ATP Data Services Privacy Policy

Last updated: October 27, 2026

1. Who we are

ATP Data Services LLC, 611 Hundred Oaks Drive STE 140, Edmond, OK 73013, USA, is the sole controller of the personal data described in this policy ("ATP", "we").

• Privacy contact: support@atpdataservices.com. Send all privacy questions, access requests and deletion requests here.
• EU representative (GDPR Art. 27): Prighter EU Rep GmbH, Marshalllaan 2, unit 2.02, 2625 GZ Delft, Netherlands
• UK representative (UK GDPR Art. 27): Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom
• Data Protection Officer: None appointed. A Data Protection Officer is not required under Art. 37 GDPR, as our core activities do not involve large scale processing of special category data or regular and systematic monitoring.

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions: European Union (EU) and United Kingdom (UK). Prighter gives you an easy way to exercise your privacy related rights (for example, requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit: https://app.prighter.com/portal/19755667050. You can also contact us directly at support@atpdataservices.com.

This policy covers our website, our online store, orders, support, and the devices you send us. We do not accept orders from mainland China through this store; such orders are refunded and we refer you to the ATP China team.

2. Summary

Data	Purpose	Lawful basis (EU/UK)	Retention
Name, email, phone, address, account login	Accounts, orders, shipping, support	Contract	While your account is open, then 3 years after your last order closes
Order, invoice and tax records	Billing, accounting, tax	Legal obligation	5 years
Payment details (handled by our payment processors; we see only the last 4 digits and card type, or your PayPal or other payment account details, and payment status)	Taking payment, preventing fraud	Contract; legitimate interests (fraud prevention)	Same as order records
Order records (technician notes, device details)	Performing the recovery; chain of custody	Contract; legitimate interests	3 years after your order closes
VeriScan records (file listings only: names, paths, sizes and similar metadata; no file content)	Letting you review and approve results	Contract	3 years after your order closes
Data on your device and recovered copies	Performing the recovery only	Contract; for third parties' data on the device, our legitimate interest and yours in getting it back	Recovered copies: 30 days after your order closes. Originals: returned by default; see Section 3. Undeliverable returns and abandoned orders: see our Terms of Service and Refund Policy
Support emails, calls and chats	Support, quality, disputes	Contract; legitimate interests	3 years after your order closes
Marketing preferences	Newsletters and offers	Consent (or soft opt-in for existing customers where allowed)	Until you unsubscribe
Essential cookies (cart, checkout and security cookies our store needs)	Running the site, cart and checkout	Legitimate interests	As set by our store platform, session or up to 1 year
Analytics cookies (Google Analytics and our store platform's analytics)	Understanding how visitors use our site so we can improve it	Consent where the law requires it (including in the EU/UK); otherwise legitimate interests	Up to 2 years
Shipping and customs data	Delivery and customs	Contract; legal obligation	Same as order records

We do not ask for your gender, age or demographic data, and we do not buy data from data brokers.

3. Data on the devices you send us

Your device may contain personal data about you and others, sometimes including sensitive data such as health information, photos or financial records.

• Access. Trained technicians access the device only to perform the recovery. They may open and view files to check that they are readable and complete. Access is limited to the people working on your order. We log chain of custody for every device, our lab tools log who handles each drive, and our order system records which technician is assigned.
• VeriScan. We show you a listing of recovered files in our secure VeriScan review portal so that you can confirm the results. VeriScan stores file listings only (file names, paths, sizes, good or bad status and similar metadata). It does not store any file content or data. Portal access is limited to you and the team working on your order. We keep VeriScan records for 3 years after your order closes. VeriScan runs on ATP's own local server at our Edmond, Oklahoma lab (USA).
• Lab location. All devices ordered through this store, including from the EU and UK, are shipped to and processed at our US lab (ATP Data Services LLC, Edmond, Oklahoma). EU/UK transfers to the US are protected as described in Section 6.
• No other use. We do not use the contents for marketing, analytics, AI training or any other purpose. We disclose them only to you, or where the law requires it. If we find content that is clearly illegal (for example, child sexual abuse material), we may be legally required to report it.
• Return and deletion. We keep our copy of recovered data for 30 days after we close your order, then securely delete it. If the drive with your recovered data is lost in transit within that time, we recopy it free. By default we return your original device. If you ask us to destroy it, we hold it for 30 days after your order closes when you approved the results, or destroy it when your order closes if the results or quote were declined or the recovery was unsuccessful. Destruction follows NIST SP 800-88, and we email you a certificate of destruction. Abandoned orders and returns that cannot be delivered are handled as set out in our Terms of Service and Refund Policy.
• Your role. For data on the device, you decide what is recovered. Where you are a business, we act as your processor. A data processing agreement is available to business customers on request. Email support@atpdataservices.com to ask for one.

