For "TriageQuant" for Atlassian Jira. This DPA forms part of, and is incorporated by reference into, the Software License and Subscription Agreement (the "Agreement") between CITIES BUBBLES ("Licensor") and the customer identified in the applicable Order Form ("Licensee"). It applies where, and to the extent that, Licensor processes Personal Data on behalf of Licensee in connection with the "TriageQuant" application (the "Software").
1.1. "Data Protection Laws" means all laws applicable to the processing of Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR") and the laws of the Republic of Lithuania implementing or supplementing the GDPR, and any national implementing or successor laws.
1.2. "Personal Data", "Controller", "Processor", "Data Subject", "Processing", "Sub-processor", "Supervisory Authority", and "Personal Data Breach" have the meanings given in the GDPR.
1.3. "Licensee Personal Data" means Personal Data contained within Licensee Data that Licensor processes on Licensee's behalf under the Agreement.
1.4. "Sub-processor" means any third party engaged by Licensor to process Licensee Personal Data.
2.1. Roles. With respect to Licensee Personal Data, Licensee is the Controller and Licensor is the Processor. Where Licensee is itself a processor for a third party, Licensor is a sub-processor and Licensee warrants it has authority to instruct Licensor accordingly.
2.2. AI analysis — two modes.
(a) Default (Licensor-managed model). By default, Licensee Personal Data submitted to the AI feature is processed by a model (Mistral) that Licensor self-hosts on its own AWS infrastructure in the European Union (Milan, Italy — AWS eu-south-1). In this mode Licensor acts as Processor, AWS is Licensor's Sub-processor (compute/infrastructure only, listed in Annex B), the model provider does not receive the data, and the data is processed transiently in memory and is not persistently stored.
(b) Optional (Licensee's own model — Paid Edition). Where Licensee configures its own AI provider/model, Licensee Personal Data is transmitted directly to the provider Licensee selects. For that transfer Licensee is the sole Controller, that provider is Licensee's own recipient — not Licensor's Sub-processor — and Licensee is solely responsible for the lawful basis, agreements, and transfer mechanisms (see Sections 5 and 13.5 of the Agreement).
2.3. Instructions. Licensor processes Licensee Personal Data only on Licensee's documented instructions, including those set out in the Agreement, this DPA, and the configuration of the Software, unless required to do otherwise by applicable law (in which case Licensor will inform Licensee unless legally prohibited).
2.4. Details of processing. The subject matter, duration, nature and purpose of processing, types of Personal Data, and categories of Data Subjects are described in Annex A.
Licensor shall:
3.1. Lawful instruction. Process Licensee Personal Data only as set out in Section 2.3, and inform Licensee if, in its opinion, an instruction infringes Data Protection Laws.
3.2. Confidentiality. Ensure that persons authorized to process Licensee Personal Data are bound by appropriate confidentiality obligations and process the data only as needed.
3.3. Security. Implement and maintain the technical and organizational measures set out in Annex C, appropriate to the risk, in accordance with Article 32 GDPR.
3.4. Sub-processors. Engage Sub-processors only in accordance with Section 4.
3.5. Assistance with Data Subject requests. Taking into account the nature of the processing, assist Licensee by appropriate technical and organizational measures, insofar as possible, to respond to requests from Data Subjects exercising their rights under Chapter III GDPR. Because the Software runs natively in Licensee's tenant, Licensee can ordinarily fulfil such requests directly within Jira.
3.6. Assistance with compliance. Assist Licensee in ensuring compliance with its obligations under Articles 32–36 GDPR (security, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of processing and information available to Licensor.
3.7. Breach notification. Notify Licensee without undue delay and in any case within 72 hours after becoming aware of a Personal Data Breach affecting Licensee Personal Data, and provide information reasonably available to assist Licensee's own notification obligations (see Section 7).
3.8. Deletion or return. On termination or expiry of the Agreement, and at Licensee's choice, delete or return Licensee Personal Data, and delete existing copies, unless retention is required by law. Because Licensee Data resides in Licensee's tenant, Licensee may export DNA Score data before uninstalling; uninstalling the Software removes data per the Atlassian Forge data lifecycle.
3.9. Audits and information. Make available to Licensee information reasonably necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by Licensee or an auditor it mandates, subject to Section 8.
4.1. General authorization. Licensee provides general written authorization for Licensor to engage the Sub-processors listed in Annex B, and any others Licensor notifies under Section 4.3.
4.2. Obligations flow-down. Licensor imposes on each Sub-processor data-protection obligations no less protective than those in this DPA and remains liable for the acts and omissions of its Sub-processors.
