1. Introduction and scope

This Privacy Policy explains how the ATLAS international group processes personal data in connection with this website (www.atlas-int.eu), contacts by email or telephone, and our business relationships with customers, partners and suppliers.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications Digital Services Data Protection Act (TDDDG) and the Swiss Federal Act on Data Protection (FADP/revDSG). Where these laws differ, we apply the stricter requirement.

Personal data is any information relating to an identified or identifiable natural person, such as name, postal address, email address, telephone number or IP address.

Version: October 2026

2. Controller and contact

The controller for the processing described in this Privacy Policy is:

ATLAS international AG
Bahnhofstrasse 20
6300 Zug
Switzerland

+41 44 777 10 58
info@atlas-int.eu

and

ATLAS international GmbH
Habsburgerring 2 (Westgate)
50674 Cologne
Germany

+49 221 540 25 90
info@atlas-int.eu

Data protection contact: For all questions about data protection and to exercise your rights, please contact info@atlas-int.eu or write to one of the physical addresses above, marked "Data Protection".

3. Visiting our website

You can use this website without telling us who you are. Your connection is encrypted (TLS).

Server log files. When you open a page, your browser automatically transmits data that our hosting provider stores in log files: IP address, date and time of access, page requested, referrer URL, HTTP status code, amount of data transferred, browser type and operating system. We need this data to deliver the website and to keep it stable and secure, for example to detect attacks. Legal basis is our legitimate interest under Art. 6 (1) (f) GDPR. Log files are deleted as soon as they are no longer needed for these purposes.

Hosting. The website is hosted by Webflow, Inc., San Francisco, USA, which processes the data on our behalf. Data may therefore also be processed in the USA. The safeguards described in Section 7 apply.

Cookies. We use only cookies and similar technologies that we consider necessary to operate and protect the website (Section 25(2) TDDDG). These include a session cookie (_cfuvid) that our hosting provider sets via its network service Cloudflare to protect the website against attacks, and the spam protection on our contact form (Section 4). You can block or delete cookies in your browser settings; some functions of the website may then not work.

External links. Our website links to other websites, for example LinkedIn. We have no influence on the processing there. Data is only transmitted to the provider once you click the link.

4. Contacting us

If you contact us by email, telephone or via the contact form, we process the data you provide to handle your request (Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR). Contact form entries are stored on our behalf by our hosting provider Webflow, Inc. (Section 3). We delete the data once your request has been dealt with, unless statutory retention obligations apply (Section 8).

To protect the form against spam and automated misuse, we use Google reCAPTCHA (Google Ireland Limited, Dublin, Ireland). reCAPTCHA processes your IP address and device and usage data, and may transfer them to Google LLC in the USA, which is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. The legal basis is our legitimate interest in protecting our website against misuse (Art. 6(1)(f) GDPR, Section 25(2) TDDDG). You can object to this processing (Section 9); in that case, please contact us by email or telephone instead of using the form.

5. Business partners and compliance checks

We supply government organisations in a sensitive, export-controlled sector. Under our Trade Compliance Policy and our Code of Conduct, we therefore check customers, end users, sales partners and suppliers before and during the business relationship. This affects contact persons, managing directors, board members, shareholders and beneficial owners of these organisations.

Contract and business contact. We process names, positions, business contact details and communication content to prepare and perform contracts and tenders (Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR where the data subject is not a contracting party).

Know-Your-Customer checks. We request documents such as commercial register extracts and share registers. With the help of specialised software and publicly available sources, we check identity, function, ownership and control, politically exposed person (PEP) status, public reports, legal proceedings and entries on sanctions, embargo and restricted party lists. The checks are repeated at regular intervals the risk profile and when relevant changes occur.

Sanctions list screening and end-use control. All parties to a transaction are screened against EU, UN, US and applicable national sanctions lists when an order is accepted and, where required, again before delivery. For listed or licensable goods and for certain destinations, we obtain end-use certificates naming the end user and end use.

