Information Privacy Policy

1Information Privacy Policy

1.1Introduction

This Privacy Policy describes how ATLAS Federal Technologies, Inc. ("AFT") collects, uses, shares, protects, retains, and disposes of personal information across its business operations. It applies to information AFT obtains through its website (atlasfedtech.com), from employees and job applicants, from business contacts and teaming partners, and in the course of performing work for federal, state, and local government customers.

AFT is an IT consulting company headquartered at 12550 Biscayne Blvd, Suite 500E, North Miami, FL 33181. As a government contractor, AFT is responsible for protecting both its own corporate information and the information entrusted to it by its government customers.

1.2Scope

This policy applies to all AFT employees, officers, subcontractors, consultants, and temporary staff who access personal information held by or on behalf of AFT. It covers:

• Corporate information: personal information AFT collects for its own business purposes, including website visitors, job applicants, employees, and business contacts.
• Government customer information: Personally Identifiable Information (PII), Controlled Unclassified Information (CUI), and Federal Contract Information (FCI) that AFT creates, receives, stores, or processes while performing a government contract or subcontract.

1.3Definitions

• Personally Identifiable Information (PII): information that can be used to distinguish or trace an individual's identity, alone or when combined with other information linked or linkable to that individual (OMB Circular A-130).
• Sensitive PII: PII that, if lost or disclosed, could result in substantial harm, embarrassment, or unfairness to an individual, such as Social Security numbers, financial account numbers, medical information, and biometric data.
• Controlled Unclassified Information (CUI): information the U.S. Government creates or possesses that requires safeguarding or dissemination controls under law, regulation, or Government-wide policy (32 CFR Part 2002).
• Federal Contract Information (FCI): information not intended for public release that is provided by or generated for the Government under a contract (FAR 52.204-21).
• Privacy and Data Security Laws: all laws, regulations, and contract clauses that apply to the information AFT handles, including the Privacy Act of 1974, the Federal Acquisition Regulation (FAR), the Defense Federal Acquisition Regulation Supplement (DFARS), and applicable state laws.

2Policy

2.1Governance

A collection of policies and procedures, including this Privacy Policy, are designed to address privacy and data security risks related to Atlas Federal Technologies' business operations, and to protect the privacy, confidentiality, integrity and availability of Personally Identifiable Information (PII) processed by or on behalf of Atlas Federal Technologies.

Reasonably foreseeable risks, both internal and external, that could result in a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personally Identifiable Information transmitted, stored or otherwise processed by or on behalf of Atlas Federal Technologies are identified and logged in the Incident Log. Atlas Federal Technologies designs and implements reasonable controls and procedures to address and mitigate such risks.

Atlas Federal Technologies has a documented Compliance Management Policy and Incident Management Policy with related procedures to handle security incidents. These policies may be modified by Atlas Federal Technologies at regular intervals.

AFT designates a Privacy Officer who is responsible for maintaining this policy, answering privacy questions, coordinating responses to privacy incidents, and serving as the point of contact for government customers on privacy matters.

2.2Privacy Principles

AFT handles personal information in line with the Fair Information Practice Principles recognized by the federal government:

• Collection limitation: collect only the information needed for a defined business or contract purpose.
• Purpose specification and use limitation: use information only for the purpose for which it was collected or as authorized by contract.
• Data quality: keep information accurate, relevant, and up to date.
• Security: protect information with safeguards appropriate to its sensitivity.
• Transparency and individual participation: tell individuals how their information is used and give them a way to access or correct it.
• Accountability: train personnel, monitor compliance, and correct problems.

2.3Information AFT Collects

AFT collects only the information it needs to respond to inquiries, recruit and employ staff, and operate its business.

2.4How AFT Uses Information

AFT uses personal information to:

• Respond to questions and requests
• Discuss contracting, subcontracting, and teaming opportunities
• Review job applications, contact candidates, and propose qualified personnel on government contracts
• Administer employment, payroll, benefits, and security clearance processes
• Perform contract work as directed by government customers
• Operate, secure, and improve the website and AFT information systems
• Send occasional updates about AFT, only on request
• Meet legal, regulatory, and contract requirements, and protect AFT's rights

AFT does not sell personal information, and does not share it for targeted (cross-context behavioral) advertising.

2.5Government Customer Information

Information AFT handles on behalf of a government customer belongs to that customer and is governed by the applicable contract, task order, and agency instructions. For this information, AFT will:

• Access, use, and disclose the information only as authorized by the contract and only to personnel with a need to know.
• Follow the Privacy Act of 1974 (5 U.S.C. 552a) and FAR 52.224-1 and 52.224-2 when a contract requires AFT to design, develop, or operate a system of records on individuals.
• Complete privacy training required by FAR 52.224-3 before personnel access a system of records, handle PII, or work on systems of records, and repeat it at least annually.
• Safeguard FCI in accordance with FAR 52.204-21 and CUI in accordance with NIST SP 800-171, DFARS 252.204-7012, and Cybersecurity Maturity Model Certification (CMMC) requirements where they apply.
• Support agency privacy requirements, including Privacy Impact Assessments, System of Records Notices, and NIST SP 800-53 privacy controls, when AFT operates or supports a federal information system.
• Store and process customer information only in systems and locations approved by the customer.
• Return or destroy customer information at contract completion as directed by the Contracting Officer.

