Edit Issues in Excel for Jira
Data-processing attachment
Last updated:
Version: 1.0
Incorporated terms
For Orders that incorporate this attachment, the Data Protection Addendum consists of the unchanged Bonterms Data Protection Addendum v2.0, Attachment Version, including its exhibits, together with the DPA Details and Additional Terms below. It applies to the extent Provider processes Customer Personal Data on Customer's behalf under the Main Agreement.
The Bonterms standard is published by Bonterms, Inc. under CC BY 4.0. The product-specific details and Additional Terms below are supplied by druidori and are separate from that standard. The privacy notice describes Provider's own business processing and does not substitute for this DPA. A page revision date does not replace the DPA Effective Date.
DPA details
| Field | Value |
|---|---|
| Provider | druidori s.r.o., IČO 05164940, Kukučínova 799/10, Hulváky, 709 00 Ostrava, Czech Republic |
| Provider privacy contact | info@druidori.com |
| Customer | The customer identified in the Marketplace Order incorporating these terms; its address and primary contact are those in the Order or otherwise supplied for the agreement |
| Customer privacy contact | The privacy contact supplied by the customer; otherwise its designated primary contact for the agreement |
| Main Agreement | The Bonterms Standard End User Agreement v1.0 and druidori Provider-Specific Terms incorporated into that customer's Order for Edit Issues in Excel for Jira |
| DPA effective date | The effective date of the customer's Agreement that incorporates this attachment, not the revision date on this page |
| Service | Edit Issues in Excel for Jira: customer-directed exports of Jira issues to Excel workbooks and user-confirmed updates of those issues from the workbooks through the app, with applicable Forge delivery/platform processing; ordinary support uses synthetic or fully anonymised diagnostic examples |
| Roles | druidori acts as processor only for processing performed on the customer's behalf; the customer acts as controller or as a processor authorised by its controller |
| Designated EU Governing Law / Designated EU Member State | Czech Republic, for the applicable transfer provisions; mandatory data-subject protections remain unaffected |
| Subprocessor list | Atlassian Pty Ltd for covered platform activity, with applicable downstream providers disclosed through the linked service-specific list below, subject to the change-notice process |
Processing description
- Instructions and purpose: deliver and authorise the app; retrieve the issues matching the user's search and the fields the user chooses; produce the workbook; compare an uploaded workbook with its export snapshot and current Jira values; resolve names typed in user columns; and, when the user confirms, update the reviewed fields in Jira as that user. The product instructions do not authorise using customer content for advertising, selling data, or unrelated purposes.
- Data and people: the content of the requested issues and fields, the uploaded workbook (including its hidden snapshot of original values), and Jira user-directory results such as display names and account IDs. Depending on what the customer keeps in Jira, this can include names, contact information, identifiers, professional details, communications, and other ordinary personal data about users, personnel, business contacts, or customers. The app receives Forge context and uses the search, selected issue keys, site address, locale, account ID and licence state. Covered platform processing can include account identifiers, time zone and IP information described in Forge's DPA; this does not mean the app records those values in a druidori database.
- Excluded data: the restrictions in the Main Agreement continue to apply. No special-category or other restricted Sensitive Data is authorised by this attachment. The app does not inspect or certify that issues or workbooks comply with those restrictions; the customer controls the source issues, the files, and their destinations.
- Operations and frequency: platform delivery and access checks; user-initiated retrieval through Jira; temporary transformation and comparison in browser memory; user-directed workbook and report files; and updates of user-confirmed field values through Jira, which records them in the issue history. Ordinary support does not include access to customer sites or live customer datasets.
- Duration: app working data is not persisted by druidori. Source issues, applied changes, workbooks and reports remain with the customer. Covered platform data follows the applicable Forge arrangements. Unexpected provider-held customer data is restricted and removed when unnecessary, subject to applicable instructions, deletion/preservation duties and narrowly applicable exceptions. Ordinary support-contact retention does not override rights over accidentally supplied customer content.
- Separate controller records: druidori's ordinary business contacts, subscription administration, and legally required accounting records are described in the privacy notice and are not automatically customer content processed under this DPA. The role depends on the actual material and purpose of processing.
App subprocessors
| Provider/service | Relevant activity | Scope and locations |
|---|---|---|
| Atlassian Pty Ltd (ABN 53 102 443 916), Australia / Forge | App-interface delivery and applicable platform processing performed for druidori | Functions and processing locations of applicable downstream services are disclosed in Atlassian's service-specific provider list. Coverage is limited to the services actually used to provide this app; the list also describes other products and optional features |
The Forge DPA covers applicable processing for the developer and incorporates transfer safeguards where required. Jira also serves the customer under its own agreement; that relationship is not relabelled as a druidori subprocessor arrangement. The app does not use Forge storage or vendor functions. Global platform processing may involve locations outside the EEA; applicable transfer safeguards under the Forge DPA apply to the covered transfers. Source Jira content and customer-controlled file destinations remain subject to the customer's own arrangements.
Security measures for the service
The current app requests read:jira-work, write:jira-work and read:jira-user, runs every request with the signed-in user's Jira permissions, and has no vendor function, remote, external fetch declaration, or content store. Workbook creation, parsing and comparison run inside the app's browser interface. Updates are sent only for cells the user changed and confirmed in the review; a value changed in Jira since the export is shown as a conflict and is not overwritten unless the user selects it. Jira enforces edit permissions and field validation on every update. Workbooks store text as literal strings; text is not evaluated as a formula.
Operational measures include limiting administration to authorised people, protecting development and release access, maintaining dependencies, reviewing and testing changes, and handling security reports. Any unexpected provider-held customer content requires restricted access, minimisation, deletion and incident assessment. Provider maintains a response owner, daily security and supplier-alert monitoring with absence coverage, and a monthly review for the support-retention policy. The app has no independent druidori security certification or penetration-test programme.
Additional terms
Subprocessor notice periods. In Sections 4.3 and 4.4(a) of Bonterms DPA v2.0, each 30-day period is replaced by 10 calendar days. This also applies to relevant changes in the downstream processing chain disclosed through Atlassian's list. The remaining objection, good-faith discussion and termination/refund provisions remain unchanged. Provider will actively notify the customer's designated administrator by email; updating a public list alone does not constitute notice. Mandatory law and applicable SCCs retain precedence.
Ordinary support scope. Ordinary support uses synthetic or fully anonymised diagnostic examples and does not include accessing customer Jira sites or investigating live customer datasets, including real exported workbooks. Any additional service requiring customer personal data must be separately agreed with the appropriate processing details and safeguards before it starts. Unexpected disclosure does not waive any duties arising under applicable law.
Customer-controlled data. The app has no customer-content repository at druidori. Requests concerning source Jira content, applied changes, or customer-controlled workbooks and reports must be handled through the customer's systems; druidori will assist within its role and control. This describes the architecture and does not waive mandatory assistance or deletion duties.