Edit Issues in Excel for Jira
Privacy notice
Last updated:
Who we are and what this notice covers
druidori s.r.o., company ID (IČO) 05164940, provides Edit Issues in Excel for Jira. Our registered office is Kukučínova 799/10, Hulváky, 709 00 Ostrava, Czech Republic. Contact us about privacy at info@druidori.com.
This notice covers the app, its product/help pages, and related support and customer administration. It does not replace your organisation's Jira privacy information or Atlassian's notices.
We are responsible as controller for the business information we use to handle enquiries, administer our customer relationships, and meet our own legal obligations. Your organisation determines why information is put in Jira, exported, and changed. Where we process that content on its behalf, the applicable customer agreement and data-processing terms govern our responsibilities.
When you use the app
The app receives Forge context from Jira: the search you opened it from and any selected issue keys, the site address, your locale, your Atlassian account ID, and the license status. It uses them to load the right issues, label the workbook, and check access to the app.
When you prepare a workbook, the app requests from Jira, using your Jira permissions, the issues that match the search and the fields you choose, together with field definitions, the values each field allows, and whether you can edit them. Depending on what your organisation keeps in those fields, this can include people's names and account IDs (for example, assignee or reporter), descriptions, dates, and other information.
The downloaded workbook contains the exported values and a hidden worksheet with a snapshot used to detect conflicts later: the site address, the search, the export time, the column definitions and allowed values, and each exported issue's ID, key, last-updated time and original values, including the account IDs of people in user fields. Anyone who has the file can read this information.
When you upload an edited workbook, the app reads it in your browser and compares it with the snapshot and with the current values in Jira. To match names you typed in user columns, it sends them as search terms to Jira's user search. Nothing is changed until you review the result and choose to apply it. The app then sends the confirmed changes to Jira as you. Jira records them in each issue's history under your name and may notify watchers according to its own settings. The result report you can download lists the changes and their outcomes.
All of this happens in the app's interface in your browser. The app has no vendor backend, external API destination, analytics service, app database, or browser persistence for issue data. It does not send issue data, workbooks, or reports to druidori.
Atlassian hosts the app interface and operates Jira and Forge. Its platform processing is separate from the app's own code. Information about Atlassian's practices is available in its privacy policy.
The app keeps its working data in memory while it is open. It creates no vendor-held copy to recover after you close it. Changes you apply become part of your Jira site and its history; uninstalling the app does not undo them. Downloaded workbooks and reports are separate files: closing the app or uninstalling it does not delete them. Their storage, syncing, sharing, and deletion depend on your device, organisation, and chosen applications.
When you contact support
We receive your email address, message, and any details or attachments you send. We use the necessary business correspondence to answer your enquiry and maintain the support case. We investigate problems using the safe diagnostic examples described below. We use our existing WEDOS-hosted mailbox and a mail application; copies can also exist on the devices used to handle correspondence.
We ask for synthetic or fully anonymised diagnostic examples. Ordinary support does not include access to your Jira site or handling live customer datasets, including real exported workbooks. We still receive and use your business email address and the correspondence needed to handle the enquiry, as described in this notice.
If customer personal data is sent accidentally, we limit access, avoid using it as a troubleshooting dataset, assess any necessary security or privacy response, and arrange removal of unnecessary working copies. Any residual backup copies remain subject to the protections and limitations described below. Sending material does not authorise unrelated use of it or remove applicable data-protection duties.
Our policy is to keep ordinary support correspondence for up to 12 months after resolution. We remove diagnostic files and identifying screenshots sooner when they are no longer needed. The period allows us to follow up on recurring problems; it is not a legal requirement to keep every message for a year. An applicable deletion request or customer instruction may require earlier action.
We retain particular records longer only where required by law or necessary for a specific legal claim, and limit that exception to the records needed. Deletion of working copies may precede expiry of protected provider or device backups. Such residual copies must remain protected and out of ordinary use; when a backup is restored, applicable deletions must be reapplied. We do not promise an immediate erase of every backup when a message is removed from the mailbox.
