Data Processing Addendum

1. Introduction and scope

This Data Processing Addendum (the “DPA”) forms part of the Terms of Service between the Customer and sole proprietor (FOP) Yurii Oleksandrovych Ivasheniuk, registered in Ukraine and trading as SolaceIn (“SolaceIn”, “we”, “us”). It applies whenever we process personal data on the Customer’s behalf in connection with our apps distributed through the Atlassian Marketplace (each, an “App”), to the extent such processing is subject to the EU or UK General Data Protection Regulation or similar data-protection laws.

2. Roles of the parties

The Customer is the controller of the personal data processed in the Apps, and SolaceIn acts as the Customer’s processor. Atlassian provides the underlying platform (Jira) under its own agreements with the Customer and is not our sub-processor.

Voluntary feedback ratings are processed by SolaceIn as an independent controller for its own product improvement purposes, as described in our Privacy Policy, and are outside the processor scope of this DPA.

3. Details of processing

The details below describe the Time And History App for Jira Cloud. If you use another SolaceIn App, contact [email protected] for the corresponding description.

• Subject matter and duration — processing needed to provide the App, for as long as the App is installed on the Customer’s site (plus the retention period described in Section 10);
• Nature and purpose — computing reports from the Customer’s Jira data on behalf of the requesting user, storing user preferences and configuration, generating exports requested by users, generating reports on a schedule a user configured and delivering them by email to the recipients that user entered, storing dashboard-gadget configuration in Jira dashboard item properties, and updating Jira issue fields when explicitly initiated by a user;
• Data subjects — the Customer’s Jira users (employees and contractors) whose accounts interact with the App;
• Categories of personal data — Atlassian account identifiers, display names and profile avatar URLs; App preferences (selected report, filters, columns, calendar, time format); dashboard-gadget configuration stored in Jira dashboard item properties (project, epic, sprint, assignee, period and display options); work-calendar configuration; access-settings grants referencing Jira group names; scheduled-report configuration (schedule name, report, filter snapshot and its display labels, frequency, start date, start time and time zone) together with the email addresses of the recipients entered by the schedule’s owner, and the cover note each run sends, which repeats the report, the filters and the names they display, the period, the calendar and the issue count, and which identifies the schedule’s owner by display name (or, on a schedule saved before this feature was released, by email address) together with a link to the Jira site; export files explicitly created by users or produced by a scheduled run, which may contain Jira issue data including issue summaries and names of assignees. No special categories of data are required by or intended for the Apps.

4. Processor obligations

We will:

• process personal data only to provide the App and only on the Customer’s documented instructions, including with regard to international transfers, unless required otherwise by applicable law;
• ensure that persons authorized to process the data are bound by confidentiality obligations;
• implement the technical and organizational measures in Section 5;
• respect the sub-processor conditions in Section 6;
• assist the Customer, taking into account the nature of the processing, in responding to data-subject requests and in meeting its security, breach-notification and impact-assessment obligations;
• delete or return personal data as described in Section 10;
• make available the information necessary to demonstrate compliance and allow audits as described in Section 11.

5. Security measures

• requests between Jira and the App are authenticated with signed tokens (JWT) issued per Jira site; the App relies on the Atlassian permission model and never widens a user’s access; a scheduled run reads Jira as the schedule’s owner, so a delivered report contains only issues that owner can open;
• Jira issue and changelog data is read transiently to compute reports and is not permanently stored, except within export files explicitly created by users or produced by their scheduled reports;
• export files are private to the user who created them, and a schedule is visible only to the owner who created it; recipient addresses are masked in our operational logs;
• data in transit is protected with TLS;
• access to production infrastructure is limited to persons who need it to operate and support the Apps.

6. Sub-processors

The Customer authorizes the following categories of sub-processors, engaged under written agreements imposing data-protection obligations no less protective than this DPA:

• Amazon Web Services — cloud infrastructure hosting the Apps’ backend and storage of user-created export files, and Amazon Simple Email Service (SES) in the EU (Frankfurt) region for the delivery of scheduled-report emails, which carry the recipient addresses, the cover note and the attached report file;
• Slack Technologies, LLC (a Salesforce company), United States — internal operational notifications about App usage. A notification contains the Jira site URL and the Atlassian account ID of the requesting user; it never contains issue data, report contents or export files.

We will inform the Customer of intended changes to sub-processors by updating this page; the Customer may object on reasonable data-protection grounds within fourteen (14) days, in which case the parties will seek a reasonable solution.

7. International transfers

Processing takes place primarily in Ukraine and the European Union; sub-processors listed in Section 6 may process limited data (such as account identifiers in operational notifications) in other countries, in which case the safeguards below apply. Where personal data of EU/UK residents is transferred to a country without an adequacy decision, the parties rely on appropriate safeguards — the EU Standard Contractual Clauses (Module Two: controller to processor) and, for transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU SCCs — which are deemed incorporated into and executed by the parties under this DPA; signed copies are available upon the Customer’s written request.

A scheduled report is delivered to the addresses a user of the Customer entered in the App, so the message and its attachment reach whatever mail systems those recipients use, wherever those systems are operated. That onward delivery is an instruction of the Customer, given through the schedule its user created, and the recipients’ mail providers are not our sub-processors.

8. Personal data breaches

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data, and will provide information reasonably available to us to help the Customer meet its own notification obligations.

9. Data subject requests

If a data subject contacts us directly about data processed in an App, we will redirect the request to the Customer where appropriate. We will assist the Customer with access, rectification, erasure and portability requests relating to data stored by the App; contact [email protected].

10. Deletion and return

• the App’s Export History lists the twenty (20) most recent export files, which their creator can delete there; older files are removed by us on request;
• deleting a scheduled report deletes its configuration and its recipient addresses; the export files its runs already produced remain in Export History and are deleted separately;
• after the App is uninstalled, stored data (configuration, work calendars, access grants, scheduled reports and export files) is retained to support reinstallation and is deleted upon the Customer’s request; scheduled reports stop running once the App is uninstalled;
• upon termination of the Terms, we will delete the Customer’s personal data on request, unless applicable law requires further storage.

11. Audits

Upon reasonable prior written notice, and no more than once per year unless a breach or supervisory authority requires otherwise, we will make available the information necessary to demonstrate compliance with this DPA, and allow for audits conducted by the Customer or an auditor mandated by the Customer, in a manner that does not endanger the confidentiality or security of other customers’ data.

12. Liability, precedence and governing law

The liability of each party under this DPA is subject to the limitations of liability in the Terms of Service. In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails. This DPA is governed by the same law as the Terms (the laws of Ukraine).

13. Contact

SolaceIn is the trading name of sole proprietor (FOP) Yurii Oleksandrovych Ivasheniuk, registered in Ukraine.
Data-protection requests: [email protected]
See also our Privacy Policy and Terms of Service.