Data Processing Agreement

Last updated: 7 September 2026

This DPA is incorporated into the Terms of Service and applies whenever a Datum App processes personal data on your behalf. You are the controller; datadir s. r. o. is the processor.

1. Subject matter and duration

We process personal data only to provide the Apps you've installed, for as long as they're installed, and until deletion on uninstall (section 7).

2. Nature and purpose

Reading and writing issue and page data (issues, projects, fields, changelog, pages, spaces) and, where a feature needs it, limited end-user data — solely to deliver that App's function.

3. Categories of data and data subjects

• Data subjects: the site's users and the people its work involves — for example an issue's assignee or reporter, and, for apps that support it, approvers, ticket contacts, or page owners.
• Data: issue and page configuration and content; and, where a feature needs it, identifiers such as a user referenced by a template or, where a feature uses them, an approver or page owner. We minimise this to what the feature requires.

4. Our obligations

• Process only on your documented instructions — including as to transfers — unless a law we're subject to requires otherwise, in which case we'll tell you first unless that law prohibits it. (Installing and configuring an App is such an instruction.)
• Ensure personnel are bound by confidentiality.
• Apply appropriate technical and organisational security measures (section 6).
• Assist you with data-subject requests, and with your obligations on security, breach notification, data-protection impact assessments, and any prior consultation with the supervisory authority (Art. 32–36).
• Notify you without undue delay after becoming aware of a personal-data breach.
• Tell you immediately if, in our view, an instruction you give infringes GDPR or other applicable data-protection law.

5. Sub-processors

You authorise the sub-processor below. We impose data-protection obligations on each sub-processor equivalent to those in this DPA, and we remain fully liable to you for each sub-processor's performance. We'll give at least 30 days' notice of any intended change and a chance to object; if you reasonably object on data-protection grounds and we can't resolve your concern within a reasonable time, you may terminate the affected App as your remedy.

Sub-processor	Purpose	Location
Atlassian Pty Ltd (and affiliates)	Hosts the app and any data it stores, via Atlassian Forge (AWS infrastructure)	Per Atlassian's terms & sub-processors

Atlassian in turn engages its own sub-processors — including Amazon Web Services, Inc. as its cloud-hosting provider — published and kept current at atlassian.com/legal/sub-processors, where you can also subscribe to change notifications.

We do not currently engage any other sub-processor. If we later add one (for example, a transactional email relay for an app that sends notifications), we'll list it above, with the 30 days' notice, before it goes live.

6. Security measures

• Per-install isolation — an app's stored data is scoped to a single install (site + app), so no site's install can read another's data.
• Platform-authenticated requests — Forge authenticates every app invocation and runs the app in an isolated, per-install sandbox; our apps expose no public HTTP endpoints or external webhooks, so there is no external surface to forge or replay.
• Dependable, auditable state — where an app owns state (a stored template, a recorded decision) that state is app-owned so it isn't silently overwritten. Any app that offers an exportable history documents what it stores on its own Marketplace listing.
• Encryption in transit and at rest (via Atlassian's Forge infrastructure); access on a least-privilege basis.
• We periodically review and test the effectiveness of these measures.

7. Return and deletion

On your request while an App remains installed, we delete or return — at your choice — the personal data we process for you. On uninstall, Forge purges the app's storage promptly, except where the law requires retention.

8. Data residency & international transfers

The apps and their stored data are hosted on Atlassian Forge (AWS); our apps store data only in Forge's hosted storage and operate no external stores. Data residency: Atlassian automatically pins that hosted data to the region of the Atlassian product an app is installed on, and migrates it if you change region (EU, US, AU, DE, SG, CA, IN, KR, JP, GB and CH are supported); each app documents its in-scope data on its Marketplace listing. Where this hosting involves a transfer of personal data outside the EEA, the UK, or Switzerland, Atlassian relies on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum, Swiss-specific amendments, and the EU–US Data Privacy Framework (with its UK and Swiss extensions) where applicable, as set out in Atlassian's own Data Processing Addendum. datadir s. r. o. does not itself transfer personal data outside the EEA other than through this Atlassian-operated hosting.

9. Audits

On reasonable request and notice, we'll make available the information needed to demonstrate compliance with this DPA, and we'll allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable confidentiality and security safeguards. Where our platform sub-processor's independent audit reports or certifications (e.g. Atlassian's SOC 2) evidence a control, we may provide those to help satisfy an audit.

Questions about this DPA: support@datadir.co. Company details: Legal notice.