TOMORIS NEXTAtlas
Legal

Privacy

Which data Atlas processes, what for, on which legal basis, for how long, and which rights you have.

Controller

TOMORIS GmbH
Saturnstraße 1
4614 Marchtrenk
Austria

E-mail
[email protected]
Phone
+43 7243 53091

Purpose and scope

Atlas is the AI potential analysis of TOMORIS GmbH. This notice covers the public pages of Atlas (home, pricing, Atlas Check, contact, imprint, privacy) and the application after the sign in.

TOMORIS is the controller for contact requests, leads of the Atlas Check, the accounts of the sign in and the audit log. The data a customer captures in its analysis (structure, interviews, documents, Microsoft 365 evaluation) TOMORIS processes on behalf of the customer, under the data processing agreement concluded with the subscription or the guided analysis.

Hosting and delivery

Atlas runs on servers of TOMORIS GmbH in its own server room at its seat in Marchtrenk, Austria; the database is there as well. Credentials and keys are kept in a Microsoft Azure Key Vault in the West Europe region.

The public address atlas.tomoris.com is delivered through Cloudflare (protection and forwarding to the server). A request produces technically necessary connection data such as time, requested address, status and IP address. They serve the secure operation and troubleshooting.

Cookies and storage in the browser

Atlas uses no analytics, advertising or tracking tools and loads no content from third parties: fonts, images and code come from the Atlas server itself. That is why there is no cookie banner.

Only technically necessary entries are set:

  • __Host-atlas: the session cookie after the sign in, HTTPS only, valid for eight hours.
  • Short-lived cookies during the sign in with Microsoft that match Microsoft's answer to the sign in; they are deleted afterwards.
  • atlas-lang in local storage: the language you chose with the language switch.
  • tomoris-theme in local storage: light or dark display, when you choose it explicitly.

Contact form

The contact form processes subject, company, name, e-mail address and message, and optionally your phone number, to answer your request. It is stored only with your consent; the wording of the consent is stored with the request.

The request goes into the lead list of Atlas, which only TOMORIS administrators see on the internal network. Where sending is set up, the sales team of TOMORIS also receives an e-mail through Microsoft 365 (Exchange Online); replies go to your e-mail address.

To prevent abuse, Atlas limits the requests per IP address and hour; the address is only held in memory for that and not stored. A hidden field keeps form robots out. There is no third-party captcha.

Atlas Check

You fill in the Atlas Check without signing in. Answers and result are not stored as long as you leave no contact. With contact and consent, Atlas stores company, name, e-mail address, optionally phone and message, your answers and the result as a lead, to contact you about it.

The short report as PDF opens with a random key that only you receive; Atlas stores only a hash of it.

Sign in with Microsoft

The sign in uses Microsoft Entra ID. Atlas receives from Microsoft the identifier of your account and your organisation, your name, your sign-in address (e-mail) and your group memberships, to set your role and your tenants. Atlas never sees a password.

People whom TOMORIS adds to Atlas are stored with account identifier, sign-in address, display name, role, guest or not, and the last sign in. Atlas invites external people as guests into the Microsoft environment of TOMORIS; Microsoft sends the invitation.

Sign ins and refused sign ins are recorded in the audit log.

Analysis data: structure, interviews, documents

An analysis captures areas, processes, steps, roles, systems and ratings. Interviews record the role of the person interviewed (for example "head of purchasing"), never their name. Documents should be uploaded without names; Atlas reads their text, the original is deleted after the evaluation.

Every change is in the change log, every important step in the audit log. Customers see only what has been approved, and only their own tenant. There is no evaluation of individual people.

Language model

To evaluate interviews and documents, Atlas uses a language model of Anthropic (Anthropic Ireland, Limited, Ireland, and Anthropic, PBC, USA) as a processor. It receives the interview transcript or the text of a document after Atlas has replaced secrets, e-mail addresses, IBANs, phone numbers and names after a salutation.

Data of a customer only go to the language model once the data processing agreement is concluded and the language model is enabled for the tenant. The free trial has no AI evaluation. The transfer to the USA is based on the standard contractual clauses of the EU Commission.

Microsoft 365 scan

With the consent of an administrator, Atlas reads the structure and the use of the organisation's Microsoft 365 through Microsoft Graph: groups, teams, sites, licences, apps and Power Automate flows. Only figures per group of at least five people are stored, never a row per person; usage reports stay pseudonymised, and the content of e-mails, files or chats is not read.

Subscription and payment

A subscription is concluded through TOMORIS.Commerce; Stripe (Stripe Payments Europe, Limited, Ireland) handles the payment. Atlas does not see payment data such as card numbers. Atlas only receives plan, term and status of the subscription from TOMORIS.Commerce, to enable your tenant.

Legal bases

  • Providing the pages and connection data: legitimate interest in a secure operation (Art. 6(1)(f) GDPR).
  • Contact requests and leads of the Atlas Check: your consent (Art. 6(1)(a) GDPR), revocable at any time; where the request concerns a service, also pre-contractual measures (Art. 6(1)(b) GDPR).
  • Sign in, subscription and payment: performance of the contract (Art. 6(1)(b) GDPR).
  • Analysis data of a customer: on behalf of the customer under the data processing agreement (Art. 28 GDPR).
  • Audit log and protection against abuse: legitimate interest in traceability and security (Art. 6(1)(f) GDPR).
  • Necessary cookies and browser entries: required for the service you explicitly asked for (section 165(3) of the Austrian Telecommunications Act 2021).

Recipients and third countries

Technically involved are Microsoft (Entra ID for the sign in, Microsoft Graph for the scan and the invitation, Exchange Online for the e-mail to sales, Azure AI Speech for dictation, Azure Key Vault for keys), Anthropic for the language model, Cloudflare for delivering the public address, and Stripe through TOMORIS.Commerce for payments. On request Atlas hands measures as tickets to the Jira of TOMORIS (Atlassian); measures contain no personal data.

Microsoft, Anthropic, Cloudflare, Stripe and Atlassian are companies headquartered in the USA. Processing outside the EU or the EEA can therefore not be ruled out. According to the providers, such transfers are based on the EU-US Data Privacy Framework or on the standard contractual clauses of the EU Commission.

Retention

  • Contact requests and leads of the Atlas Check: twelve months after they came in, earlier on your request.
  • Interview transcripts: 90 days after the interview was approved (adjustable per tenant, 1 to 365 days).
  • Uploaded documents (original): 30 days after the evaluation (adjustable per tenant); the text read stays until the document or the tenant is deleted.
  • Microsoft 365 evaluations: twelve months after the scan (adjustable per tenant).
  • Change log and audit log: 24 months (adjustable per tenant, at least twelve months).
  • Session cookie: eight hours.
  • A tenant is deleted completely on request; only a deletion receipt without content remains.

Your rights

You have the right of access, rectification, erasure and restriction of processing, the right to data portability and the right to object to processing based on legitimate interests (Art. 15 to 21 GDPR). You can withdraw a consent at any time with effect for the future. Please write to [email protected].

If you believe that the processing of your data violates data protection law, you can lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde (Barichgasse 40–42, 1030 Vienna, dsb.gv.at).

There is no automated decision-making including profiling. Atlas rates work steps, not people; people approve the proposals of the AI.

Security and updates

Transfers are encrypted with HTTPS. Tenants are separated in the database, every access follows role and tenant, and important steps are recorded in the audit log. Only TOMORIS reaches the administration, on the internal network.

This notice is updated when the data flows of Atlas or the information of the providers change.

As of: October 2026