2.6How AFT Shares Information

AFT shares personal information only as described below:

• Service providers who help AFT run its business, such as website hosting, email (Microsoft 365), recruiting platforms, and AFT's IT service provider. They may use the information only to provide services to AFT and must protect it to standards consistent with this policy.
• Government agencies and prime contractors, when an individual is proposed for or working on a contract and has agreed to be included (for example, a resume submitted with a proposal), or when required to perform the contract.
• Subcontractors and teaming partners, only as needed to perform a contract and subject to written agreements that flow down the applicable privacy and security requirements.
• Legal reasons, when required by law, subpoena or court order, or to protect the rights, property, or safety of AFT, its customers, or others.
• Business transfers, if AFT is involved in a merger, acquisition, or sale of assets. The information would remain subject to this policy.

AFT does not sell or rent personal information to anyone.

2.7Cookies and Analytics

The AFT website uses cookies (small files stored by the browser) to make the site work and keep it secure. AFT does not currently use advertising cookies or tracking pixels. If AFT adds analytics, this policy will be updated before it is turned on.

Visitors can block or delete cookies in their browser settings. Some parts of the site may not work properly without them.

Do Not Track. Some browsers send a "Do Not Track" signal. Because there is no common standard for these signals, the website does not currently respond to them.

2.8Data Security

AFT uses reasonable administrative, technical, and physical safeguards to protect personal information, including access controls based on least privilege, multi-factor authentication, encryption, security monitoring, and secure configuration of systems. No method of transmission over the internet is 100% secure, so AFT cannot guarantee absolute security.

2.9Incident and Breach Response

Atlas Federal Technologies will implement and follow procedures for responding to data security incidents, including any breach involving the disclosure of Personally Identifiable Information, in accordance with and as defined under applicable Privacy and Data Security Laws and its obligations therein.

The procedures for responding to data security incidents shall include, where applicable, requirements for notice to the affected data subject(s) and regulatory authorities as required by Privacy and Data Security Laws. Atlas Federal Technologies will work with appropriate subject-matter experts to verify such compliance.

Personnel must report any suspected or confirmed loss, theft, or unauthorized access to personal information to the Privacy Officer immediately. In addition:

• Government customer information: AFT will report incidents to the Contracting Officer and agency contacts within the time frame required by the contract. For DoD contracts subject to DFARS 252.204-7012, cyber incidents affecting covered defense information are reported to the DoD within 72 hours of discovery.
• Corporate information: under Florida law (Fla. Stat. §501.171), affected individuals are notified no later than 30 days after a breach is determined, and other state laws are followed where they apply.

2.10Retention and Disposal

AFT keeps personal information only as long as needed for the purposes in this policy or as required by law or contract. Job application records are generally kept for at least 1 year (2 years for federal contractor requirements). Contract records are retained as required by FAR Subpart 4.7 and the contract. Government customer information is retained, returned, or destroyed as directed by the customer.

When information is no longer needed, AFT securely deletes or destroys it using methods consistent with NIST SP 800-88 so that it cannot be read or reconstructed.

2.11Individual Choices and Rights

Individuals may contact AFT at any time to:

• Ask what personal information AFT holds about them
• Correct or update their information
• Ask AFT to delete their information, unless AFT must keep it by law or contract
• Stop receiving marketing emails, using the "unsubscribe" link in any email or by contacting AFT

AFT will respond within 30 days and may need to verify identity before acting on a request. Depending on where an individual lives, state law may give additional rights; AFT will honor requests as required by applicable law and will not treat anyone differently for making one.

Requests about records held in a government system of records are referred to the responsible agency under the Privacy Act.

2.12Job Applicants

Information submitted with a job application is used only to evaluate the application, make hiring decisions, and, with the candidate's agreement, propose the candidate for government contracts. Background checks are run only with written permission. AFT is an Equal Opportunity Employer.

2.13Links to Other Websites

The AFT website may link to other websites, such as SAM.gov, LinkedIn, or job boards. AFT is not responsible for the privacy practices of those sites.

2.14Training and Accountability

All AFT personnel complete privacy and security awareness training when hired and at least annually, plus any role-based or contract-specific training required by a customer. Violations of this policy may result in disciplinary action, up to and including termination, and may be reported to government customers as required by contract.

2.15Changes to This Policy

AFT reviews this policy at least annually and when laws, contract requirements, or business practices change. The public version on atlasfedtech.com shows the current effective date, and significant changes are highlighted on the website. This version is effective October 29, 2026.