DPA processing annex

Annex to DD-DPA-2026-10-28.1 — prepared 28 October 2026. This annex forms part of the DPA instrument. It describes the four assessed production releases. It is not an assertion that the prepared instrument is published or executed. Contact support@accounts.datadelight.co through the request route to complete an agreement.

A. Common processing and people

The subject matter is operation of the customer's selected Jira or Confluence apps. Processing includes reading, evaluating, displaying and, where described below, writing customer-selected data and recording diagnostic events. Frequency depends on app use; Group Mentions also processes queued and hourly subscription jobs. Duration is the service term followed by return or deletion under section 7 of the DPA.

Data subjects may include the customer's users, administrators, group members, collaborators and people identified in customer work items, links or content. The customer determines which categories actually occur. Free text and URLs can contain personal data; numeric references can identify people in context. These apps are not intended as a dedicated system for special-category or criminal-offence data. Customers must identify any such intended processing and agree appropriate safeguards before using it for that purpose.

B. App schedules

Block Done While Blockers Open

Assessed production: Forge 3.1.0, source 1f502d9. Purpose: evaluate workflow transitions and linked blockers; show a refusal when applicable. The validator reads work item keys, link types, linked keys, status identifiers and names, and summaries; its optional condition evaluates Jira expression data as the viewer. The validator reads Jira as the app. Same-project blocker summaries can appear in the refusal.

No app-owned database is used. Jira holds the underlying work items. Forge diagnostic logs include work item keys, target status, outcomes, blocker keys and failure snippets. The live Marketplace answer for logging End-User Data was Yes in the retained verification; this annex preserves that fact. Data in Jira follows customer platform controls. No app-defined log deletion period or purge mechanism is established.

Long URL Field

Assessed production: Forge 2.3.0, source 146ba93. Purpose: store and display long links and optional labels, derive host values and support administrator copy, check, set and repair operations. Data includes URLs, optional labels, hosts, field metadata, selected JQL, work item identifiers and source/target field values. The admin resolver reads as the user and writes app field values as the app; processing is scoped by selected work items and platform permissions.

Values are stored in Jira custom fields; no app-owned database is used. App diagnostic statements report operation counts. This is not a claim that platform telemetry contains no personal data. Retention and removal of stored values follow customer Jira controls; no separate app retention period is established. Opening a stored link contacts a customer-selected destination after Atlassian's confirmation; the destination's handling is outside this processing service and is not evidence of a contracted subprocessor.

Group Mentions for Confluence

Assessed production: Forge 2.4.0, source b9797f7. Purpose: find selected group-mention macros in saved page/blog content, mention members in footer comments, manage group subscriptions and display/manage the user's watched pages. The app reads page/blog content, content and macro IDs, group IDs/names, member account IDs, display names/types, watch state and space permissions. It posts mention comments on behalf of the saver and changes watches on behalf of the subscribing administrator. Confluence decides whether and how members are notified; the saver is excluded from mentions.

Forge key-value storage holds mention records keyed by content and macro ID: group ID/name, delivered account IDs, status, counts, timestamp and possible error. Subscription records hold space IDs/keys, target page ID/title or space key, group ID/name, subscribing administrator account ID, timestamps/status and member account IDs with app/own/opted-out watch state. Queued delivery jobs include content ID/type and saver account ID; queued sync jobs include subscription key and offset. Confluence stores the resulting comments and watches.

Mention records have no automatic expiry or implemented delete path in the assessed code. Removing a macro is not a proven purge. Unsubscribe queues removal of watches added by that subscription, preserves members' own watches and watches still held by another subscription, then deletes the subscription and member records when removal completes. Failures can leave records for further handling. An hourly membership sync removes departed members from its member map and removes qualifying app-added watches.

Logs include content, macro and subscription identifiers, status, counts and errors. The retained live Marketplace logging answer was Yes. No automatic deletion of Confluence comments, uninstall purge, queue retention, backup deletion period or log retention duration is established. A verified return/deletion procedure for persistent mention records and failed removals remains a prerequisite to execution.

Whole Number Field

Assessed production: Forge 2.2.0, source 978e111. Purpose: validate and format whole numbers and let administrators preview/copy selected source values into the app field. Data includes number values, work item identifiers/keys, selected JQL, field IDs/types and context minimum, maximum and separator configuration. Copying reads Jira under the caller's permissions and writes app field values through Jira as the app.

Jira holds values and context configuration; no app-owned database is used. Diagnostic logs include counts and error messages. No separate app retention period or log purge is established. Newer development releases add context-table synchronisation and an out-of-range display notice; those are not attributed to this production release. The documentation's create-time work-type range limitation remains applicable; no reliable per-work-type create enforcement is promised.

C. Platforms, security and retention limits

All four assessed manifests use Atlassian Forge and Jira or Confluence APIs; no app-declared external network egress is identified. Atlassian provides the product, runtime, logging and, for Group Mentions, key-value storage and queues. This is a technical dependency inventory, not a verified list of contractual subprocessor legal entities. The customer's own Atlassian agreement may govern some product processing directly; the provider's Forge contractual chain and any subprocessing arrangements must be verified separately.

Observed controls include declared API scopes, platform-mediated access and per-action permission checks where implemented. Block Done's validator deliberately acts as the app; Group Mentions uses saver or administrator impersonation for background actions. No claim of certification, particular hosting region, backup schedule, encryption configuration or independently audited controls is made from source code alone. The DPA's security obligations require operational evidence before execution.

The retained Forge guidance establishes developer console log visibility for the past 30 days and a site administrator's ability to disable developer log access. Visibility is not a verified storage or deletion period. No fixed platform log, queue, backup or post-uninstall retention duration is established by this assessment. Customer Jira/Confluence content and Forge app records require separate treatment in the return/deletion plan.

D. Completion requirements

Before execution, establish the contracting provider identity privately, authorised subprocessor entities and terms, processing/access locations and transfer safeguards, actual platform retention/deletion behavior, a tested Group Mentions export/purge procedure and handling of queues and failed removals. Verify security operations, incident and rights-request handling, audit support and return/deletion responsibilities. These are unresolved operational facts, not inferred guarantees or a new request for approval to offer DPA support.

See the individual privacy policies, security information and documentation. Those pages describe the products; they do not execute this Addendum or override its completion requirements.