Legal basis for these checks is compliance with legal obligations under EU and national export control and sanctions law (Art. 6 (1) (c) GDPR, for Germany in conjunction with the AWG and AWV) and our legitimate interest in preventing sanctions violations, money laundering, terrorist financing and corruption (Art. 6(1)(f) GDPR). Information on criminal offences from public sources is processed only to the extent permitted by Art. 10 GDPR. Under Swiss law, this processing is justified by our overriding private interest in checking the creditworthiness and reliability of business partnersand by legal requirements (Art. 31 FADP).

We do not make automated individual decisions. A possible match is always reviewed by our Group Trade Compliance Officer, who decides on the next steps.

We usually collect this data from the business partner itself, from public registers, sanctions lists, media and other public sources, and from compliance information providers.

6. Reports of violations (whistleblowing)

Employees and external partners can report actual or suspected violations of law, our Code of Conduct or our Trade Compliance Policy to compliance-tco@atlas-int.eu. The Group Trade Compliance Officer is the internal reporting office under the German Whistleblower Protection Act (HinSchG).

We process the data contained in a report (identity of the reporting person, if given, persons named, facts described) to investigate the matter and take follow-up action. Legal basis is Art. 6(1)(c) GDPR in conjunction with Section 10 HinSchG, and otherwise our legitimate interest in detecting and preventing violations (Art. 6(1)(f) GDPR).

Reports can be made anonymously. The identity of the reporting person and of the persons named is treated confidentially and disclosed only where the law requires it, for example to public authorities. Documentation is deleted three years after the procedure has been completed, unless a longer period is required by law (Section 11(5) HinSchG).

7. Recipients and transfers abroad

Within the group, ATLAS international AG and ATLAS international GmbH share data to the extent required for joint projects, central group compliance and administration (Art. 6(1)(f) GDPR).

We also use service providers who process data on our behalf and are bound by data processing agreements: hosting, IT, cloud and communication services (including email, file storage and AI-assisted analysis tools), providers of compliance and sanctions screening databases, and specialised trade compliance consultants. Where required, we disclose data to public authorities, in particular export control, customs and law enforcement authorities, and to auditors and legal advisers.

Some recipients are located outside Switzerland and the EU/EEA, in particular in the USA. Transfers take place only if the country has been recognised as providing adequate protection (for the USA, for certified companies under the EU-U.S. or Swiss-U.S. Data Privacy Framework), if we have agreed EU Standard Contractual Clauses (with the amendments required for Switzerland), or if an exception under Art. 49 GDPR or Art. 17 FADP applies. Such an exception applies in particular where the transfer is necessary to perform a contract with you or in your interest, for example with government customers and partners in project countries. You can request a copy of the safeguards used from the contact address in Section 2.

8. Retention

We store personal data only as long as necessary for the purpose for which it was collected. Data from business relationships, including compliance and screening records, is kept for the duration of the relationship and then for as long as statutory retention obligations require. These are in particular up to 10 years under commercial and tax law (Art. 958f Swiss Code of Obligations, Section 257 German Commercial Code, Section 147 German Fiscal Code) and at least 5 years for export control records (Art. 27 Regulation (EU) 2021/821). Data may also be kept for as long as needed to establish, exercise or defend legal claims. After that, it is deleted.

9. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to data portability, and to withdraw consent with effect for the future (Art. 15 to 20 GDPR, Art. 25 to 28 FADP). Statutory retention or compliance obligations may limit deletion.

Right to object (Art. 21 GDPR). Where we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds or the processing serves legal claims.

To exercise your rights, contact info@atlas-int.eu. We may ask you to prove your identity.

You also have the right to lodge a complaint with a supervisory authority, in particular:

•     Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch

•     Germany: Data Protection Commissioner of North Rhine-Westphalia (LDI NRW), Kavalleriestrasse 2-4, 40213 Düsseldorf, www.ldi.nrw.de

Obligation to provide data. You are not obliged to provide personal data when visiting the website. Business partners must provide the data required for compliance checks; without it, we cannot enter into or continue a business relationship.

10. Changes

We update this Privacy Policy when our processing or the law changes. The version published on this website applies.