Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (“DPA”) is between the Customer (the “Controller”) and Radrly Sp. z o.o., Poland (registered office: ul. Tarczyńska 68, 05-831 Krakowiany, Poland; KRS 0001215510, NIP 5342706013, REGON 543658680) (the “Processor”). It forms part of the End User License Agreement and applies to personal data that the Processor processes on the Controller's behalf through CapRadar. Terms such as “personal data” and “processing” have the meaning given in Regulation (EU) 2016/679 (GDPR).

2. Subject matter, duration and nature

• Subject matter: providing CapRadar: classifying Jira work for software capitalization and R&D time records, period close with approvals and signed snapshots, reports and exports.
• Duration: for as long as the Controller has the app installed, plus the deletion period described in section 9.
• Nature and purpose: reading data inside Atlassian Forge, storing results in Forge hosted storage, and showing them to authorised users.
• Infrastructure: the app runs only on Atlassian Forge (Runs on Atlassian). It declares no remote hosts, uses no Forge Remote or Connect, and makes no egress to servers outside Atlassian. No processing of Controller data takes place on Radrly-operated servers.

3. Data and data subjects

• Data subjects: people whose worklogs or assigned work items are processed, people whose rates, absences or team shares are imported, and users of CapRadar.
• Categories of personal data stored:
  • Atlassian account IDs, linked to an internal random person key
  • worklog metadata (work item, start time, duration) and the work item fields used by rules and allocation, including status and assignee intervals
  • absence dates and type codes, cost centres, departments, legal entities and team shares that you enter or import
  • rates you enter or import, non-labour cost lines, plans, policies, rules, phases, overrides and their reasons
  • period states, approvals, attestations, snapshots, hashes, the audit trail, export logs and Rovo drafts
• Not stored: Worklog comments, work item summaries and descriptions, comments, attachments, email addresses and display names. Summaries used for R&D evidence are read with the caller's permissions when requested and not stored.

4. Instructions

The Processor processes personal data only on the Controller's documented instructions, which are these terms, the Controller's configuration of the app and the Controller's use of its features. If the Processor believes an instruction infringes data protection law, it will inform the Controller.

5. Confidentiality and personnel

The Processor ensures that people authorised to process personal data are bound by confidentiality obligations. As the app runs on Atlassian Forge and has no code path that sends Controller data to Radrly, Radrly staff have no routine access to Controller data.

6. Security

The Processor implements appropriate technical and organisational measures under Article 32 GDPR, described in Annex II and on the Security page.

7. Sub-processors

The only sub-processor is Atlassian (Atlassian Pty Ltd and affiliates), which hosts Forge and the Atlassian Cloud products. The Controller gives general authorisation for the sub-processors in Annex III. The Processor will inform the Controller of intended changes so that it can object.

8. Assistance, personal data breaches and audits

• Data subject rights: the Processor will help the Controller to respond to data subject requests.
• Breach notification: the Processor will notify the Controller without undue delay, and in any event within 48 hours after becoming aware of a personal data breach affecting the Controller's data.
• Audits: the Processor makes available the information needed to show compliance and allows reasonable audits, which may be satisfied by documentation, Atlassian's published compliance reports or a written questionnaire.

9. Return and deletion

Locked snapshots are kept while the app is installed. In the Advanced edition an administrator sets retention; many accounting regimes expect records to be kept for several years, so check your own requirements. Standard keeps audit trail detail beyond snapshots for 90 days. When Atlassian reports an account as closed, the Processor removes or pseudonymises that account ID. After uninstall, the Forge platform deletes the app's data according to Atlassian's policy.

10. International transfers

The Processor does not transfer personal data itself. All CapRadar data is stored in Forge hosted storage under the Controller's Atlassian data residency choice. Any transfers by Atlassian are governed by Atlassian's own transfer mechanisms.

11. Liability, term and law

Liability under this DPA is subject to the limitations in the End User License Agreement, to the extent the law allows. This DPA lasts as long as the Processor processes personal data for the Controller and is governed by the laws of Poland. If this DPA and the EULA conflict on personal data, this DPA prevails.

Annex II: Technical and organisational measures

• Hosting on Atlassian Forge (Runs on Atlassian). Encryption at rest and in transit provided by Atlassian.
• Storage in Forge hosted storage only, following the Controller's data residency.
• No egress: no calls to remote hosts, no Forge Remote or Connect, no public API.
• Server-side permission checks before every read; validated input; prepared SQL statements.
• Data minimisation as described in section 3; logs without personal data.
• Automated checks before every production deployment; a vulnerability reporting process.

Annex III: Sub-processors

No other sub-processors.

Contact

Privacy and DPA questions: marcin@radrly.com.