this site and its row links to it.
See also: Atomic Campus · Data Processing Agreement · Privacy Policy · Security