Skip to content

Data Processing Addendum

Last updated: 20 October 2026

This Data Processing Addendum ("DPA") sets out how we process personal data on your behalf when your organization uses Issue Link Guard for Jira (the "app"). It is the contract between a controller and its processor that Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") requires. It forms part of the Terms of use.

Terms such as "controller", "processor", "personal data", "processing", and "personal data breach" have the meaning given to them in the GDPR.

1. Parties and roles

1.1 "You" means the organization that installs the app in its Jira Cloud site. You are the controller of the personal data the app processes in your site.

1.2 "We" means Bartosz Boratyński BTB IT, a sole proprietorship registered in Poland in the Central Registration and Information on Business (CEIDG), NIP (tax ID) 1182048615. We are your processor. Contact for data protection matters: privacy@btb-it.com.

1.3 If you use Jira and the app as a processor on behalf of another controller, we act as your sub-processor. The instructions you give us then include those of your controller, and you pass the information in this DPA on to it.

1.4 The app runs on Atlassian Forge. Atlassian Pty Ltd hosts it and is our sub-processor, as described in section 8.

2. What this DPA covers

2.1 This DPA covers the personal data the app processes in your Jira site on your behalf ("customer personal data"). Annex 1 describes it.

2.2 This DPA does not cover:

  • data we process as a controller for our own purposes, such as support messages, license and contact details from the Atlassian Marketplace, and invoices, which the Privacy policy describes
  • your Jira data that Atlassian processes under your own agreement with Atlassian, including the links and comments the app creates once they are saved in Jira

3. Subject matter, nature, purpose, and duration

3.1 Subject matter: storing and using the data the app needs to control who can link issues in your site and to keep its activity log.

3.2 Nature: the app reads data from Jira through Atlassian's APIs, stores some of it in Forge hosted storage, shows it to users in Jira, deletes and anonymizes it, and reports the account IDs it stores to Atlassian. All of this runs on Atlassian's infrastructure. The app sends no data to us or to any other outside service.

3.3 Purpose: enforcing your link rules, recording and showing the activity log, showing who last changed a project's settings, and meeting Atlassian's personal data reporting requirement, through which the app removes the data of closed Atlassian accounts. We do not process customer personal data for any other purpose, including our own.

3.4 Types of personal data and data subjects: Atlassian account IDs of the users of your Jira site, with the time, link type, and issues of each change recorded in the activity log, and the account IDs, group IDs, and project role IDs listed in link rules. The app does not store names, email addresses, or issue content. Annex 1 has the full list.

3.5 Duration: from when you install the app until Atlassian has deleted the app's data after you uninstall it, as described in section 11. This DPA ends then. Our duty of confidentiality continues after that.

4. Your instructions

4.1 We process customer personal data only on your documented instructions. Your instructions are:

  • this DPA and the Terms of use
  • the way you install, configure, and use the app in your site, including project settings, link rules, the technical account, and the settings on the Data and privacy tab
  • any other written instruction that we agree to

4.2 Actions in the app by people to whom you give the necessary Jira permissions, such as Jira administrators, project administrators, and users who link issues, count as your instructions.

4.3 The activity log keeps entries for 24 months unless a Jira administrator chooses another period. Keeping this default is your instruction to keep entries for 24 months. You can change it at any time. See Data and privacy and Annex 1.

4.4 We will inform you immediately if we think that an instruction infringes the GDPR or other EU or Member State data protection law.

4.5 If EU or Member State law requires us to process customer personal data in a way you did not instruct, we will tell you before we do so, unless that law forbids it.

4.6 The app can follow only the instructions it is built for. If you need something else, write to us. If we cannot agree, you can stop using the app and uninstall it.

5. Your responsibilities

5.1 You make sure that you have a legal basis for processing personal data with the app and that you inform the users of your Jira site about it, for example in your privacy notice for employees. Annex 1 describes what the activity log records, why, for how long, and who can see it.

5.2 You decide the app's settings, including the retention period, and the permissions you give your users in Jira.

6. Confidentiality

6.1 Only the owner of our business has access to the accounts and systems we use to build and run the app. We do not access customer personal data outside the app's normal operation.

6.2 Before anyone else works on the app for us, we will bind them to confidentiality and give them only the access they need.