4. Who we share data with

We share data only with service providers who process it on our instructions, under contract:

• Payment processors (including Shopify Payments, Shop Pay and PayPal): payments and fraud checks. Each is also an independent controller for its own legal duties.
• Shopify: our online store and order data. Shopify is also an independent controller for Shop Pay, fraud prevention and its own legal duties, under the Shopify Consumer Privacy Policy.
• Order management and automation tools: order details are passed to our order management system.
• Shipping carriers and shipping software: to create labels, track shipments and clear customs, which means they process the recipient's name, address, phone, email and customs details.
• Email and communications provider.
• Analytics provider: Google Analytics, used only with your consent where the law requires it (including in the EU/UK). We do not use advertising tools.
• Authorities, advisers, and a buyer in a business sale, where the law requires it or where needed to protect our rights.

ATP Data Services LLC is the only company that controls or processes data from this store. We do not share it with any ATP affiliate.

We do not sell personal data, and we do not use advertising tools or share personal data for cross-context behavioral advertising.

5. Your rights

Depending on where you live, you may have the right to:

• access your data, or receive a copy (portability);
• correct it, or have it deleted;
• restrict or object to processing, including objecting to direct marketing at any time;
• withdraw consent at any time.

To make a request, including a deletion request, email support@atpdataservices.com. We will verify your identity and reply within one month (EU/UK) or 45 days (US states), and these periods can be extended where the law allows.

EU/UK complaints. You can complain to your local supervisory authority, for example the Dutch Autoriteit Persoonsgegevens (https://www.autoriteitpersoonsgegevens.nl) or the UK Information Commissioner's Office (https://ico.org.uk).

6. International transfers

We are based in the USA. When you order through this store, you choose to send your device to our US lab in Edmond, Oklahoma. Transferring your device, your order data and the data on your device to the US is therefore necessary to perform the contract you asked for (GDPR and UK GDPR Article 49(1)(b)). We transfer only what we need to perform the Services and handle your order. Some of our service providers (Section 4) may also process order data in the USA. Where they offer it, we use their standard contractual safeguards. You can ask us for more detail at support@atpdataservices.com.

7. US state privacy rights (CCPA/CPRA and similar)

• What we collect. In the last 12 months we collected: identifiers, customer records, commercial information, internet activity (with consent where required), geolocation derived from IP address (approximate), and the contents of devices you send us.
• Where it comes from and why. The sources and purposes are described above. We disclose it for business purposes to the service providers in Section 4.
• Selling and sharing. We do not sell personal information. We do not knowingly sell or share the personal information of anyone under 16.
• Sensitive information. Sensitive personal information on devices is used only to perform the Services.
• Your rights. California and other state residents can ask to know, delete and correct their data, and opt out of sale, sharing or targeted advertising.
• How to ask. Email us at support@atpdataservices.com. An authorized agent may make a request for you.
• Non-discrimination. We will not treat you differently for using these rights.

8. Cookies and Global Privacy Control

We use essential cookies, plus analytics cookies only with your consent where the law requires it. Essential cookies run the store and the cart. Visitors in the EU/UK, and anywhere else the law requires it, are asked for consent through our cookie banner before we set Google Analytics cookies. We do not use advertising cookies. You can accept or decline analytics cookies through the banner, and change your choice at any time by clearing your cookies so the banner appears again. You can block cookies in your browser settings, but the cart and checkout may not work.

We honor Global Privacy Control (GPC) browser signals as an opt-out of sale, sharing and targeted advertising. There is no common standard for Do Not Track, so we treat GPC as the signal we respond to.

9. Children

Our Services are for adults. We do not knowingly collect personal data from children under 16 (13 in the US) through our website. If you think a child has given us data, contact us and we will delete it. Devices may contain children's data, and we handle it under Section 3.

10. Security

We use encryption in transit, access controls, logged access to order data, secured lab premises, and secure destruction methods. No system is perfectly secure. If a personal data breach occurs, we notify the relevant supervisory authority within 72 hours of becoming aware of it where the law requires, and we notify affected customers without undue delay where required. For tips on protecting yourself from identity theft, see https://consumer.ftc.gov and https://www.identitytheft.gov.

11. Marketing

We send marketing emails only with your consent, or to existing customers about similar services where the law allows it. You can unsubscribe at any time using the link in each email. We will still send you emails about your orders.

12. Changes

We will update the "Last updated" date when this policy changes. We post the updated policy on this page with a new "Last updated" date.

13. Contact

ATP Data Services LLC, 611 Hundred Oaks Drive STE 140, Edmond, OK 73013, USA. Privacy contact: support@atpdataservices.com.