Snapshot 224351
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Personal data processing agreement -
Actions for Jira Service Management
The data processing agreement (“DPA”) is concluded pursuant to Article 28(3) of the GDPR and,
together with the Privacy policy for apps and End User License Agreement (“EULA”), constitutes an
agreement (“Agreement”) entered into between each person or entity being a customer (hereinafter
referred to as the “Data Controller” or the “Controller”, the “Customer”, “You”) identified in the
signature block
and
Deviniti sp. z o. o. [limited liability company] with its registered office in Wrocław, at ul. Sudecka 153,
53-128 Wrocław, entered in the Register of Entrepreneurs of the National Court Register kept by the
District Court for Wrocław - Fabryczna in Wrocław, 6th Commercial Division of the National Court
Register under KRS number: 0000223645, NIP: 897-17-00-419, REGON [National Business Registry
Number]: 933044506, with a share capital of PLN 54,400.00, (hereinafter referred to as ‘Processor’ or
‘Us’)
hereinafter collectively referred to as ‘Parties’ or each individually as ‘Party’.
WHEREAS,
The Controller intends to use the Processor’s Actions for Jira Service Management application
available on the Atlassian Marketplace (“Product”) and, in connection therewith, it is necessary for the
Controller to entrust the Processor with the processing of personal data,
The Parties agreed as follows:
For the purposes of the Agreement, the Customer may act as Controller or Processor, with Deviniti Sp.
z o.o. acting as Processor or Sub-processor, as the case may be.
§ 1 Subject of the Agreement
1. The Controller declares that – within the meaning of the provisions of Regulation (EU) 2016/679 of
the European Parliament and of the Council of 27 April 2016 on the protection of natural persons
with regard to the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC (“GDPR”) – it is the controller of the personal data entrusted to it.
2. The Controller complies and will comply with all applicable data protection regulations with
respect to the processing of the personal data entrusted to it.
3. The Controller warrants that it has all necessary rights to provide the Processor with personal data
for processing in connection with the use of the Product. To the extent required by the provisions
of the Act of 10 May 2018 on the protection of personal data, the Controller is responsible for
ensuring that all necessary consents of the data subjects for such processing are obtained and for
ensuring that a record of such consents is kept. If consent is withdrawn by the data subject, the
Controller is responsible for notifying the Processor of such withdrawal, and the Processor remains
responsible for implementing any instructions of the Controller with respect to the further
processing of such personal data.
4. The Controller entrusts the Processor with the processing of personal data indicated in § 2(3) in
connection with the Controller’s use of the offered Product, and the Processor undertakes to
process such data.
5. The Controller shall not instruct the Processor to process any personal data in a manner that would
constitute a breach of law.
6. The Processor may process personal data only to the extent and for the purpose necessary to
maintain the services resulting from the Controller’s use of the offered Product.
7. It is the sole responsibility of the Controller to assess the permissibility of the processing of personal
data in accordance with Article 6(1) of the GDPR.
8. The Processor shall only use personal data to ensure the proper functioning of the Product. The
Processor shall not store, use, sell or disclose the Customer's personal data for any other purpose,
subject to ongoing marketing activities, provided that the Controller has consented to receive
content of this nature.
9. The Processor may, at its own discretion, select and use the measures it deems necessary to
achieve the purposes, subject to the requirements of the Agreement.
10. The personal data processing agreement constitutes a supplement to the provisions of the Privacy
policy for apps and the EULA and is an integral part thereof in the event that, during the
Customer’s use of the offered Product, personal data processing is entrusted.
11. The Parties do not foresee the transfer of special categories of personal data.
12. The personal data are transferred on a continuous basis.
§ 2 Nature of Processing
1. Personal data will be processed in accordance with the provisions of the Agreement and may be
subject to the following processing operations: collection, retrieval and viewing, use, recording,
storage, organizing and structuring, modification and updating.
2. The Processor will process personal data to the extent necessary to ensure the functioning of the
Product.
3. In performing the subject matter of the Agreement, the Processor may have access to the
following personal data or information regarding the end user:
1) user account identifier (accountId),
2) e-mail address,
3) end user data contained in requests, projects, attachments and other Jira objects made
available to the application
4. Data processing period:
1) The Processor will process personal data for the duration of the use of the Product, and the
data will be deleted within 60 days from the date of termination or expiry of the Agreement,
provided that this period may be extended in justified cases, but will not be longer than 12
months from the date the Customer ceases using the Product,
2) sub-processors will process personal data to the extent necessary to provide access to the
Product, in accordance with applicable law and the provisions of the Agreement.
