This Data Processing Addendum ("DPA") is part of the agreement between the customer that installs Zombie Hunter for Jira ("Customer") and LINEXA CONSULTING, a company registered in France under SIREN 107 250 946 (SIRET 107 250 946 00012, intra-EU VAT FR67 107 250 946), with its registered office at 4 Rue Lakanal, 78500 Sartrouville, France ("LineXa"), under the Zombie Hunter Terms of Service. It applies when the app processes personal data that is subject to the EU General Data Protection Regulation (GDPR), the UK GDPR or similar laws. The Customer accepts it by installing or using the app.
1. Roles
- The Customer is the controller of the personal data in its Jira site.
- LineXa is a processor: the app processes that data only to provide its features to the Customer.
- Atlassian is the sub-processor that hosts the app (see section 6).
2. What is processed
| Data subjects | People with an account on the Customer's Jira site who are assigned to open tickets in a project where the app is used |
| Personal data | Atlassian account ID and display name, and, for people over the In Progress limit, how many tickets they have In Progress |
| Other data | Ticket key, summary, status, date of last real activity, and the rules each ticket broke. This is not personal data unless the Customer puts personal data in ticket summaries |
| Special categories | None. The app doesn't need or ask for any |
| Purpose | Show which open tickets are inactive and who they are assigned to, warn when someone has too many tickets In Progress, and close tickets when a user clicks Close |
| Duration | While the app is installed. Each scan replaces the previous result |
The app reads descriptions, comments and changelogs while it scans, but it does not store them. It stores no email addresses and no other profile data.
3. LineXa's obligations
LineXa will:
- Process personal data only on the Customer's documented instructions. Installing and using the app, as described in the user guide, is those instructions.
- Not sell personal data, use it for its own purposes, or combine it with other data.
- Make sure anyone at LineXa who could access personal data is bound by confidentiality.
- Keep the security measures in section 5.
- Help the Customer answer data subject requests and meet its obligations on security, breach notification and impact assessments, as far as the app's design allows.
- Delete or return personal data at the end of processing (section 8).
- Give the Customer the information it needs to show compliance with this DPA (section 9).
- Tell the Customer if it believes an instruction breaks data protection law.
4. Where the data is
The app is built on Atlassian Forge. It runs on Atlassian's infrastructure and keeps its data in Forge storage for the Customer's site.
- The app makes no network calls outside Atlassian.
- LineXa runs no servers of its own for the app and holds no copy of Customer data.
- Data location follows Atlassian's Forge hosting and, where it applies, the Customer's Atlassian data residency settings.
5. Security
- Platform: encryption in transit and at rest, isolation between sites, and access control, all provided by Atlassian Forge.
- Least privilege: the app asks only for the scopes listed in the privacy policy.
- Acting as the user: Close runs as the person who clicks it, so Jira's own permissions decide what can change.
- Data minimisation: only an account ID and a display name are stored per person.
- No deliberate logging: the app does not write personal data to logs. If an error happens, Atlassian may record its message in the app's Forge logs.
- Code: changes are reviewed and tested before release.
6. Sub-processors
| Sub-processor | What it does | Where |
|---|---|---|
| Atlassian (Atlassian Pty Ltd and its affiliates) | Hosts and runs the app on Forge and stores its data | As described in Atlassian's data residency and sub-processor pages |
The Customer authorises this sub-processor. LineXa will update this page at least 30 days before adding or replacing a sub-processor. The Customer may object in writing within that time. If LineXa and the Customer can't resolve the objection, the Customer may uninstall the app.
7. Personal data breaches
LineXa will tell the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting the app. The notice will say what happened, what data and people are affected, the likely consequences and what is being done about it. Notices go to the Customer's site administrators, by email or through the Atlassian Marketplace.
8. Deletion
- When an account closes: every week the app reports the account IDs it stores to Atlassian's personal data reporting API. When Atlassian reports an account as closed, the app removes that person's account ID and name everywhere they appear. When an account is updated, the app replaces the stored name with the current one.
- When the app is uninstalled: Atlassian deletes all of the app's stored data.
- On request: the Customer can ask LineXa at any time to help remove specific data. Running a new scan also replaces the previous result.
9. Information and audits
On written request, LineXa will answer reasonable questions about how the app processes personal data, and will describe the measures in this DPA in more detail. Atlassian's certifications and audit reports cover the Forge platform. Any further audit must be agreed in advance, at reasonable times and with reasonable notice.
10. International transfers
LineXa itself doesn't receive or transfer Customer personal data. Any transfer that happens as part of hosting is made by Atlassian under its own data processing terms, including the EU Standard Contractual Clauses where they apply.
11. Liability, order and law
- Liability: the limits of liability in the Terms of Service apply to this DPA.
- Order of precedence: if this DPA and the Terms of Service conflict about personal data, this DPA wins.
- Governing law: this DPA is governed by French law.
Contact
Data protection questions and requests: support@linexa.eu.