RequestOps Data Processing Addendum (short form)

Parties. The customer organisation that installs RequestOps (controller) and Unitlane Apps, operated by Jonas Nilsson, Sweden (processor). Applies together with the Terms of Use when personal data in the customer’s Jira site is processed by RequestOps.

1. What is processed. Atlassian account IDs; text typed into the app (checklist names, vendor names, message text); and request information RequestOps reads from Jira to show status and send messages. Purpose: providing RequestOps. Duration: while the app is installed, then as described in the Privacy Policy. Data subjects: the customer’s staff, requesters/customers, approvers and vendor contacts.

2. Processing in practice. RequestOps runs on Atlassian Forge. Unitlane Apps does not receive customer data in normal operation, collects no telemetry and operates no servers that hold it. Processing happens in Atlassian’s hosted runtime and storage, under the customer’s Atlassian agreement and Atlassian’s Forge terms.

3. Instructions. We process personal data only on the customer’s documented instructions, which are the customer’s configuration and use of the app.

4. Confidentiality. Only Jonas Nilsson has access to Unitlane Apps systems; no access to customer data is granted or expected. If support needs data, the customer chooses what to send.

5. Security. Measures are in the security statement: Forge platform protections, least-privilege scopes, server-side validation, signed one-time links, and no external egress.

6. Subprocessors. Atlassian (Forge hosting and storage, Jira). No other subprocessor handles app data. Support emails are handled in Unitlane’s own mail system and are not app data. Support mail is hosted with Zoho Mail. Changes to this list will be posted on this page.

7. Assistance. Within reason we help the customer answer data-subject requests. The customer’s Jira administrator can, in Settings, Privacy and data, download supported app-stored data and erase a person’s account reference. RequestOps also reports stored account IDs to Atlassian’s personal-data reporting service and applies its instructions for supported records. Coverage is the app’s own records; it is not a promise to reach every copy in Jira.

8. Incidents. If we become aware of a personal-data breach affecting RequestOps data we will tell the affected customers without undue delay through Marketplace contact details and support email, and tell Atlassian through its Marketplace security process.

9. Deletion and return. On removal of the app, Atlassian manages retained app storage under its platform policy; data in Jira stays with the customer. We hold no copy to return or delete.

10. Audits. We will answer reasonable written questions. Atlassian’s own audit reports cover the platform.

11. Transfers. Data location follows the customer’s Atlassian site and Forge hosting. We make no transfer ourselves.

12. Law. Swedish law.

Contact: [email protected]