4.3. Changes. Licensor will give Licensee at least 30 days' prior notice of the addition or replacement of any Sub-processor (for example, via the sub-processor page or email). Licensee may object on reasonable data-protection grounds within 14 days; the Parties will then work in good faith to resolve the objection, failing which Licensee may terminate the affected part of the Subscription as its sole remedy.
4.4. The AI Provider is expressly not a Licensor Sub-processor (see Section 2.2).
5.1. Licensee Personal Data hosted on Forge remains within the Atlassian data-residency configuration chosen by Licensee. For the default AI mode, processing occurs on Licensor's AWS infrastructure located in the European Union (Milan, Italy — AWS eu-south-1); this path does not involve a transfer outside the EEA, and no separate transfer mechanism is required for it.
5.2. Where Licensor or a Sub-processor transfers Licensee Personal Data outside the EEA, the UK, or other jurisdiction with restrictions, the transfer will be governed by an appropriate safeguard, such as the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, for the UK, the UK International Data Transfer Addendum, or an adequacy decision.
5.3. The SCCs are incorporated by reference and completed as follows: Module Two (Controller-to-Processor) applies; Licensee is the data exporter, Licensor the data importer; the optional docking clause applies; for Clause 9, Option 2 (general authorization) with the period in Section 4.3; for Clause 11, the optional independent-dispute-resolution body does not apply; for Clause 17, the governing law is the law of Lithuania; for Clause 18, the forum is the courts of Kaunas, Lithuania. Annexes I, II, and III to the SCCs are populated by Annex A, Annex C, and Annex B of this DPA respectively.
The liability of each Party under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement (Section 16).
7.1. The notification in Section 3.7 will, to the extent known, describe the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed.
7.2. Licensor's notification is not an acknowledgment of fault or liability.
7.3. Licensor will coordinate with Licensee on external communications regarding a breach and follow the incident-management practices summarized in Annex C.
8.1. Audits under Section 3.9 will occur no more than once per 12-month period (unless required by a Supervisory Authority or following a confirmed breach), on at least 30 days' notice, during business hours, without unreasonable disruption, and subject to confidentiality.
8.2. Licensor may satisfy audit requests by providing relevant certifications, third-party reports, or its responses on the Atlassian Marketplace Privacy and Security tab, where these reasonably address Licensee's questions.
9.1. This DPA takes effect on the Effective Date and remains in force for as long as Licensor processes Licensee Personal Data. Provisions that by their nature should survive, survive termination.
9.2. Except as modified here, the Agreement remains in full force. This DPA is governed by the same law as the Agreement.
| Item | Description |
|---|---|
| Subject matter | Provision of the "TriageQuant" Software and its AI analysis feature within Licensee's Jira Cloud instance |
| Duration | The Subscription Term and any period required to delete or return data |
| Nature and purpose | Storing configuration; generating, displaying, and persisting DNA Score records; providing support; maintaining security and reliability |
| Type of Personal Data | Any Personal Data the Licensee chooses to include in Jira issue content or configuration submitted to the Software; administrator/account identifiers; support correspondence. The Licensee shall be liable for the unlawful submission/uploading of data subjects' personal data to Jira without the required consents. The Licensee should not submit special-category data unless it has a lawful basis and so instructs. |
| Categories of Data Subjects | Licensee's employees and any individuals referenced in the Jira issue content the Licensee submits |
| Frequency | Continuous / on-demand, as determined by Licensee's use |
| Processing operations | Collection, storage, structuring, retrieval, display, transmission (in the default mode, to Licensor's self-hosted AI model on AWS in the EU, processed transiently in memory only; in the optional mode, to the Licensee's own AI provider), erasure |
The current, up-to-date list of authorized Sub-processors is also maintained at citiesbubbles.com/legal/sub-processors.
| Sub-processor | Purpose | Location | Safeguard for transfers |
|---|---|---|---|
| Atlassian Pty Ltd / Atlassian, Inc. | Hosting of the Software on the Forge platform; Marketplace licensing and billing; native data storage | As per Atlassian data residency | Atlassian DPA / SCCs |
| Amazon Web Services EMEA SARL (AWS) | Cloud compute/infrastructure hosting the self-hosted Default AI Model for the AI analysis feature (Default Mode) | European Union (Milan, Italy) | EU processing (no transfer); AWS DPA / EU SCCs where applicable |
| Amazon Web Services (AWS) | Hosting Licensor's self-hosted Mistral model for the default AI analysis mode (compute only; transient, in-memory processing — no storage of prompts/outputs) | Milan, Italy (eu-south-1) | Within EEA — no separate transfer mechanism required for this hop |
The following measures apply, taking into account that the Software runs natively on Atlassian Forge and that Licensor does not maintain a separate persistent copy of Licensee Data (Agreement Section 13.1):