Data processing agreement · Christian Ortiz

What this agreement is

This data processing agreement (“DPA”) is the Data Protection Addendum for the Confluence Cloud and Jira Cloud apps I publish on the Atlassian Marketplace:

It forms part of the Atlassian Marketplace end-user agreement and each app’s Provider-Specific Terms (Page Tree Markdown Export, Safe Tree Copier, Steadfast Gantt Planner, Estimate Scheduler) whenever an app processes personal data on your behalf. It applies automatically; you don’t need to sign anything. If your organization needs a countersigned copy, email support@christianortiz.studio.

It’s written to meet Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR, and similar laws. Where a law gives you more protection than this DPA, that law applies.

The parties

You, the organization that installs the app on its Confluence Cloud or Jira Cloud site, are the controller: you decide what content is in your site and who may use the app.
I, Christian Ortiz, an individual publishing as Christian Ortiz Studio, am the processor: the app handles personal data only to do what your users ask it to.

Under the California Consumer Privacy Act (CCPA), I’m your service provider. I don’t sell or share your personal information, and I don’t use it for any purpose other than providing the app.

What is processed

Purpose: providing the app’s features to your users: exporting pages to Markdown, copying page trees between spaces, planning projects in Gantt charts, or scheduling Jira issues from their estimates, as each app’s documentation describes.

Personal data:

Atlassian account IDs of the people who use the app, stored with their exports, saved jobs, run records, charts, chart versions, copied rows, schedule views and date write-back records.
Personal data that may appear in page titles, page content, labels, file names, chart and task names, view names and JQL your team wrote into Confluence or Jira, to the extent the app stores or passes them on while doing its job.

Data subjects: your Confluence and Jira users, and anyone named in your Confluence or Jira content.

Special categories: none are intended. The app doesn’t look for or treat sensitive data differently; it handles all content the same way.

Duration: for as long as the app is installed, and then until the deletion described in End of processing.

Each app’s privacy policy lists exactly what it stores and for how long: Page Tree Markdown Export, Safe Tree Copier, Steadfast Gantt Planner, Estimate Scheduler.

My obligations

I’ll:

process personal data only on your documented instructions, which are the agreement, this DPA and your users’ actions in the app, unless the law requires otherwise (and if it does, I’ll tell you first unless the law forbids that);
tell you if I believe an instruction breaks data protection law;
keep personal data confidential. I’m the only person with access to the app’s operation, and I’m bound to confidentiality;
never use your data to train models, profile people, advertise, or for any purpose of my own.

Security

The app runs entirely on Atlassian Forge: its code runs on Atlassian’s infrastructure, its data lives in Atlassian-hosted storage that belongs to your site, and it declares no external servers and makes no requests outside Atlassian. The security measures are listed in each app’s privacy policy, in its Security section. They include least-privilege access scopes, permission checks for every user action, no third-party code or assets loaded at runtime, and logs that carry no page content and no account IDs.

Sub-processors

The only sub-processor is Atlassian, which hosts the app’s code and storage (Forge hosted compute and storage) under the Forge Data Processing Addendum. You authorize this sub-processor by installing the app.

Before I add or replace a sub-processor, I’ll give at least 30 days’ notice on this page and in the app’s Marketplace listing, so you can object. If we can’t resolve an objection, you can stop using the app and uninstall it. Any new sub-processor will be bound by data protection terms at least as protective as this DPA.

Where data is processed

Personal data stays in Atlassian’s infrastructure. Forge hosted storage follows your site’s data residency location when your site is pinned to one. Any transfer of personal data outside its location happens within Atlassian’s platform and is covered by Atlassian’s transfer mechanisms, including the EU Standard Contractual Clauses in the Forge Data Processing Addendum. I don’t copy your data anywhere else.

Helping you

I’ll help you, as far as is reasonable and taking into account how the app works:

Rights requests. Many requests can be handled in the app: an export or a saved job can be deleted at any time, copied Gantt rows expire after 24 hours, and a schedule view can be deleted at any time. If you need more, email me and I’ll respond within 30 days. If a person contacts me directly about your data, I’ll pass the request on to you.
Assessments. I’ll give you the information you need for a data protection impact assessment or a consultation with a regulator.
Account closures. The apps report stored account IDs to Atlassian’s personal data reporting service and act on closed accounts, as each privacy policy describes.

Personal data breaches

If I become aware of a breach of security that affects your personal data, I’ll tell you without undue delay, with what I know about what happened, the data involved, and what I’m doing about it, and I’ll keep you updated as I learn more.

End of processing

When the app is uninstalled from your site, its data is deleted under Atlassian’s data lifecycle for Forge hosted storage: it’s soft-deleted at uninstall and permanently removed after Atlassian’s 28-day retention period. I don’t keep a copy. If you want it removed sooner, or want confirmation, email me.

Audits

On written request to support@christianortiz.studio, I’ll give you the information you reasonably need to confirm I’m meeting this DPA, including written answers to a security questionnaire, no more than once a year unless a breach or a regulator requires more. Because the app’s data lives in Atlassian’s infrastructure, Atlassian’s own audit reports cover that infrastructure. I don’t hold separate certifications such as SOC 2 or ISO 27001.

Changes

If I change this DPA, I’ll update the date at the top of this page and give notice in the apps’ release notes or Marketplace listings before the change takes effect. A change won’t reduce the protection your data has during a period you’ve already paid for.

Contact

Christian Ortiz, publishing as Christian Ortiz Studio
support@christianortiz.studio