Data Processing Addendum

Version DD-DPA-2026-10-28.1 — prepared 28 October 2026.

This is the Datadelight DPA instrument prepared for customer agreement. It includes the processing annex. It takes effect only when incorporated into a binding customer agreement or signed by authorised representatives with the completion details below. Viewing this page, installing an app or contacting support does not execute it. This prepared version has unresolved completion requirements; it is not represented as an agreement already in force.

For a copy to complete or customer-specific terms, use Request a DPA. No customer data or credentials are needed in an initial request.

1. Parties, scope and precedence

The customer identified in the completion record is the Controller (or a processor authorised by its controller). The provider operating under the public name Datadelight, identified in that record, is the Processor. This Addendum applies only to personal data processed on the customer's behalf through the selected covered apps: Block Done While Blockers Open, Long URL Field, Group Mentions for Confluence and Whole Number Field. Other products need a separate schedule.

Applicable Data Protection Law means the EU GDPR, UK GDPR and other data protection law applicable to this processing. Personal Data, Controller, Processor, processing and personal data breach have their meanings under that law. Customer Personal Data means personal data in the processing annex for the selected apps. The customer determines the purposes and lawful basis, provides required notices and is responsible for lawful instructions and authorisation from any upstream controller.

This Addendum prevails over conflicting service terms on processing Customer Personal Data. It does not reduce statutory rights, supervisory powers or mandatory transfer safeguards. Other commercial terms remain in the underlying agreement. No unilateral website update changes an executed version; amendments require agreement in writing.

2. Instructions and permitted use

Datadelight shall process Customer Personal Data only on documented customer instructions, including instructions concerning international transfers, to provide the selected app functions described in the annex. The agreement, configured app actions and subsequent authorised written directions constitute instructions. Datadelight shall not sell or share that data for advertising, use it for independent profiling, or combine it for unrelated purposes.

If law requires processing beyond those instructions, Datadelight shall inform the customer before processing unless prohibited by that law. Datadelight shall immediately inform the customer if an instruction appears to infringe Applicable Data Protection Law and suspend the affected instruction pending lawful clarification.

Where California service provider or contractor requirements apply, Datadelight shall retain, use and disclose personal information only for the specified business purposes and permitted legal exceptions, including no sale or sharing, no use outside the direct business relationship and no prohibited combination with other sources. Datadelight shall provide the same level of protection required by applicable law, notify the customer if it can no longer comply, and allow reasonable steps to check, stop and remediate unauthorised use.

3. Confidentiality and security

Datadelight shall ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations and access only what their duties require. Datadelight shall implement and maintain technical and organisational measures appropriate to risk, taking account of the nature of the data, processing context and state of the art, consistent with Article 32 where applicable. Measures shall include access control, protection of credentials, appropriate protection in transit and at rest, incident handling, recovery arrangements and regular assessment of effectiveness.

The annex distinguishes observed app controls from infrastructure assurances still requiring verification. This clause is an obligation on execution, not evidence that every operational measure or certification has already been verified. Datadelight shall not materially reduce agreed protection during the agreement.

4. Subprocessors

Datadelight shall engage a subprocessor only with the customer's prior written specific or general authorisation. The completion record must identify the initial authorised entities and functions; naming a platform in the annex alone is not that authorisation. Under general authorisation, Datadelight shall give at least 30 days' prior written notice of intended additions or replacements and a reasonable opportunity to object on data protection grounds before the new entity processes data.

Datadelight shall bind each subprocessor by written obligations providing equivalent protection for the processing, including assistance, security and deletion, and remain responsible to the customer for its performance. If a justified objection cannot be resolved, the affected processing shall not be assigned to that entity; the parties shall agree an alternative or end the affected service before the change. Customer-selected websites opened from links are not thereby appointed as Datadelight subprocessors.

5. Assistance and incidents

Taking account of the nature of processing, Datadelight shall assist the customer through appropriate technical and organisational measures with requests to exercise data subject rights. Datadelight shall promptly forward requests received directly and shall not respond substantively except on customer instructions or as legally required.

Taking account of information available and the processing, Datadelight shall assist with security obligations, breach assessment and notification, impact assessments and prior consultation with supervisory authorities. Datadelight shall notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notification shall include available information about the breach, affected data and individuals, likely consequences, mitigation and a contact point. Missing information shall follow in stages without undue delay. Datadelight shall investigate, contain and remediate the breach and preserve relevant evidence.

6. Information and audit

Datadelight shall make available information necessary to demonstrate compliance with this Addendum and applicable processor obligations, and allow and contribute to audits and inspections by the customer or its mandated auditor. The parties shall coordinate reasonable notice, confidentiality and protection of other customers' data; these arrangements shall not prevent an urgent incident investigation or a competent authority's lawful access. A platform report may support an audit but does not replace these rights.

7. Duration, return and deletion

Processing continues for the selected services' term and the period necessary to complete lawful return or deletion instructions. At the customer's choice on termination, Datadelight shall return or delete Customer Personal Data and delete existing copies unless law requires retention. Any legally retained data shall remain protected and used only for that legal requirement; Datadelight shall explain the basis and applicable period unless prohibited.

The parties shall record the return format, responsible operators, completion timetable and verification method before execution. Platform records, logs, queued jobs and backup copies must be included in that plan. Customer-managed Jira or Confluence content is handled through the customer's platform controls and instructions. Uninstalling an app is not a confirmed deletion method. In particular, Group Mentions has no automatic expiry or deletion of mention records in the assessed code. Datadelight must establish an effective procedure for those records before committing to a completion date. No retention deadline is inferred from log visibility.

8. International transfers

Datadelight shall not make a restricted international transfer without documented customer instructions and a lawful mechanism under Applicable Data Protection Law. Before such processing the parties shall document applicable entities, locations, onward transfers, safeguards and any required assessment or supplementary measures. Where standard contractual clauses or a UK transfer instrument are required, the parties must complete and incorporate the applicable instrument and annexes separately. This Addendum does not itself incorporate unspecified clauses or assert that platform hosting resolves transfer requirements.

9. Completion record

Before this instrument becomes effective, the parties shall record in a separate private agreement: their contracting identities and authorised representatives; the underlying agreement; selected apps and applicable production versions; effective date; customer instructions and data subject categories; authorised subprocessor legal entities and contractual chain; applicable locations and transfer arrangements; operational security and assistance contacts; and the return/deletion procedure and timetable. Do not place private identity details on this public page.

The processing annex records the assessed behavior and unresolved factual requirements. The execution record must resolve those requirements for the customer's processing. Existing approval to offer DPA support remains in place; preparation of this text does not sign an agreement or change Marketplace answers.