Skip to content
Inventerprises

Data Processing Addendum

Last updated 2026-10-29

This Data Processing Addendum ("DPA") forms part of the End User Terms between Inventerprises AB, org.nr 559588-8578, Malmö, Sweden ("Processor") and the organization that installs one of its apps ("Customer"). It applies to Form Behaviours and Timesheets and Production Telemetry ("the apps") and meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). No signature is needed; it applies from installation. A countersigned copy is available on request.

1. Roles

Customer is the controller of personal data in Customer Data. Processor processes that data on Customer's behalf, only to provide the apps. Terms defined in the GDPR have the same meaning here.

2. Instructions

Processor processes personal data only on Customer's documented instructions. The Terms, this DPA, and the way Customer's administrators configure and use the apps are Customer's complete instructions. Processor will tell Customer if it believes an instruction breaks the GDPR or other data protection law. Processor may process data otherwise only where EU or Member State law requires it, and will tell Customer first unless that law forbids it.

3. Confidentiality

Everyone Processor authorizes to process personal data is bound by confidentiality.

4. Security

Processor maintains the technical and organizational measures in Annex 2, which are designed to meet Article 32 GDPR. Processor may update them as long as the overall level of protection does not fall.

5. Subprocessors

Customer gives general authorization for Processor to use subprocessors. The current subprocessors are listed in Annex 3. Processor will give Customer at least 30 days' notice of a new subprocessor, by updating this page and by email to the license contact Atlassian provides. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may end its license for the affected app and receive a refund through the Atlassian Marketplace for the unused part of a prepaid term. Processor imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible to Customer for its subprocessors.

6. Data subject requests

Taking into account the nature of the processing, Processor will help Customer respond to requests from data subjects exercising their GDPR rights. If Processor receives such a request directly, it will pass it to Customer and will not answer it except on Customer's instruction. Most requests can be handled by Customer's own Jira administrators within Jira and the apps.

7. Assistance

Processor will give Customer reasonable help with security, breach notification, data protection impact assessments, and prior consultation under Articles 32 to 36 GDPR, using the information available to Processor.

8. Personal data breaches

Processor will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe what is known of the breach, the data and data subjects concerned, its likely consequences, and the measures taken or proposed. Processor will add information as it becomes available.

9. Deletion and return

When an app is uninstalled, Atlassian deletes the data the app stored in Forge storage, under Forge's data retention rules. Before uninstalling, Customer can export data that the app shows in Jira. Jira worklogs written by Timesheets are Jira data and are not deleted on uninstall. Processor keeps no copies of Customer Data outside Atlassian's platform.

10. Audits

Processor will make available to Customer the information needed to show compliance with Article 28 GDPR, and will answer reasonable security questionnaires. Because the apps run entirely on Atlassian's platform, the audit evidence for the hosting layer is Atlassian's own certifications and reports. If that information is not enough, Customer may audit Processor once a year, at Customer's cost, with at least 30 days' written notice, during business hours, and under confidentiality. Customer may audit more often where a supervisory authority requires it or after a personal data breach.

11. International transfers

Processor does not itself transfer Customer Data outside the EU and EEA. Atlassian's processing, including any transfer outside the EU and EEA, is covered by Atlassian's data processing terms and the safeguards they describe, such as the EU Standard Contractual Clauses.

12. Liability and precedence

Liability under this DPA is subject to the limits in the Terms, except where the GDPR does not allow them. If this DPA and the Terms conflict on data protection, this DPA wins. This DPA is governed by the same law and settled in the same courts as the Terms.

Annex 1: Details of processing

Subject matter and purpose
Providing the apps inside Customer's Jira Cloud site.
Duration
While an app is installed, then until Atlassian deletes the app's data after uninstall.
Nature
Storage, reading and display of data inside Atlassian Forge. Timesheets also writes worklogs to Jira.
Data subjects
Users of Customer's Jira site, and people named in Customer's Jira data.
Form Behaviours
Form rules defined by administrators, which may contain Atlassian account IDs in user conditions. Jira form fields are read in order to apply rules.
Timesheets
Timesheets with recorded time, dates and comments, their status, and the Atlassian account IDs of sheet owners and approvers. Worklogs written to Jira.
Production Telemetry
Jira issue and board data read through read-only scopes; stored in Forge storage: item keys, summaries, statuses and their history, and the assignee as an account ID and display name. Reporters, descriptions, comments and email addresses are not stored.
Special categories
None intended.

Annex 2: Technical and organizational measures

  • The apps run on Atlassian Forge and carry the "Runs on Atlassian" label. Processing and storage happen on Atlassian's infrastructure, which encrypts data in transit and at rest.
  • No egress. The apps make no calls to any service outside Atlassian, and Processor runs no servers that receive Customer Data.
  • Least privilege. Each app requests only the Jira scopes it needs. Production Telemetry requests read scopes only.
  • App logs written by Processor contain no issue content or form data.
  • Access to Processor's Atlassian developer account, which controls deployment, is limited to Processor's staff and protected with multi-factor authentication.
  • Changes are reviewed and tested before they are deployed to production.
  • Vulnerabilities are handled under the Security policy.

Annex 3: Subprocessors

Atlassian Pty Ltd and its affiliates
Hosting, running and storing the apps through Atlassian Forge. Location follows Atlassian's data residency rules for Forge apps and Customer's site.

Contact

Inventerprises AB, Malmö, Sweden. alexander@inventerprises.se.