Data Processing Addendum

1. Introduction and scope

This Data Processing Addendum (the “DPA”) forms part of the Terms of Service between the Customer and sole proprietor (FOP) Yurii Oleksandrovych Ivasheniuk, registered in Ukraine and trading as SolaceIn (“SolaceIn”, “we”, “us”). It applies whenever we process personal data on the Customer’s behalf in connection with our apps distributed through the Atlassian Marketplace (each, an “App”), to the extent such processing is subject to the EU or UK General Data Protection Regulation or similar data-protection laws.

2. Roles of the parties

The Customer is the controller of the personal data processed in the Apps, and SolaceIn acts as the Customer’s processor. Atlassian provides the underlying platform (Jira) under its own agreements with the Customer and is not our sub-processor.

Voluntary feedback ratings and similar operational telemetry are processed by SolaceIn as an independent controller for its own product improvement purposes, as described in our Privacy Policy, and are outside the processor scope of this DPA.

3. Details of processing

• Subject matter and duration — processing needed to provide the App, for as long as the App is installed on the Customer’s site (plus the retention period described in Section 10);
• Nature and purpose — computing reports from the Customer’s Jira data on behalf of the requesting user, storing user preferences and configuration, generating exports requested by users, and updating Jira issue fields when explicitly initiated by a user;
• Data subjects — the Customer’s Jira users (employees and contractors) whose accounts interact with the App;
• Categories of personal data — Atlassian account identifiers, display names and profile avatar URLs; App preferences (selected report, filters, columns, calendar, time format); work-calendar configuration; access-settings grants referencing Jira group names; export files explicitly created by users, which may contain Jira issue data including issue summaries and names of assignees. No special categories of data are required by or intended for the Apps.

4. Processor obligations

We will:

• process personal data only to provide the App and only on the Customer’s documented instructions, including with regard to international transfers, unless required otherwise by applicable law;
• ensure that persons authorized to process the data are bound by confidentiality obligations;
• implement the technical and organizational measures in Section 5;
• respect the sub-processor conditions in Section 6;
• assist the Customer, taking into account the nature of the processing, in responding to data-subject requests and in meeting its security, breach-notification and impact-assessment obligations;
• delete or return personal data as described in Section 10;
• make available the information necessary to demonstrate compliance and allow audits as described in Section 11.

5. Security measures

• requests between Jira and the App are authenticated with signed tokens (JWT) issued per Jira site; the App relies on the Atlassian permission model and never widens a user’s access;
• Jira issue and changelog data is read transiently to compute reports and is not permanently stored, except within export files explicitly created by users;
• export files are private to the user who created them;
• data in transit is protected with TLS;
• access to production infrastructure is limited to persons who need it to operate and support the Apps.

6. Sub-processors

The Customer authorizes the following categories of sub-processors, engaged under written agreements imposing data-protection obligations no less protective than this DPA:

• Amazon Web Services — cloud infrastructure hosting the Apps’ backend and storage of user-created export files;
• Internal operational tooling — services used to run and monitor the Apps (for example, delivery of operational notifications that may include account identifiers).

We will inform the Customer of intended changes to sub-processors by updating this page; the Customer may object on reasonable data-protection grounds within fourteen (14) days, in which case the parties will seek a reasonable solution.

7. International transfers

Processing takes place primarily in Ukraine and the European Union; sub-processors listed in Section 6 may process limited data (such as account identifiers in operational notifications) in other countries, in which case the safeguards below apply. Where personal data of EU/UK residents is transferred to a country without an adequacy decision, the parties rely on appropriate safeguards — the EU Standard Contractual Clauses (Module Two: controller to processor) and, for transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU SCCs — which are deemed incorporated into and executed by the parties under this DPA; signed copies are available upon the Customer’s written request.

8. Personal data breaches

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data, and will provide information reasonably available to us to help the Customer meet its own notification obligations.

9. Data subject requests

If a data subject contacts us directly about data processed in an App, we will redirect the request to the Customer where appropriate. We will assist the Customer with access, rectification, erasure and portability requests relating to data stored by the App; contact [email protected].

10. Deletion and return

• export files can be deleted by their creator from the App’s Export History, or removed by us on request;
• after the App is uninstalled, stored data (configuration, work calendars, access grants and export files) is retained to support reinstallation and is deleted upon the Customer’s request;
• upon termination of the Terms, we will delete the Customer’s personal data on request, unless applicable law requires further storage.

11. Audits

Upon reasonable prior written notice, and no more than once per year unless a breach or supervisory authority requires otherwise, we will make available the information necessary to demonstrate compliance with this DPA, and allow for audits conducted by the Customer or an auditor mandated by the Customer, in a manner that does not endanger the confidentiality or security of other customers’ data.

12. Liability, precedence and governing law

The liability of each party under this DPA is subject to the limitations of liability in the Terms of Service. In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails. This DPA is governed by the same law as the Terms (the laws of Ukraine).

13. Contact

SolaceIn is the trading name of sole proprietor (FOP) Yurii Oleksandrovych Ivasheniuk, registered in Ukraine.
Data-protection requests: [email protected]
See also our Privacy Policy and Terms of Service.