6.3 Under the Forge Data Processing Addendum, Atlassian makes sure that its staff and its own sub-processors who process the data are bound to confidentiality.

7. Security

7.1 We take the technical and organizational measures described in Annex 2, as Article 32 GDPR requires. Atlassian protects the platform with the measures described in Exhibit B to the Forge Data Processing Addendum.

7.2 We may update our measures as the app, Jira, and Forge change, but not in a way that lowers the overall level of security.

8. Sub-processors

8.1 You give us general authorization to use sub-processors. Atlassian Pty Ltd is currently our only sub-processor for customer personal data. The current list is on the Sub-processors page and in Annex 3.

8.2 Atlassian processes customer personal data under the Forge Data Processing Addendum, which binds it to confidentiality, security measures, help with data subject requests, notice of security incidents, deletion of the data, and audit information. We will engage any other sub-processor only under a written contract that gives customer personal data at least the protection of this DPA.

8.3 We announce changes as follows:

  • a new sub-processor of our own: at least 30 days before it starts processing customer personal data, by email to the technical contacts of active licenses and on the Sub-processors page
  • a change that Atlassian announces to its own sub-processors: we pass Atlassian's notice on to the same contacts within 3 business days of receiving it

8.4 You can object to a new sub-processor in writing during the notice period, as described in Objections. We will discuss your concerns in good faith. If we cannot address them, you can stop using the app and uninstall it.

8.5 As Article 28(4) GDPR requires, we remain liable to you for our sub-processors' performance of their data protection obligations.

9. Help with data subject requests

9.1 The app gives your Jira administrators tools to respond to requests from the people whose data it processes. They can:

  • view activity log entries on the Issue Link Guard tab of each issue
  • anonymize one person's entries, which also removes the person from "last changed by"
  • anonymize all entries, delete the entries in a date range, or delete the whole log
  • set the retention period and automatic anonymization

Project administrators can remove a person from link rules by editing the project's rules. When Atlassian reports an account as closed, the app removes that person from the activity log, from "last changed by", and from link rules by itself. See Data and privacy.

9.2 If a request from one of your users reaches us, we forward it to you without undue delay and do not answer it ourselves, unless the law requires us to. We help you respond by explaining what the app stores about the person and which of the app's tools to use.

10. Help with security, breaches, and impact assessments

10.1 Annex 2 and the Security page describe our measures so that you can assess them under Article 32 GDPR.

10.2 If we become aware of a personal data breach affecting customer personal data, we will notify you without undue delay and no later than 72 hours after becoming aware of it. This includes breaches that Atlassian reports to us. We send the notice to the technical contacts of your license.

10.3 The notice contains the information available at that time:

  • what happened and when
  • the categories and approximate number of people and records concerned
  • the likely consequences
  • the measures taken or proposed to address the breach
  • who to contact for more information

We will update you as we learn more.

10.4 As the controller, you decide whether to notify the supervisory authority and the people concerned. We give you the information you need for that and take reasonable steps to contain and investigate the breach in the app.

10.5 For data protection impact assessments and prior consultations with a supervisory authority, we give you the description in Annex 1, this documentation, and answers to reasonable questions about the app. We pass on the information Atlassian provides about Forge, as far as Atlassian allows.

11. Deletion at the end

11.1 While the app is installed, your Jira administrators can delete or anonymize activity log entries at any time, and project administrators can change or remove link rules, as described in section 9.

11.2 When you uninstall the app, Atlassian deletes the app's data from Forge hosted storage. The data is first kept for about 28 days so that it can be recovered if the app was uninstalled by mistake, and then destroyed. If you reinstall the app within 21 days and want the data back, contact us and we will ask Atlassian to relink it to the new installation. Reinstalling the app does not restore the data by itself. Atlassian may keep data that the law requires it to keep, isolated from any further processing.

11.3 We keep no copy of customer personal data. The app does not export its data to a file and we have no access to it, so we cannot send you a copy. If you need records from the activity log, review them in Jira before you uninstall the app.

11.4 Links and comments the app created, and picker link lists stored as issue properties, stay in Jira after you uninstall the app. Picker link lists contain no personal data.

