EA Sphere Data Processing Addendum
This Data Processing Addendum ("DPA") is the data protection addendum identified in the provider-specific terms for EA Sphere for Jira Cloud. It forms part of the agreement between Renevell LLC ("Provider") and each customer of EA Sphere ("Customer"), made up of the Bonterms Standard End User Agreement and those provider-specific terms, as set out in the terms of service (together, the "Agreement"), and applies without further signature. Terms not defined here have the meanings given in the Agreement or in Data Protection Laws.
1. Definitions
"Data Protection Laws" means the laws on the processing of personal data that apply to the processing under the Agreement, including, where they apply, Regulation (EU) 2016/679 (the "GDPR"), the GDPR as it forms part of the law of the United Kingdom together with the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act of 2018 as amended (the "CCPA"). "Customer Personal Data" means the personal data within Customer Data that Provider processes on Customer's behalf in providing EA Sphere. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, Customer Personal Data. "Sub-processor" means a processor Provider engages to process Customer Personal Data. "Standard Contractual Clauses" means the clauses annexed to Commission Implementing Decision (EU) 2021/914. "Controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the GDPR, and "business", "service provider", "sell" and "share" the meanings given in the CCPA.
2. Roles and instructions
2.1 Customer is the controller of Customer Personal Data, or a processor acting for its own controller, and Provider is Customer's processor, or sub-processor as the case may be. Under the CCPA, Customer is the business and Provider its service provider.
2.2 Provider processes Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's use and configuration of EA Sphere, including by its administrators, are Customer's complete instructions. Provider will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.
2.3 Customer is responsible for the lawfulness of the personal data it and its users enter in EA Sphere, and does not submit Sensitive Data to it, as the Agreement provides.
2.4 Annex 1 describes the processing.
3. Provider's obligations
3.1 Confidentiality. Provider's personnel do not access Customer Personal Data in providing EA Sphere. Any person Provider authorizes to process Customer Personal Data is bound by an obligation of confidentiality.
3.2 Security. Provider maintains the technical and organizational measures in Annex 2.
3.3 Data subject requests. EA Sphere lets Customer's administrators export, correct and delete its data, and erases the account IDs of closed Atlassian accounts automatically each week. Taking into account the nature of the processing, Provider will assist Customer by appropriate measures with requests from data subjects that Customer cannot meet through EA Sphere itself, and will pass to Customer, without responding to it, any such request Provider receives directly.
3.4 Assistance. Provider will give Customer the information about EA Sphere that Customer reasonably needs for a data protection impact assessment or a consultation with a supervisory authority, where Customer does not otherwise have it.
3.5 Security Incidents. Provider will notify Customer without undue delay after becoming aware of a Security Incident, at the contact addresses Atlassian provides to Provider for Customer's installation. The notice describes, to the extent then known, the nature of the incident, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. Provider will update Customer as further information becomes available and will take reasonable steps to contain and remedy the incident.
3.6 Deletion. Customer's administrators can delete all EA Sphere data at any time under Settings, Data, after exporting it if they wish. When EA Sphere is uninstalled, it no longer uses its stored data, and Atlassian deletes that data 28 days later. Provider keeps no copy of Customer Personal Data outside Customer's Forge storage.
3.7 Demonstrating compliance. Provider maintains a record of its processing activities and makes available to Customer the information necessary to demonstrate compliance with this DPA: this DPA, the privacy policy, the security statement, answers to Customer's reasonable security and privacy questionnaires, and the audit reports Atlassian makes available for the Forge platform. As Provider holds no Customer Personal Data outside the Forge platform, Customer agrees that these satisfy its audit rights; where Data Protection Laws require more, Provider will allow an audit of its processing under this DPA on at least 30 days' written notice, no more than once a year, at Customer's expense, during business hours and subject to reasonable confidentiality terms.
4. Sub-processors
4.1 Customer authorizes Provider to engage Sub-processors. Provider's Sub-processor is Atlassian, which operates the Forge platform on which EA Sphere runs and stores its data, under Atlassian's Forge Data Processing Addendum with Provider. Atlassian publishes the sub-processors it uses for the Forge platform.
4.2 Provider will post any new Sub-processor on this page at least 30 days before it processes Customer Personal Data. Within that period Customer may object on reasonable data protection grounds by email to support@renevell.com. If the parties cannot resolve the objection, Customer may cancel its subscription to EA Sphere.
4.3 Provider remains responsible to Customer for its Sub-processors' processing of Customer Personal Data as Data Protection Laws require.
5. International transfers
5.1 EA Sphere stores Customer Personal Data only in the Forge storage for Customer's Jira site. Where the site's data is pinned to a location under Atlassian's data residency options, that storage stays in that location; otherwise Atlassian determines where it is held, under the transfer terms of its Forge Data Processing Addendum, which incorporates the Standard Contractual Clauses.
