Privacy Policy
How Datum apps handle personal data — for the Atlassian sites that install them and the people who use those sites.
Last updated: 7 September 2026
Datum is a studio of Atlassian apps operated by datadir s. r. o. ("we", "us"). This policy explains what personal data we process, why, and the rights you have. It covers our apps and this website.
1. Who we are
datadir s. r. o., Bauerova 1205/7, 040 23 Košice, Slovakia (IČO 57 582 904; registered at the Municipal Court Košice, section Sro, insert no. 65729/V). Full company details are on our Legal notice. For any privacy question or to exercise your rights, contact support@datadir.co.
2. The two relationships
We process personal data in two distinct roles:
- As a processor, on behalf of an Atlassian site (a Jira, Jira Service Management, or Confluence cloud tenant) that installs one of our apps. The site is the controller of its issues, pages, and user data; we act on its documented instructions. This is governed by our Data Processing Agreement.
- As a controller, for the site's own administrative and billing data, and for visitors to this website.
3. What we process
| Category | Examples | Role |
|---|---|---|
| Account | Atlassian site and user identifiers, admin contact, plan and billing status (via the Atlassian Marketplace) | Controller |
| Issue / page data | Issues, projects, fields, comments, pages and spaces accessed via the Atlassian APIs to provide the app's function | Processor |
| End-user data | For apps that support it — an approver's identity, a ticket contact, or a page owner — the minimum required to deliver that feature | Processor |
| Usage & logs | App events, audit-log entries, and technical logs used to operate and secure the service | Controller / Processor |
| Website | Standard request logs; no advertising or cross-site tracking cookies | Controller |
4. Why, and on what legal basis
- To provide the service you or the site asked for — performance of a contract.
- To secure and improve it — our legitimate interest in a reliable, safe product.
- To meet legal obligations — tax, accounting, and responding to lawful requests.
These bases apply to data we handle as a controller. For data we process on a site's behalf, that site (as controller) is responsible for the lawful basis.
5. Where data lives & data residency
Our apps run on Atlassian Forge, Atlassian's cloud platform for marketplace apps (hosted on AWS), and any data an app stores is held in Forge's isolated per-install hosted storage. We operate no external data stores, so nothing an app touches leaves Atlassian's infrastructure. Data residency: because our apps store data only in Forge's hosted storage, Atlassian automatically pins that data to the region of the Atlassian product an app is installed on and migrates it with the product if you change region — no action needed from you. Residency follows Atlassian's programme (currently EU, US, AU, DE, SG, CA, IN, KR, JP, GB and CH). Each app documents the specific data it treats as in-scope for residency on its Marketplace listing.
Atlassian is our platform sub-processor. Where hosting a site's data involves a transfer outside the EEA, the UK, or Switzerland, Atlassian relies on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum, Swiss-specific amendments, and the EU–US Data Privacy Framework (with its UK and Swiss extensions) where applicable. We ourselves do not transfer personal data outside the EEA other than through this Atlassian-operated hosting. Sub-processors are listed in our DPA.
6. Retention
Issue, page, and end-user data processed on a site's behalf is retained only while the app is installed, and is deleted after uninstall. Billing records are kept as long as the law requires. Where an app keeps its own audit log, entries are capped to a fixed number of recent events (not separately configurable by the site) and are deleted on uninstall; we'll update this if a configurable retention window ships.
7. Your rights
Subject to your role and applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. Site end users should contact their site admin (the controller); we will assist that site. Admins and website visitors can contact us directly at support@datadir.co. You may also lodge a complaint with the Slovak Office for Personal Data Protection (Úrad na ochranu osobných údajov SR, dataprotection.gov.sk), or with the supervisory authority in your own EU/EEA member state.
8. Uninstall & deletion
When an app is uninstalled — or a site is closed — we delete the personal data we hold for it, except where the law requires us to keep certain records. You can also request deletion at any time.
9. Breaches, automated decisions, special categories, cookies & children
Breaches. If a breach affects personal data we control (admin, billing, or website-visitor data), we'll notify the Slovak supervisory authority within 72 hours where the law requires, and affected individuals without undue delay where the breach is likely to result in a high risk to them. For data we process on a site's behalf, we notify that site — see our Data Processing Agreement.
Automated decisions. None of our apps make solely automated decisions, including profiling, that produce legal or similarly significant effects on individuals.
Special categories. Our apps aren't designed to collect special categories of data (Art. 9 GDPR). If a site's own issue or page content happens to include such data, the site remains the controller responsible for its lawful basis; we process it only on the site's instructions and take no independent decisions about it.
Cookies. This website sets no advertising or cross-site tracking cookies — only strictly-necessary state where needed. We'll update this if that ever changes.
Children. Our apps and website are intended for business use by professional users; we don't knowingly direct services to, or collect data from, children.
Data Protection Officer. We haven't appointed a DPO — Art. 37 GDPR doesn't require one for our size and type of processing. Privacy questions go to support@datadir.co.
10. Changes
We'll post any changes here and update the date above. Material changes affecting sites will be notified by email.