12. Information and audits

12.1 We make available the information you need to check that we meet this DPA and Article 28 GDPR:

12.2 The Forge Data Processing Addendum gives us summaries of Atlassian's audit reports and written answers from Atlassian, not on-site audits. We pass on what Atlassian provides, as far as Atlassian allows, but we cannot offer you an on-site audit of Atlassian.

12.3 If you need any other audit or inspection of our business, carried out by you or by an auditor you appoint who is bound by confidentiality, we will agree its scope and timing with you. You give us reasonable notice and bear the cost of the audit.

12.4 This section does not limit the powers of a supervisory authority.

13. International transfers

13.1 We do not transfer customer personal data outside the European Economic Area (EEA). We are based in Poland, and the app sends no data to us or to anyone else.

13.2 Forge hosted storage keeps the app's data in your Jira site's data residency location. If your site uses the Global location, Atlassian chooses the region. Atlassian may occasionally process an individual request outside that location, and its own sub-processors may process data outside the EEA. Atlassian does this under the safeguards of the Forge Data Processing Addendum, which includes the Standard Contractual Clauses, and, where applicable, the EU-US Data Privacy Framework.

13.3 By using the app on Atlassian Forge, you instruct us to use Atlassian in this way.

14. Liability and precedence

14.1 Liability under this DPA is subject to the limitation of liability in the Terms of use, except where the law does not allow liability to be limited. Nothing in this DPA limits the rights of data subjects.

14.2 If this DPA and the Terms of use conflict on the processing of personal data, this DPA prevails.

15. Governing law

15.1 This DPA is governed by Polish law. Disputes are settled by the court named in the Terms of use, unless mandatory law provides otherwise.

16. Acceptance, changes, and notices

16.1 This DPA forms part of the Terms of use. It applies when you install or use the app, and no separate signature is needed.

16.2 If you need a signed copy for your records, write to privacy@btb-it.com. We will send you this DPA as a PDF signed by us, which you can countersign.

16.3 We may change this DPA to follow changes in the law, in Atlassian's terms, in Forge, or in the app. We will tell the technical contacts of active licenses about material changes at least 30 days before they take effect, unless the law or Atlassian requires a shorter period. If you do not agree to a change, you can stop using the app and uninstall it.

16.4 Send notices under this DPA to privacy@btb-it.com. We send our notices to the technical contacts of your license in the Atlassian Marketplace, so make sure they are up to date.

Annex 1. Description of processing

Item Description
Subject matter Storing and using the data the app needs to control who can link issues in your Jira site and to keep the activity log
Nature Reading data from Jira, storing it in Forge hosted storage, showing it in Jira, deleting and anonymizing it, and reporting the stored account IDs to Atlassian's personal data reporting API
Purpose Enforcing link rules, recording and showing the activity log, showing "last changed by", and removing the data of closed Atlassian accounts
Duration From installation until Atlassian deletes the app's data after the app is uninstalled
Frequency Continuous while the app is installed
Data subjects Users of your Jira site: people who create or remove links through the app or whose link chosen on the create screen was not created, people named in link rules, and administrators who change the app's project settings or turn on the technical account
Storage location Forge hosted storage in your Jira site's data residency location, as described in section 13
Sub-processors See Annex 3

The app is not designed to process special categories of personal data (Article 9 GDPR) or data about criminal convictions and offenses.

Personal data the app stores

Data Stored in Personal data Kept for
Activity log The app's database (Forge SQL) Account ID of the person who requested a link change, or whose link chosen on the create screen was not created, with the time, the action, the link type, the issues involved, and whether the technical account made the change 24 months by default; a Jira administrator can choose 1 to 60 months or Never, anonymize entries, delete them, or turn the log off
Project rules Forge Key-Value Store Account IDs, group IDs, and project role IDs that may use a link type Until the rules are changed, the project is deleted, or the app is uninstalled
"Last changed by" Forge Key-Value Store Account ID of the person who last saved a project's settings or turned on the technical account, and when Until the next change, until the person is anonymized, or until the app is uninstalled
Account report register Forge Key-Value Store Account IDs the app stores, as reported to Atlassian every 7 days, and whether Atlassian reported the account as closed Until the account ID no longer appears in the app's other data, when the next report removes it

When Atlassian reports an account as closed, the app removes that person from the activity log, from "last changed by", and from project rules.