3) All data provided by the Controller is stored in the structure of Atlassian Pty Ltd, Level 6, 341
George St, Sydney NSW 2000, Australia, and the Processor does not store or process data other
than that specified in section 3 above.
§ 3 Obligations and representations
1. The Processor declares that it has the infrastructure, resources, experience, knowledge and
well-qualified personnel capable of performing its obligations in accordance with applicable law. In
particular, the Processor declares that it is familiar with the principles of processing and protection
of personal data arising from Regulation (EU) No. 679/2016 of the European Parliament and of the
Council of 27 April 2016 on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing Directive 95/46/EC.
2. Each Party shall comply with applicable personal data protection regulations, in particular the
GDPR
3. The Processor is obliged to:
1) process the provided personal data solely under the Agreement, except where it is required to
do so by law; where the Processor’s processing of personal data results from legal provisions, it
shall inform the Controller electronically – before commencing processing – of such legal
requirement, if the law permits providing such information due to the public interest,
2) process the provided personal data in accordance with the GDPR and the Agreement,
3) implement appropriate technical and organizational measures to ensure a level of security
appropriate to the risk posed by a breach of the rights or freedoms of natural persons whose
personal data will be processed under and within the scope of the Agreement,
4) support the Controller in fulfilling its obligation to respond to requests from the data subject,
to the extent the data subject exercises the rights set out in GDPR Chapter 3. The Processor’s
cooperation with the Controller in the scope referred to above shall take place in a form and at
a time convenient for the Parties, while enabling them to carry out their business operations,
5) assist the Controller, to the extent of:
a) ensuring the security of personal data processing by implementing appropriate technical
and organizational measures,
b) reporting any personal data breaches to the supervisory authority and informing the data
subjects of such breaches.
§ 4 Technical and Organizational Measures
1. The Processor implements and applies appropriate technical and organizational measures to
ensure a level of security appropriate to the risk posed by a breach of the rights or freedoms of
natural persons whose personal data will be processed in connection with the use of the Product.
2. When assessing whether the level of security referred to above is appropriate, the Processor is
obliged to take into account the risks associated with processing, in particular those resulting from
accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure of, or any
unlawful access to, personal data transmitted, stored or otherwise processed.
3. When implementing technical and organizational measures, the Processor:
1) follows the Controller’s guidelines regarding personal data processing security measures, in
accordance with applicable law,
2) takes into account the state of the art, the context, nature, scope and purposes of processing,
as well as the risk of a breach of the rights or freedoms of natural persons whose personal data
will be processed under and within the scope of the Agreement.
4. The Controller agrees that the Processor may transfer personal data processed under the
Agreement outside the European Economic Area (“EEA”), the United Kingdom or Switzerland, if
this is necessary to provide the services and ensure the proper operation of the Product. The
Controller acknowledges that the transfer of personal data outside the EEA, the United Kingdom or
Switzerland is necessary to provide services to the Controller. The Processor may also transfer
personal data to other jurisdictions if reasonably necessary for the proper operation of the Product,
including wherever the Processor or any of its subcontractors maintains facilities.
5. As a rule, the processing of personal data referred to in § 2(3)(1)-(3) takes place within the EEA and
the USA. In the case of transfers to third countries, the Processor transfers personal data to certified
entities and countries for which the European Commission has issued adequacy decisions, and on
the basis of Standard Contractual Clauses, with the application of additional safeguards (technical
and legal) or Binding Corporate Rules, which ensures an adequate level of protection of personal
data.
§ 5 Sub-processing
1. The Controller consents to the Processor further entrusting the processing of personal data to
other entities in connection with ensuring the proper functioning of the Product.
2. The Processor ensures that it will use services provided only by processors that provide sufficient
guarantees of implementing appropriate technical and organizational measures so that
processing meets the requirements of the GDPR and is compliant with the current personal data
protection regulations.
3. The Processor shall be fully liable to the Controller for compliance with the contractual obligations
under the GDPR agreed between the Processor and the further processor. If the further processor
fails to fulfill its obligations regarding personal data protection, the Processor shall be liable to the
Controller for non-compliance with contractual obligations.
4. The list of sub-processors constitutes Appendix No. 1 to the Agreement. Detailed information
regarding the personal data protection of these entities can be found in their privacy policies.
