...
The Processor shall provide the Controller with software solutions in accordance with the apps EULA or, if not stated specifically, this Main Agreement. In doing so, the Processor shall obtain access to personal data and shall process such data exclusively on behalf of and in accordance with the instructions of the Controller. The scope and purpose of the data processing by the Processor are set out in the Main Agreement. The Controller is solely responsible for assessing the permissibility of the data processing in accordance with Art. 6 (1) GDPR.
The Parties conclude the present agreement to specify the mutual rights and obligations under data protection law. In case of doubt, the provisions of this Agreement shall take precedence over the provisions of the Main Agreement.
The provisions of this Agreement shall apply to all activities related to the Main Agreement in which the Processor and its employees or persons authorized by the Processor come into contact with personal data originating from or collected for the Controller or otherwise processed on the Controller's behalf.
The term of this Agreement shall be based on the term of the Main Agreement, unless the following provisions give rise to obligations or rights of termination going beyond this.
The provision of the contractually agreed data processing usually takes place in a member state of the European Union or another contracting state of the Agreement on the European Contractual Area (Decision 94/1/EC). If the Processor transfers Personal Data to subcontractors outside the EU or the EEA, they have previously agreed to comply with the standard data protection clauses pursuant to Commission Implementing Decision (EU) 2021/914 of 4.6.2021 and thus ensure an adequate level of data protection within the meaning of Art. 46 (2) lit. c GDPR.
To the extent that Provider Processes Customer Personal Data protected by Data Protection Laws in one of the regions listed in Annex 4 (Region-Specific Terms), then the terms specified therein with respect to the applicable jurisdiction(s) will apply in addition to the terms of this DPA.
...
If not stated otherwise, the Processing is hosted on cloud (AWS, see Annex 3).
Google Workspace for Jira
Purposes of processing | Categories of processing | Categories of personal data | Categories of data subjects |
Connect Google apps and services with Jira. Optimize Jira with Google features and extend Google apps and services with Jira functionalities. | We only store content that has been explicitly created by our apps. The most common data we store are:
We do not store Jira content (like Jira issues, comments, etc.) or Google content (like email content, event descriptions) on our servers. | Reports on the
The app is unaware of the type of data supplied to it. Example categories of personal data are:
The Controller must inform the Processor if he processes additional categories of personal data inside Jira or the app. |
The Controller must inform the Processor if he processes additional categories of data subjects with this app. |
Annex 2 - Authorized persons, entitled persons, communication channel
...