Record of Processing Activities
GDPR Article 30(2) — Processor Record
Version 1.1 | October 28, 2026
1. Processor Details
| Processor name | Lamb and Flag TopCo Corp (dba AtlanticM&A) |
| Registered address | 159 N Wolcott St, Ste 133, Casper, WY 82601, United States |
| Data protection contact | privacy@atlanticma.ai |
| Representative in the EU | To be appointed when required under Article 27 |
2. Categories of Processing
| # | Processing Activity | Categories of Data Subjects | Categories of Personal Data | Transfers to Third Countries | Retention |
|---|---|---|---|---|---|
| 1 | User account management | Customer employees and contractors | Name, email, hashed password, MFA config, session tokens, login timestamps | N/A. Processed in the account's hosting region (US East or London). SCCs apply where data is processed in the United States. | While account active + 30 days post-termination |
| 2 | Project management | Customer employees, project team members, governance participants | Names, email addresses, job titles, project role assignments, task assignments, workstream ownership | N/A. Processed in the account's hosting region (US East or London). SCCs apply where data is processed in the United States. | While subscription active + 30 days |
| 3 | Meeting transcript analysis (AI) | Meeting attendees, individuals discussed in meetings | Names, statements attributed to individuals, action item assignments, opinions expressed | Transcript → AWS Bedrock in the account's hosting region via VPC private endpoint (US East accounts: may route within us-east-1, us-east-2 and us-west-2; London accounts: eu-west-2 only). Not used for model training. | While subscription active + 30 days. Transcript stored in S3 (encrypted). |
| 4 | AI dependency analysis | N/A — processes task titles, not personal data | Task titles and workstream names (may incidentally contain personal names if used in task titles) | Task data → AWS Bedrock in the account's hosting region via VPC private endpoint (US East accounts: may route within us-east-1, us-east-2 and us-west-2; London accounts: eu-west-2 only). Not used for model training. | AI results are ephemeral (session state). Task data follows project retention. |
| 5 | Report generation & distribution | Report recipients (email addresses), individuals named in report content | Email addresses of distribution list members, project data included in generated reports | Email sent via AWS SES in the account's hosting region (us-east-1 or eu-west-2) | Distribution config while subscription active. Generated reports not retained server-side. |
| 6 | Document storage | Individuals named in uploaded documents (TSA addendums, templates) | Document content (may contain personal data uploaded by Controller) | N/A. Stored in AWS S3 in the account's hosting region (us-east-1 or eu-west-2), encrypted AES-256 | While subscription active + 30 days |
| 7 | Governance & team management | Steering committee members, IMO members, workstream leads | Names, roles, organisational side (acquirer/target), governance positions | N/A. Processed in the account's hosting region (US East or London). | While subscription active + 30 days |
| 8 | Payment processing | Account billing contacts | Processed entirely by Paddle (Merchant of Record). AtlanticM&A does not receive or store payment card data. | Paddle processes in UK/Global (PCI DSS Level 1) | Managed by Paddle per tax regulations |
| 9 | Customer feedback | Users submitting feedback | Email address, feedback text, browser info, page URL | N/A. Processed in the account's hosting region (US East or London). | Until resolved or deleted by administrator |
| 10 | Audit logging | All platform users | User ID, action performed, timestamp, IP address | N/A. Processed in the account's hosting region (US East or London). CloudTrail logs in the same region. | Application logs: while subscription active. CloudTrail: 90 days. |
| 11 | Connector — customer-configured API access | Project owners and RAID owners (by name), individuals named in project, risk or document text | Read-only. Project names and descriptions, RAID entries (title, description, mitigation plan) and their owners' names, work-plan tasks, meeting titles and timings, and excerpts of documents the Controller has imported for this purpose. Meeting organiser email addresses, meeting join and recording links, and legal-hold detail are withheld from this channel by column-level projection. | Disclosed to a recipient the CONTROLLER selects and authenticates. AtlanticM&A does not choose the destination and cannot enumerate it; the transfer is made on the Controller's documented instruction under Art. 28(3)(a). See the DPA. | AtlanticM&A retains nothing additional. Access lasts only while the Controller's token is live (owner-set expiry, capped at 365 days) and stops immediately on revocation, subscription lapse, or the removal of the person who created it. |
3. Sub-Processors
The full list of sub-processors, with processing purposes and locations, is published on the Sub-Processors page. The table below summarises those that process Customer personal data.
| Sub-Processor | Processing | Location | Safeguards |
|---|---|---|---|
| AWS (multiple services) | Compute, database, storage, email, monitoring | The account's hosting region: us-east-1 (N. Virginia) or eu-west-2 (London). CloudFront edge access logs for both regions are stored in us-east-1. | SOC 2 II, ISO 27001, SCCs, EU-US DPF |
| AWS Bedrock (Anthropic Claude + DeepSeek) | AI transcript analysis, work plan generation, dependency analysis. Claude Sonnet 4.6 and DeepSeek V3.2 / R1 routed per feature. | US East accounts: us-east-1, and may route within us-east-2 and us-west-2. London accounts: eu-west-2 only. | SOC 2 II, ISO 27001, no model training |
| Recall.ai | Meeting notetaker, calendar sync and transcription. Off by default; enabled per project by the Customer. | US East accounts: us-east-1. London accounts: eu-central-1 (Frankfurt). | SOC 2 II, SCCs, EU-US DPF |
| Paddle | Payment processing (MoR) | UK / Global | PCI DSS Level 1 |
| GitHub | CI/CD pipeline trigger | US | SOC 2 II, no customer data |
Services the Customer connects to the platform itself (Microsoft, Google, Atlassian Jira, Slack) receive data only on the Customer's instruction and are not sub-processors engaged by the Processor. They are listed in Section 3 of the sub-processor list.
4. Technical and Organisational Security Measures
A description of the technical and organisational security measures implemented pursuant to GDPR Article 32 is provided in the Security Technical Addendum and the Data Protection Impact Assessment.
Key measures include:
- Encryption at rest (AES-256) and in transit (TLS 1.2+)
- Row-Level Security for tenant data isolation
- VPC network isolation with private endpoints (no public internet egress)
- Multi-factor authentication (TOTP, WebAuthn)
- AWS WAF with OWASP rule sets and rate limiting
- DynamoDB-backed distributed rate limiting
- CloudTrail audit logging
- Automated backup with 35-day retention
- Incident response procedure with 72-hour notification
5. International Transfers
Each Customer account is hosted in one AWS region, chosen when the account is created: US East (us-east-1, N. Virginia, United States) or London (eu-west-2, United Kingdom). Personal data is stored and processed in that region, except as described on the Sub-Processors page. For personal data from the EEA/UK/Switzerland that is processed in the United States, the following safeguards are in place:
- Standard Contractual Clauses (SCCs) — Module 2 (Controller to Processor), EU Commission Decision 2021/914
- AWS compliance: AWS participates in the EU-US Data Privacy Framework and maintains its own SCCs with customers
- Supplementary measures: Encryption, VPC isolation, access controls as described in Section 4
Full details of the international transfer mechanism are set out in the Data Processing Agreement (Section 5).
6. Document Control
| Version | 1.1 |
| Date | October 28, 2026 |
| Next review | March 2027 or upon material change in processing |
| Approved by | Richard Parry, Director |
Lamb and Flag TopCo Corp (dba AtlanticM&A) · 159 N Wolcott St, Ste 133, Casper, WY 82601, United States
For enquiries: privacy@atlanticma.ai