Personal data the app processes without storing it

While it runs, the app reads from Jira the data it needs to show and check links: display names, group and project role memberships, the users and groups that project administrators search for when they configure rules, and issue keys and summaries in issue search. It keeps this data only briefly in memory.

If a project has that option on, the technical account adds a comment on both issues that names the person who requested the link. The comment is regular Jira data.

The app does not store names, email addresses, passwords, tokens, or issue content. Picker link lists (issue properties), one project property, one app property, and the progress of cleanup jobs contain no personal data.

Default retention of the activity log

The retention period is your decision. The default of 24 months is a proposal built into the app, chosen so that the log covers at least two yearly audit and planning cycles. By keeping it, you instruct us to keep entries for 24 months. You can shorten the period, turn on automatic anonymization, or turn the log off on the Data and privacy tab at any time.

Annex 2. Technical and organizational measures

The Security page describes these measures in more detail.

In the app

Measure Description
No outside services The app runs entirely on Atlassian Forge. It has no servers of its own, declares no external domains and no remote back ends, and sends no data to us or to any other outside service.
Data minimization The app stores account IDs, group IDs, and project role IDs, not names, email addresses, or issue content. It reads names from Jira when it shows them.
Storage and encryption The data is kept in Forge hosted storage in your site's data residency location. Atlassian encrypts it in transit and at rest.
Tenant isolation Forge keeps each site's data in a separate partition. The app's short-lived in-memory caches are keyed by the site's installation, so one site's data is never served to another.
Access control The server checks every request to create or remove a link against the project's rules, the license, and the user's Jira permissions. Project settings need Administer Projects or Administer Jira, and the admin page needs Administer Jira. The activity log is shown only to people who can view the issue.
Least privilege By default, the app talks to Jira as the signed-in user. Before the app's own account acts for a user, the app checks that user's permissions. If a check cannot be made, the app refuses the change. The app requests only the scopes listed on the Security page.
Retention and erasure A daily job deletes entries older than the retention period and applies automatic anonymization. Administrators can delete or anonymize entries on demand. The data of closed Atlassian accounts is removed after the report to Atlassian, which runs every 7 days.
Logging The app's logs contain event types, counts, issue and project keys, and error codes. They never contain account IDs, names, issue content, or the text of Jira's responses.

In our business

Measure Description
Access Only the owner of our business has access to the Atlassian developer account, the GitHub account, and the email accounts we use for the app. The Atlassian developer account, the GitHub account, and the OVHcloud account that manages our email use multi-factor authentication. Our mailboxes are protected with strong, unique passwords.
No access to customer data We have no access to customer personal data outside the app's normal operation.
Secure development Every code change is scanned with Atlassian's security scanner for Forge apps (Forge Security Requirements Tester), and the app's dependencies are audited for known vulnerabilities.
Vulnerability handling Security reports go to security@btb-it.com. We acknowledge them within 2 business days and fix vulnerabilities within the targets of Atlassian's Security Bug Fix Policy: Critical within 10 days, High within 4 weeks, Medium within 12 weeks, and Low within 25 weeks.
Incidents We report security incidents to Atlassian as Atlassian requires, and we notify you of personal data breaches as described in section 10.
Confidentiality As described in section 6.

At Atlassian

Atlassian describes its measures for the Forge platform in Exhibit B to the Forge Data Processing Addendum. They include encryption of data in transit and at rest, logical separation of each developer's data, access controls and background checks for Atlassian staff, business continuity plans, vulnerability management, and independent audits such as SOC 2 and ISO 27001. Atlassian may update these measures as long as the overall level of security does not materially decrease.

Annex 3. Sub-processors

Sub-processor Service Location Safeguards
Atlassian Pty Ltd Hosting, storage, and compute for the app on Atlassian Forge Your Jira site's data residency location. Atlassian may occasionally process an individual request in another location. Forge Data Processing Addendum, including the Standard Contractual Clauses

Atlassian's own sub-processors are listed at atlassian.com/legal/sub-processors. The current list of our sub-processors and the way we announce changes are on the Sub-processors page.

Previous versions

This is the first version of this DPA. Every change to it is recorded in the page history on GitHub.