1. Overview

Atlantis is committed to protecting payment information used in its travel, booking and hospitality technology services. This statement describes our approach to payment security and explains the scope of our PCI DSS compliance statements.

For purposes of this statement, “Atlantis,” “we,” “us” and “our” refer to Atlantis Systems Technologies Filipinas Corp., Atlantis Systems Technologies Malaysia Sdn. Bhd., and Atlantis Systems Asia Holdings Pte. Ltd., as applicable to the service or payment environment concerned. This statement applies across these three entities, with assessment and compliance claims limited to the entities and environments covered by the relevant documentation.

2. PCI DSS Assessment

The Payment Card Industry Data Security Standard (PCI DSS) sets requirements for protecting payment account data. Its requirements apply according to how an entity handles that data and whether its systems can affect the security of a payment environment.

Atlantis Systems Technologies Filipinas Corp. has completed a PCI DSS v4.0.1 Self-Assessment Questionnaire A-EP (SAQ A-EP) for its defined e-commerce payment environment and maintains passing external vulnerability scans through a PCI Security Standards Council Approved Scanning Vendor.

The relevant assessment records identify the legal entity and payment environment covered. A shared Atlantis brand or shared technology does not, by itself, extend an assessment to another group entity.

3. Maintaining Payment Security

Across the Atlantis entities, our commitment is to maintain safeguards appropriate to each entity’s services, payment activities and responsibilities. For assessed payment environments, this includes applicable PCI DSS assessments, required vulnerability scans, ongoing security monitoring and coordination with payment providers.

Payment processing arrangements and security responsibilities depend on the service and the participating Atlantis entity. Any statement about card-data handling or a particular security control applies only to the environment for which it has been verified.

4. Compliance Scope

PCI DSS compliance statements relate only to the legal entities, systems, services and payment environments identified in the applicable assessment and supporting records. Coverage of a shared environment must be established by those records and the applicable validation requirements of the acquiring bank or payment brands.

Relevant documentation may be provided to authorized partners, payment providers, acquiring banks or regulators on reasonable request, subject to confidentiality requirements.

5. Important Limitation

This page provides general information about Atlantis’s payment-security approach. It does not expand any assessment scope or represent that every Atlantis entity, product, website, application or system has been assessed or validated as PCI DSS compliant. Applicable legal, contractual and payment-provider obligations continue to apply to each entity.

6. Security and Compliance Inquiries

For questions about this statement or the compliance scope relevant to your service, please use our Contact Us page or email helpdesk@ph.atlantis.asia. Please identify the Atlantis entity, service and payment environment concerned so that the appropriate information can be provided.