Last updated: 10.11.2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between AtrioSolutions LLC (“AtrioMail”, “we”, “our”, “us”) and the customer (“Controller”, “you”, “your”) who uses AtrioMail services through atriomail.com, system.atriomail.com, and any other subdomains operated by AtrioSolutions LLC.

This DPA reflects the parties’ agreement regarding the processing of personal data in compliance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

1. Roles and Responsibilities

  • The Customer is the Data Controller and determines the purpose and means of processing personal data.
  • AtrioSolutions LLC is the Data Processor and processes personal data only on documented instructions from the Controller.
  • For the live chat in the control panel, AtrioSolutions LLC is an independent controller, not the Controller’s processor, except for the account data described in Annex 2. Annex 2 sets out how this works, including on a reseller’s hostname.

2. Subject Matter of Processing

AtrioMail provides email hosting and related services. The processing of personal data may include:

  • Creation and management of email accounts.
  • Transmission and storage of email data.
  • Logging for security, analytics, and error monitoring.
  • Billing and payment processing.
  • Support through the live chat, where an account holder gives a support code (Annex 2).

3. Duration of Processing

Processing begins when the Controller registers for AtrioMail services and continues until the account is terminated. Upon termination, all personal data is deleted immediately, except where retention is required by law (e.g., billing records), and except live chat conversations, which Annex 2 covers.

4. Types of Personal Data

The personal data processed may include:

  • Customer account details (name, email address, company, billing information).
  • End-user data within email accounts (email addresses, communication content).
  • Technical data (IP addresses, logs, device information).
  • Account data a support assistant reads or changes in the live chat at the account holder’s request: domain names, mailbox addresses, DNS, verification and migration status, and mailbox sign-in records including IP addresses (Annex 2).

5. Data Subject Categories

  • The Controller’s employees, contractors, or customers who use AtrioMail email accounts.

6. Obligations of AtrioSolutions LLC

AtrioMail shall:

  1. Process personal data only on documented instructions from the Controller.
  2. Ensure confidentiality of persons authorized to process personal data.
  3. Implement appropriate technical and organizational measures for security.
  4. Assist the Controller in fulfilling GDPR obligations, including data subject rights requests.
  5. Notify the Controller without undue delay in the event of a personal data breach.
  6. Delete or return all personal data upon termination of services, except live chat conversations, which Annex 2 covers.
  7. Make available information necessary to demonstrate compliance.

7. Sub-Processors

The Controller authorizes AtrioMail to engage the following sub-processors:

  • Hetzner Online GmbH (EU) , hosting infrastructure in Germany, and in Finland for the live chat and its assistant
  • Amazon Web Services SES (United States) , email delivery, including the live chat’s notification email
  • Sentry (EU) , error logging
  • Posthog (EU) , analytics
  • Stripe, Inc. (US/EU) , payment processing
  • OpenAI, L.L.C. (United States) , the AI assistant in the live chat (Annex 2)
  • Chatwoot, Inc. (United States) , relays live chat notifications, which contain message text, to our support team’s mobile app through Google Firebase Cloud Messaging (Annex 2)

AtrioMail shall ensure that sub-processors are bound by written agreements that meet GDPR standards.

8. International Transfers

Although AtrioSolutions LLC is incorporated in the United States, personal data is primarily processed within the European Union.
Where data is transferred outside the EU, AtrioMail uses safeguards such as the European Commission’s Standard Contractual Clauses (SCCs).
Some sub-processors are in the United States: Amazon SES for email delivery and, for the live chat, OpenAI and Chatwoot (Annex 2). For these, AtrioMail relies on the EU-US Data Privacy Framework where the sub-processor is certified under it, and otherwise on the SCCs.

9. Controller Obligations

The Controller is responsible for:

  • Ensuring that data subjects’ personal data is collected lawfully.
  • Providing necessary notices and obtaining consent where required.
  • Maintaining the accuracy of data submitted to AtrioMail.

10. Governing Law

This DPA is governed by the laws of the State of Delaware, United States.
For EU customers, AtrioMail complies with GDPR requirements for processing personal data.

11. Contact

Questions regarding this DPA should be directed to:

AtrioSolutions LLC
131 Continental Dr, Suite 305
Newark, DE 19713, United States
Phone: +1 (302) 520 3708
Email: privacy@atriomail.com

Annex 1. United Kingdom

This Annex applies where, and to the extent that, personal data processed under this DPA is subject to UK data protection law, meaning the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025 which amends both. It supplements the DPA above, and where the two conflict in respect of that data, this Annex prevails. Our wider UK statement is at UK data protection statement.