5.2 To the extent the processing under this DPA involves a transfer of Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to a country that does not have an adequacy decision, the Standard Contractual Clauses, Module Two (controller to processor) or Module Three (processor to processor) as applicable, are incorporated into this DPA by reference. For them: Clause 7 applies; under Clause 9, option 2 applies, with the notice period in section 4.2; the optional wording in Clause 11 does not apply; under Clauses 17 and 18, the law and courts of Ireland apply; and Annexes I and II are completed by Annexes 1 and 2 of this DPA and Annex III by section 4. For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies to them; for transfers from Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.
6. California
Provider will not sell or share Customer Personal Data; will not retain, use or disclose it for any purpose other than providing EA Sphere under the Agreement, or outside the direct business relationship between the parties; and will not combine it with personal data from other sources except as the CCPA permits. Provider will comply with the CCPA, provide the same level of privacy protection it requires, notify Customer if it can no longer meet its obligations under it, and allow Customer to take reasonable steps to stop and remedy any unauthorized use of Customer Personal Data. Provider understands and will comply with these restrictions.
7. General
7.1 This DPA applies for as long as Provider processes Customer Personal Data under the Agreement.
7.2 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.
7.3 Where this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA prevails; where they apply, the Standard Contractual Clauses prevail over both.
7.4 Provider may update this DPA by posting a new version on this page with a new effective date. An update will not materially reduce the protection of Customer Personal Data during a subscription term.
7.5 A customer that requires a signed copy of this DPA may request one at support@renevell.com with "Privacy" in the subject.
Annex 1. Details of the processing
| Item | Details |
|---|---|
| Parties | Customer, as controller, reached at the technical contact Atlassian provides to Provider for Customer's installation. Provider, as processor: Renevell LLC, support@renevell.com. |
| Subject matter and nature | Storing and showing, within Customer's Jira site, the records, history, exercises, learning and settings Customer's users keep in EA Sphere; attributing changes and actions to Atlassian accounts; recording Learning acknowledgments; reporting the stored account IDs to Atlassian each week and erasing those of closed accounts; and writing operational error logs, which exclude the content of Customer's records and which Provider can view only while Customer's site shares app logs with Provider. |
| Purpose | Providing EA Sphere to Customer under the Agreement. |
| Duration and frequency | Continuous while EA Sphere is installed, until the data is deleted as section 3.6 describes. |
| Data subjects | Customer's Jira users who use EA Sphere, and people whose contact details Customer's users enter in records, notices and settings. |
| Personal data | Atlassian account IDs, recorded with changes and actions, Learning acknowledgments and the list kept for the weekly personal-data report; one-way digests of account IDs held briefly with saves; acknowledgment records, with the owner teams and incident roles selected and the dates of acknowledgments and passed knowledge checks; and names, roles, email addresses and telephone numbers that Customer's users type into records, notices and settings. EA Sphere does not store names, email addresses or avatars from Atlassian profiles. |
| Special categories | None. |
| Retention | While EA Sphere is installed, subject to the change history retention period Customer's administrators set and to section 3.6. |
| Sub-processor | Atlassian: compute, storage and logging on the Forge platform, for the same duration. |
Annex 2. Technical and organizational measures
| Area | Measures |
|---|---|
| Platform | EA Sphere runs on Atlassian Forge: its functions execute on Atlassian-hosted compute and its data is held in the Forge storage for Customer's site, encrypted in transit and at rest by the Atlassian platform. Data residency follows the site's Atlassian settings. |
| No data egress | EA Sphere makes no calls outside Atlassian, loads no resources from outside Atlassian, and uses no analytics or tracking services. |
| Access control | Settings, deletion of all data and other restricted actions are verified on the server against the person's Administer Jira permission and Jira groups. Jira data is read with the signed-in person's permissions, and details of work items a person cannot see in Jira are withheld from them. |
| Integrity | The server validates every write and makes one change to a site's data at a time. Change history, recorded notices and degradation updates cannot be altered once recorded. |
| Personnel | Provider's personnel have no access to Customer Data in providing EA Sphere. Error logs are written to exclude the content of records, and Customer's site administrators can stop sharing app logs with Provider. |
| Personal data lifecycle | Weekly reporting of stored account IDs to Atlassian and erasure of closed accounts; change history retention set by Customer's administrators; export and deletion of all data by Customer's administrators. |
| Vulnerability management | Dependencies are reviewed for known vulnerabilities before each release. Reports sent to support@renevell.com with "Security" in the subject are acknowledged within two business days, and confirmed vulnerabilities are fixed within the timeframes Atlassian sets for Marketplace apps. |
| Incidents | Security Incidents are notified to Customer as section 3.5 describes and reported to Atlassian as Atlassian requires of Marketplace partners. |
Contact
Renevell LLC
Email: support@renevell.com, with "Privacy" in the subject