Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the End User Terms between the customer that installs the Atlassian Marketplace apps Recurring Issues for Jira and Q&A for Confluence (each an "App") ("Customer", acting as controller) and Filip Ilić PR Agencija za računarsko programiranje Filip Code Kaona, registered in the Republic of Serbia, company ID (MB) 65422174, tax ID (PIB) 111454976, seat: Kaona, Serbia, operating under the brand Loopwise Labs ("Loopwise Labs", acting as processor). It applies automatically when the Customer installs the App and Loopwise Labs processes Customer Personal Data on the Customer's behalf. No signature is required.
1. Definitions
"GDPR" means Regulation (EU) 2016/679, and, where applicable, the UK GDPR and the Serbian Law on Personal Data Protection. "Customer Personal Data" means personal data processed by the App on behalf of the Customer. Terms such as "controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the GDPR.
2. Details of processing
- Subject matter and purpose: Recurring Issues for Jira: creating Jira issues on schedules configured by the Customer's users. Q&A for Confluence: creating and organising questions and answers as Confluence content.
- Duration: while the App is installed, plus the deletion period in section 9.
- Nature of processing: storage of configuration and metadata, and use of it to create, assign and transition Jira issues or to create Confluence pages, comments, labels and page properties.
- Categories of data subjects: the Customer's Atlassian users who create rules, are set as assignees, vote, accept answers or are named moderators.
- Types of personal data: Atlassian account IDs only. No names, email addresses or special categories of data are stored.
3. Processing on instructions
Loopwise Labs processes Customer Personal Data only on the Customer's documented instructions, which are given through the App's configuration and these terms, unless required otherwise by law. Loopwise Labs will inform the Customer if it believes an instruction infringes data protection law.
4. Confidentiality
Anyone authorised by Loopwise Labs to process Customer Personal Data is bound by confidentiality.
5. Security
The App is built on Atlassian Forge and runs entirely on Atlassian's infrastructure. Data is stored in Atlassian-managed Forge storage, protected by Atlassian's security controls, and is not transferred to systems operated by Loopwise Labs or third parties. Loopwise Labs keeps access to production limited to what Atlassian exposes to developers (function logs, which contain no personal data beyond technical identifiers) and uses multi-factor authentication for its accounts.
6. Sub-processors
The Customer authorises Atlassian (Atlassian Pty Ltd and its affiliates) as sub-processor for hosting via Forge. Loopwise Labs will notify the Customer of any new sub-processor by updating this page at least 30 days in advance, giving the Customer the opportunity to object. Loopwise Labs remains responsible for its sub-processors' compliance.
7. International transfers
Customer Personal Data is stored by Atlassian under Atlassian's own data transfer mechanisms (including the EU Standard Contractual Clauses where applicable). Where Loopwise Labs itself accesses Customer Personal Data from the Republic of Serbia, the parties agree that the EU Standard Contractual Clauses (Module 2, controller to processor) are incorporated by reference.
8. Assistance and data subject requests
Loopwise Labs will assist the Customer, taking into account the nature of processing, with data subject requests, security, breach notification, data protection impact assessments and prior consultation. Because the App stores only account IDs inside the Customer's site, most requests can be fulfilled by the Customer deleting the relevant rules or content. Each week each App also removes account IDs of accounts that Atlassian reports as closed.
9. Deletion
When an App is uninstalled, its Forge storage is deleted by Atlassian under Atlassian's retention rules. Confluence content created through Q&A for Confluence is the Customer's content and stays under the Customer's control. On request, Loopwise Labs will confirm deletion of any Customer Personal Data under its control.
10. Personal data breaches
Loopwise Labs will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available to it.
11. Audits
Loopwise Labs will make available the information necessary to demonstrate compliance with this DPA and will respond to reasonable written audit questionnaires once per year, or after a personal data breach.
12. Order of precedence
If this DPA conflicts with the End User Terms regarding the processing of Customer Personal Data, this DPA prevails.
Contact
Privacy and DPA questions: support@loopwiselabs.app