Marketplace and business records
Atlassian Marketplace can provide us with customer and technical/billing contact details, organisation and site information, license or entitlement identifiers, subscription status, user tier, and transaction details. We use information made available to us to administer the subscription, answer billing or support questions, reconcile payments, and meet accounting or legal obligations. These business records do not give us a copy of your issues or workbooks. Payments are handled through Atlassian; the app does not collect payment-card details.
We retain necessary customer-administration records while the relationship or related enquiry requires them. We avoid keeping duplicate customer lists and remove task-specific working copies when their purpose ends. Accounting records are retained for the period required for their particular record type under applicable law. Records needed for an actual dispute are restricted to that purpose until the need ends. Atlassian controls the retention of its own platform records; deleting our copy does not delete Atlassian's independent records.
Product and help website
The app's product, guide, and support pages are static pages. Their source adds no advertising or analytics scripts, tracking cookies, external fonts, or contact forms. Following a link to Atlassian or another website brings you under that service's own practices.
Our hosting provider, WEDOS (also using the VEDOS brand), processes the connection information needed to serve and protect the website. This can include IP addresses, request times, requested URLs, and technical request information. Server logs and their retention depend on the applicable hosting service and settings. If we obtain an extract to investigate a fault or abuse, we limit it to relevant entries and remove the working extract when the investigation no longer needs it, unless a specific legal obligation requires retention. The app itself does not send Jira data to this website.
Why we use business personal information
Where GDPR applies, our controller processing relies on the following grounds:
| Purpose | Basis |
|---|---|
| Responding to a person who is our customer, or taking steps they request before contracting | Performance of that contract or requested pre-contractual steps, where necessary (Article 6(1)(b)) |
| Supporting users and contacts at business customers, administering those relationships, and keeping the website reliable and secure | Our legitimate interests in providing and protecting the product and communicating with the relevant people (Article 6(1)(f)), balanced against their rights |
| Required accounting records and legally required responses or disclosures | Compliance with applicable legal obligations (Article 6(1)(c)) |
| Establishing, exercising, or defending a specific legal claim | Legitimate interests in protecting legal rights (Article 6(1)(f)), or a legal obligation where applicable |
This notice is not a request for consent. Supplying information for support is voluntary, but without enough information we may be unable to answer or investigate. Your organisation is responsible for the lawful basis for its Jira content and for the exports and changes its users make. We do not use the app to build advertising profiles or make automated decisions about individuals with legal or similarly significant effects.
Recipients and locations
Information is available to the people who need it to handle the relevant support or business task, and to service providers involved in that task. These include Atlassian for the app platform/Marketplace and WEDOS for our website and email. Professional advisers and authorities may receive the necessary information for accounting, legal advice, or a legal requirement. We do not sell personal information.
The provider is established in Czechia, but that does not mean every service processes data only in Czechia or the EU. Atlassian operates internationally; its Forge data-processing information and subprocessor list describe its arrangements. Where a transfer for which we are responsible requires protection under GDPR, we must use an applicable adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses. Contact us for information about the safeguards relevant to your data. We do not treat a Czech hosting address as proof about all email routes, device copies, or downstream providers.
Your choices and rights
Contact info@druidori.com to ask about or exercise rights relating to information we control. Depending on the circumstances and applicable law, you may request access, correction, erasure, restriction, or portability. You may object to processing based on legitimate interests. If a separate activity relies on your consent, you may withdraw it without affecting prior lawful processing.
We may request the information reasonably needed to verify your identity and locate the relevant records. We normally respond to GDPR requests within one month. If the law permits an extension for complexity or number of requests, we will explain it within that first month. Our best-effort product-support policy does not replace these legal duties.
For information in your organisation's Jira site, contact that organisation's administrator or privacy contact. We can help with matters within our control, but cannot view, edit, or delete your Jira content ourselves.
You may complain to a competent data-protection authority. In Czechia, this is the Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, email posta@uoou.gov.cz. You may also contact the authority where you live or work, or where an alleged infringement occurred. You do not need to contact us first to exercise that right.
Changes
We will keep the published notice dated and update it when relevant practices change. Material changes will be communicated as required by law. A change to the notice does not itself authorise a new use of data.