Privacy Policy

Version 1.4Effective 20 October 2026Governing law: Ireland and the EU GDPR

This Privacy Policy explains how Atlantic Agentic Labs, a trading name of Reevre Limited ("we", "us", "our"), collects, uses, shares and protects personal data when you visit atlanticagenticlabs.com, contact us, or deal with us as a client, prospective client, partner or supplier. It is written to meet the requirements of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Acts 1988 to 2018, and the ePrivacy Regulations (S.I. No. 336 of 2011).

1. Who we are

The controller of the personal data described in this policy is:

We are a small company and have not appointed a Data Protection Officer, as the GDPR does not require one for our processing. A named director is responsible for data protection and answers every request personally.

2. Personal data we collect

Information you give us

• Contact form: your name, work email address, company (optional), the subject you are interested in, your timeline (optional), and your message.
• Challenge us: your name, work email address, organisation, what you are sending, a response deadline (optional), your description of the challenge, whether you want our NDA first, and any documents you upload. Documents may contain personal data about other people, such as names in a tender pack; please send only what we need to understand the challenge.
• Signing our mutual NDA online: your organisation's name, registration number, place of incorporation and registered office; your name, title and work email; the name you type as your signature; the time; and the country your request came from. We keep a signed copy of the agreement.
• Business dealings: names, job titles, business contact details and correspondence of people at our clients, prospective clients, partners and suppliers, and any information needed to agree and perform a contract, such as billing details.

Information collected automatically

• Security data: when you use the contact form, Cloudflare Turnstile processes technical signals from your browser and your IP address to check that the form is being sent by a person. When you visit any page, our host Cloudflare processes your IP address and request details to deliver the page and protect the site from attack.
• Your cookie choice: stored in your own browser, not on our systems.
• Visit counts: Cloudflare Web Analytics counts visits to this site without cookies or any identifier stored on your device: the page, the referring site, browser and device type, and country, from which no individual visitor can be recognised. It runs for every visitor, because it reads nothing from and writes nothing to your browser. Our basis is our legitimate interest in knowing which pages are read (6(1)(f)).
• Usage data, only with your consent: if you turn on Analytics, Microsoft Clarity records how you use the site: pages viewed, clicks, scrolling, device and browser type, approximate location from your IP address, and recordings of your visit with anything typed into forms masked.

We do not use advertising cookies or tracking pixels, and we do not buy personal data from third parties.

3. How we use personal data

• To answer your enquiry and continue the conversation you started.
• To prepare proposals and, if we work together, to enter into and perform our contract with you or your organisation.
• To keep the website and our systems secure and to prevent spam and abuse of the contact form.
• To keep records we are legally required to keep, such as accounting and tax records.
• To establish, exercise or defend legal claims.

We do not sell personal data, use it for advertising, or use it to train AI models. The legal basis for each use is set out in the table in section 14.

4. When we act for our clients

When we build or operate systems for a client, the client usually decides what personal data those systems process and why. In that case the client is the controller and we act as its processor under a written data processing agreement (GDPR Article 28). That data is handled under the client's instructions and its own privacy notice, not this policy. The data processing agreement lists the sub-processors involved, which may include Amazon Web Services and the AI model providers above, and the client decides whether models run inside its own cloud account or are called through a provider's service. Our systems are built to keep each client's data within its own environment and isolated from every other client's.

5. Who we share it with

We share personal data only with the service providers we need to run our business, under contracts that require them to protect it and use it only on our instructions:

We use AI model providers only on their business and API terms, under which they act as our processors, do not train their models on our data, and may keep it only for a short period for abuse and safety monitoring, as set out in their data processing terms. Where a model is available inside AWS, we prefer to run it there, so the data stays within our AWS environment and the region we choose.

We may also disclose personal data where the law requires it, to protect our rights or the safety of others, or to a buyer or successor if our business is reorganised or sold, in which case this policy will continue to apply.

6. International transfers

Proton stores email in Switzerland, which the European Commission recognises as providing adequate protection. We run our AWS workloads in EU regions wherever we can, including AI models run through Amazon Bedrock. Cloudflare, Microsoft, Resend, Amazon Web Services and the AI model providers may process data in the United States or other countries outside the European Economic Area, in particular when a model is called through the provider's own service rather than inside AWS. Those transfers are covered by the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise by the European Commission's Standard Contractual Clauses. You can ask us for details of these safeguards using the contact details in section 13.

7. Retention and security

When data is no longer needed we delete it or anonymise it. We protect personal data with encryption in transit and at rest, multi-factor authentication on every account that holds it, access limited to those who need it, and an engineering practice built to the controls of ISO/IEC 27001 and SOC 2. No method of transmission or storage is completely secure, and we will notify you and the Data Protection Commission of a breach where the law requires.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy (Article 15)
• Rectify data that is inaccurate or incomplete (Article 16)
• Erase your data, in certain circumstances (Article 17)
• Restrict how we use it, in certain circumstances (Article 18)
• Data portability, to receive data you gave us in a portable format (Article 20)
• Object to processing based on our legitimate interests, and at any time to direct marketing (Article 21)
• Withdraw consent at any time where we rely on it, without affecting what was done before

To exercise a right, send a request through our contact form, choosing "Something else", or write to us at the address in section 1. We may need to confirm your identity. We will respond within one month, which may be extended by two further months for complex or numerous requests; if so, we will tell you why within the first month. Exercising your rights is free unless a request is manifestly unfounded or excessive.

9. Automated decisions and AI

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing, including profiling (Article 22). We do not use your messages to train AI models. Where we use AI models in our own work, including to help read and draft correspondence, they are the providers and terms described in section 5, and a person reviews anything that affects you.

10. Cookies

This website uses what it needs to work and stay secure: Cloudflare Turnstile on the contact form, and a record of your cookie choice. If you turn on Analytics, it also uses Microsoft Clarity, which sets cookies. We use no advertising cookies. Details are in our Cookie notice, and you can change your choice at any time from Cookie preferences.

11. Children

Our website and services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as our services or the law change. We will update the version and effective date at the top of this page, and where a change is material we will tell people we are in contact with before it takes effect.

13. Contact and complaints

For any question about this policy or your personal data, use our contact form or write to Atlantic Agentic Labs (Reevre Limited), Lisloughrey, Cong, Co. Mayo, F31 YA43, Ireland.

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work or where an alleged infringement took place. Our lead supervisory authority is the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, dataprotection.ie. We would appreciate the chance to resolve your concern first.

14. Legal bases for processing

Where we rely on legitimate interests, we have balanced them against your rights and freedoms. You can ask us for that assessment, and you can object at any time.