This Data Processing Addendum (“DPA”) forms part of the terms of use between Plugins Factory (“Processor”) and the customer (“Controller”) when the Processor processes Customer Personal Data through AssetPilot for Jira or AssetPilot Connect. It is intended to meet Article 28 of the GDPR and the UK GDPR, and the service-provider requirements of the CCPA/CPRA. It applies without a signature. A countersigned copy will be available on request from privacy@plugins-factory.com.
1. Instructions
The Processor processes Customer Personal Data only on the Controller’s documented instructions: the terms, this DPA and the Controller’s configuration of the Apps.
2. Confidentiality
Everyone with access to Customer Personal Data is bound by confidentiality.
3. Security
The Processor applies the measures in Annex II.
4. Subprocessors
The Controller authorises the subprocessors in Annex III. The Processor gives 30 days’ notice of new subprocessors on the subprocessors page.
The Controller may object on reasonable data protection grounds. If no solution is found, the Controller may end the affected licence and receive a pro-rata refund. The Processor imposes equivalent obligations on each subprocessor and remains liable for them.
5. Data subject requests
The Processor helps the Controller respond to requests, as far as the Apps’ functions allow.
6. Personal data breaches
The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of a breach. The Processor provides the information required by Article 33(3) GDPR as it becomes available.
7. Impact assessments
The Processor provides the information it reasonably has for data protection impact assessments and prior consultations.
8. Deletion
After uninstall, App data is deleted by the Forge platform as described in data handling. The Controller can export data before uninstalling.
9. Audits
The Processor makes available the information needed to demonstrate compliance: this DPA, the trust center documents, and answers to a reasonable security questionnaire once a year.
On-site audits take place where the law requires them, with 30 days’ notice and at the Controller’s cost.
10. International transfers
Where Customer Personal Data is transferred outside the EEA, the UK or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2 or 3) apply and are incorporated by reference, with the UK International Data Transfer Addendum and Swiss amendments where needed.
11. CCPA
The Processor does not sell or share Customer Personal Data, does not retain, use or disclose it outside the direct business relationship, and does not combine it with other data.
Annex I: Description of processing
| Item | Description |
|---|---|
| Data subjects | The Controller’s Jira users; people the Controller records as asset holders; MDM users (Connect) |
| Categories of data | Atlassian account ids; names and emails of external people; MDM user names and emails; device serial numbers and attributes; audit records |
| Special categories | None intended. The Controller must not enter them. |
| Nature and purpose | Storing and displaying asset records and history, device synchronisation and notifications, as configured by the Controller |
| Duration | The life of the installation, then deletion as in section 8 |
Annex II: Technical and organisational measures
- Hosting on Atlassian Forge; encryption in transit (TLS 1.2+) and at rest by Atlassian.
- Tenant isolation by the Forge platform; no databases operated by the Processor.
- Secrets in Forge secret storage; API keys stored as SHA-256 hashes; OAuth access tokens kept in memory only.
- Least-privilege scopes; user actions run as the user; admin checks on every settings change.
- No personal data in function logs.
- Multi-factor authentication on all developer, source code, email and Atlassian accounts; access limited to named people.
- Code review and automated tests before every release; security fixes within Atlassian’s Security Bug Fix Policy.
- Incident handling as described in incident response.
Annex III: Subprocessors
As listed on the subprocessors page on the date this DPA takes effect.