...
The Processor shall provide the Controller with software solutions in accordance with the apps EULA or, if not stated specifically, this Main Agreement. In doing so, the Processor shall obtain access to personal data and shall process such data exclusively on behalf of and in accordance with the instructions of the Controller. The scope and purpose of the data processing by the Processor are set out in the Main Agreement. The Controller is solely responsible for assessing the permissibility of the data processing in accordance with Art. 6 (1) GDPR.
The Parties conclude the present agreement to specify the mutual rights and obligations under data protection law. In case of doubt, the provisions of this Agreement shall take precedence over the provisions of the Main Agreement.
The provisions of this Agreement shall apply to all activities related to the Main Agreement in which the Processor and its employees or persons authorized by the Processor come into contact with personal data originating from or collected for the Controller or otherwise processed on the Controller's behalf.
The term of this Agreement shall be based on the term of the Main Agreement, unless the following provisions give rise to obligations or rights of termination going beyond this.
The provision of the contractually agreed data processing usually takes place in a member state of the European Union or another contracting state of the Agreement on the European Contractual Area (Decision 94/1/EC). If the Processor transfers Personal Data to subcontractors outside the EU or the EEA, they have previously agreed to comply with the standard data protection clauses pursuant to Commission Implementing Decision (EU) 2021/914 of 4.6.2021 and thus ensure an adequate level of data protection within the meaning of Art. 46 (2) lit. c GDPR.
To the extent that Provider Processes Customer Personal Data protected by Data Protection Laws in one of the regions listed in Annex 4 (Region-Specific Terms), then the terms specified therein with respect to the applicable jurisdiction(s) will apply in addition to the terms of this DPA.
...
Process | Purpose of processing | Categories of processing | ||
Customer support | Help users from the Controller's organization to resolve usage problems or error situations and thus contribute to the value of the app for the Controller and improvement of the apps and documentation. | In customer support usage problems or error situations are reported by users from the Controller's organization via the mechanism described in Annex 2. In the course of the support process reporters might be asked to provide Confluence support zips including log files Templates used for exporting to different formats Page exports or space exports from Confluence JIRA support zips including log files Outlook Google Workspace log files Logs from the reporters browser console Data is provided through the support tool (Jira Service Management, see Annex 3), or in cases where the data provided is too large for that mechanism, we offer to use a data transfer service (Google Drive, see Annex 3). Reporters can choose to provide their own mechanism of data transfer. The received data is then analyzed manually or automatically for causes or indicators of reported usage problems or error situations. | ||
Error tracking Tracking | For error tracking data is transferred from the end user's browser to an error reporting service, which allows analysis of errors without users having to actively report them. This is used to improve the quality of the apps. | Data describing the error context, like operations invoked, the user interface element clicked, technical context like browser, operating system values are transferred to the error reporting service (Sentry and LogRocket, see Annex 3).
| ||
Atlassian license distribution | The apps are only usable with valid licenses. Licenses; i.e. commercial, evaluation and community or academic licenses; are distributed through the Atlassian Marketplace | All data attached to a license under my.atlassian.com is transferred to the Processor.Usage Analysis | Data is transfered from the end user’s browser to an usage analysis/metrics service, which allows monitoring the usage of our apps and features. This is used to improve the quality of and implement new features. | Data describing the usage context, like specific page sections, button presses, technical context like browser and operating system. A token is generated to identify an unique user than can not be decrypted back to the actual user (Mixpanel, see Annex 3). |
Atlassian license distribution | The apps are only usable with valid licenses. Licenses; i.e. commercial, evaluation and community or academic licenses; are distributed through the Atlassian Marketplace | All data attached to a license under my.atlassian.com is transferred to the Processor. | ||
Google license distribution | When installing any app through the Google Workspace Marketplace, basic licensing information is distributed. | All data attached to this license is transferred to the Processor. |
Cloud
The following table describes the data processing of all apps of the Processor.
If not stated otherwise, the Processing is hosted on cloud (AWS, see Annex 3).
Google Workspace for Jira
...
Purposes of processing
...
Categories of processing
...
Categories of personal data
...
Categories of data subjects
...
Connect Google apps and services with Jira. Optimize Jira with Google features and extend Google apps and services with Jira functionalities.
...
We only store content that has been explicitly created by our apps. The most common data we store are:
User / instance settings
Metadata mappings between Atlassian & Google objects
User login tokens retrieved by OAuth login
We do not store Jira content (like Jira issues, comments, etc.) or Google content (like email content, event descriptions) on our servers.
...
Reports on the
Name of the JIRA instance
Atlassian account ID
Google account ID
The app is unaware of the type of data supplied to it. Example categories of personal data are:
Assignees, reporters, watchers and other participants of issues
Field values and changes on fields & comments made by users of Jira
The Controller must inform the Processor if he processes additional categories of personal data inside Jira or the app.
Jira user
Google Users
...
The following table describes the data processing of all apps of the Processor.
If not stated otherwise, the Processing is hosted on cloud (AWS, see Annex 3).
Annex 2 - Authorized persons, entitled persons, communication channel
...