5. Natural persons conducting sole proprietorships and cooperating with the Processor on the basis
of permanent civil-law agreements are treated as the Processor’s internal personnel. The Processor
stipulates that the transfer of personal data to such persons is carried out in accordance with
applicable law.
6. The Processor is entitled to change the list of entities referred to in section 4 above by making an
appropriate modification to that list. An updated list of entities to whom the Processor transfers
data will each time be posted on the marketplace platform, in the dedicated Privacy & Security tab,
and in the Trust Center at https://trust.deviniti.com/subprocessors, if possible.
7. The Customer acknowledges that the services offered by some sub-processors are necessary for
the proper provision of services and proper operation of the Product and that an objection to the
use of a sub-processor may prevent Us from offering some or all functionalities of the Product to
the Customer.
§ 6 Audits
1. The Controller is authorized to conduct an audit of the Processor’s compliance with the Agreement
and applicable law in the processing of personal data; in particular, the Controller may verify the
compliance and adequacy of the technical and organizational measures securing personal data
processing implemented by the Processor.
2. The audit shall first be carried out by the Controller sending the Processor a request to provide the
necessary explanations within 14 days from receipt of the request. If no response is provided within
that period, the Controller shall be entitled to conduct a direct audit on the terms set out below.
3. The Controller will inform the Processor at least 14 days before the planned audit date of its
intention to conduct the audit. If, for important reasons, in the Processor’s assessment, the audit
cannot be carried out on the indicated date, the Processor should inform the Controller
electronically of this fact, indicating the justification for such assessment. In such case, the Parties
will jointly agree a later audit date.
4. A direct audit may be carried out by the Controller or external entities commissioned by the
Controller, on business days, between 8:00 a.m. and 4:00 p.m., provided that the audit does not
disrupt the Processor’s business operations and its confidentiality.
5. The Processor is obliged to cooperate with the persons conducting the audit, in particular to
provide them access to premises and documents containing personal data and information on the
manner of processing personal data, ICT infrastructure and IT systems, as well as to persons having
knowledge of the personal data processing processes carried out by the Processor.
6. After the audit, the Controller’s representative prepares an audit report, which is signed by
representatives of both Parties. The Processor undertakes, within the period agreed with the
Controller, to comply with the recommendations contained in the audit report aimed at
eliminating deficiencies and improving the security of personal data processing.
7. The costs related to conducting the audit shall be borne by the Party that commissioned the audit,
without the right to request reimbursement of such costs or payment of additional remuneration.
§ 7 Personal Data Breach
1. The Processor is obliged to implement and comply with procedures for detecting personal data
breaches and to implement appropriate remedial measures.
2. Upon noticing a breach of personal data entrusted to the Processor by the Controller, the
Processor, without undue delay and, if possible, no later than within 48 hours of detecting the
breach, shall notify the Controller of the situation.
3. The Processor, without undue delay, shall take all reasonable actions to minimize and remedy the
adverse effects of the breach.
4. The Processor is obliged to document each breach of the personal data entrusted to it, including
the circumstances of the breach, its effects, and the remedial actions undertaken.
§ 8 Term of the agreement
1. The term of the Agreement is strictly linked to and corresponds to the period of use of the Product,
unless the Agreement provides for obligations or rights extending beyond that period.
2. The Controller has the right to terminate the Agreement with immediate effect for important
reasons, including due to a breach by the Processor or sub-processors of the GDPR and other
mandatory provisions of law or the provisions of the Agreement, in particular where:
1) the regulatory authority responsible for compliance with personal data processing rules finds
that the Processor or sub-processor breaches the data processing rules,
2) a final and binding judgment of a court of general jurisdiction demonstrates that the
Processor or sub-processor does not comply with the personal data processing rules.
§ 9 Final Provisions
1. The Parties agree that the Agreement replaces any existing DPA agreements that the Parties may
have previously concluded in connection with the use of the Product.
2. In the event of a conflict between the Agreement and the EULA, the Agreement shall prevail with
respect to personal data protection.
Appendix No. 1 to the Agreement – List of processing subcontractors (sub-processors)
Entity Corporate Privacy Policy Purpose
headquarters
Google Inc., 1600 Amphitheatre https://policies.google.com/privacy Product analytics
(Google Tag Parkway Mountain
Manager) View, CA 94043, USA.
PostHog Inc. 2261 Market Street https://posthog.com/privacy Product analytics
#4008, San
Francisco, CA 94114.