1. How this DPA is read for UK data. For personal data covered by this Annex:

  • references to the GDPR are read as references to the UK GDPR, and references to an Article of the GDPR are read as the corresponding Article of the UK GDPR;
  • references to a supervisory authority are read as the Information Commissioner’s Office (ICO);
  • references to Union or Member State law are read as the law of the United Kingdom.

2. Restricted transfers out of the United Kingdom. Where processing under this DPA involves a restricted transfer of personal data out of the UK, the parties agree the following safeguards apply:

  • To the EEA. AtrioMail stores and processes customer data on infrastructure in the European Union. The United Kingdom’s adequacy regulations cover the EEA, so no further transfer safeguard is required for these transfers.
  • To the United States and other third countries. The parties rely on the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) where the recipient is certified under it, and otherwise on the ICO’s International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, which are incorporated into this DPA by reference and completed with the details set out in this DPA. Where the IDTA or the Addendum applies, AtrioMail carries out a transfer risk assessment and makes it available to the Controller on request.
  • Updated ICO documents. The ICO has said it will issue updated versions of the IDTA and the Addendum during 2026 following the Data (Use and Access) Act 2025. The parties will use the updated versions once they are in force.

3. Transfers into the United Kingdom. On 19 December 2025 the European Commission renewed its adequacy decisions for the United Kingdom, which run until 27 December 2031. Personal data therefore moves between the UK and AtrioMail’s European infrastructure without additional transfer paperwork.

4. Data subject requests and complaints. AtrioMail assists the Controller in responding to requests from data subjects exercising their rights under UK GDPR. Where a data subject contacts AtrioMail directly about data AtrioMail processes on the Controller’s behalf, AtrioMail passes the request to the Controller promptly rather than answering it. Individuals may also complain to AtrioMail directly about AtrioMail’s own handling of their personal data, which AtrioMail acknowledges within 30 days, and to the ICO at any time.

5. Personal data breaches. AtrioMail notifies the Controller of a personal data breach without undue delay after becoming aware of it, and provides the information the Controller needs to meet its own duty to notify the ICO within 72 hours where the breach is likely to result in a risk to people’s rights and freedoms.

6. Governing law. Section 10 above continues to apply. Nothing in this DPA or this Annex deprives a data subject in the United Kingdom of the protections or remedies available to them under UK data protection law, including the right to complain to the ICO and the right to an effective judicial remedy.

Annex 2. Live Chat

This Annex explains how the live chat in the control panel relates to this DPA. Our Privacy Policy describes the chat in full.

1. Who can use it. Anyone signed in to the control panel, after the two-factor sign-in, can use the live chat, including the Controller’s users and, on a reseller’s hostname, the reseller’s clients. It is on by default. A reseller can switch it off for each of its hostnames in its white-label settings; the control panel then does not load the chat on that hostname and sends nothing to it.

2. Our role for the chat. For the chat itself (who uses it, what they write, and what the control panel sends to identify them: an opaque identifier, their name, account role and signup date, never their email address) AtrioSolutions LLC is an independent controller, not the Controller’s processor. The Controller does not receive these conversations. AtrioMail does not copy the Controller on its clients’ chats, and does not tell it when one of them uses a support code.

3. Account data in a chat. An account holder can paste a one-time support code into the chat. For that chat, the support assistant may then read the account’s domains, mailboxes, migrations, DNS status and mailbox sign-in records, and, after the account holder says yes in the chat to each change, make one of a limited set of changes to the account’s own domains and mailboxes. That account data stays covered by this DPA, and the support code and the account holder’s yes are the documented instruction for that processing. As part of the conversation it can reach the live chat sub-processors listed in section 7.

4. Single sign-on. Anyone who opens a client’s control panel through single sign-on from WHMCS or Blesta is identified to the chat as that client, so what they write is recorded under that client.

5. Retention. Conversations, including account data that became part of them, are kept and deleted as set out in our Privacy Policy (currently 12 months after the last message), also after the account is terminated.

6. Telling your clients. Where a reseller’s clients accept the reseller’s own privacy policy on its hostname instead of ours, the reseller agrees to tell them that the live chat in the control panel is provided by AtrioSolutions LLC under its own Privacy Policy, or to switch the chat off for that hostname.