srcplugins

Data Processing Addendum

Effective 24 October 2026.

Scope

This Data Processing Addendum forms part of the Terms of Use between Nicholas Gibson, an individual doing business as srcplugins ("we", "us" or "our"), and the organization that installs or uses our apps ("you"). It applies when our apps process personal data on your behalf ("customer personal data") and takes effect when you accept the Terms of Use, without a separate signature. Where it conflicts with the Terms of Use on data protection, this addendum takes precedence.

"Data protection laws" means applicable laws governing the processing of personal data, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act (CCPA). Terms such as controller, processor, data subject, personal data breach and sub-processor have the meanings those laws give them.

Roles

You are the controller of customer personal data, or a processor acting for your own customer. We are your processor, or sub-processor, and a service provider under the CCPA. This addendum doesn't cover personal data we handle as a controller, such as support emails and website requests, which our Privacy Policy describes.

Processing details

  • Subject matter and purpose: providing, supporting and securing the apps you install, as described in each app's documentation.
  • Nature: our apps run on Atlassian Forge, inside Atlassian's cloud. They read and change content in your Atlassian product through Atlassian's APIs, usually as the signed-in user and only within the app's listed permissions, and keep app data, such as settings, in Forge storage for your site. They don't send data to srcplugins servers or other external services unless an app's documentation says otherwise.
  • Data subjects: your users of the Atlassian product, and anyone named or described in the content those users work with through an app.
  • Categories of personal data: Atlassian account IDs and the profile details Atlassian's APIs return with them; personal data contained in content the app reads or writes, such as work item text; and technical data in the logs Atlassian provides to us, such as site, app version, license status and errors. Each app's page lists what it stores.
  • Sensitive data: our apps aren't designed or intended to process special categories of personal data or other sensitive personal information. You shouldn't use them for that purpose. The security measures described in this addendum apply to all personal data the apps process.
  • Frequency and duration: continuous while an app is installed, then until its data is deleted as described under Deletion and return below.

Your instructions

We process customer personal data only on your documented instructions, unless the law requires otherwise; if it does, we'll notify you beforehand unless legally prohibited from doing so. Your instructions are the Terms of Use, this addendum, and your configuration and authorized use of the apps. We'll tell you if we believe an instruction breaks data protection laws. You are responsible for having a lawful basis for the processing and for the content your users put into your Atlassian product.

California

We process customer personal data under the CCPA only for these business purposes: reading and updating the content in your Atlassian product that your authorized users direct an app to; keeping app configuration and operational records; and providing support, diagnosing problems and keeping the apps secure. We don't sell or share customer personal data, retain, use or disclose it outside our direct business relationship with you or for any other purpose, or combine it with personal data from other sources, except as the CCPA allows.

We provide the level of privacy protection the CCPA requires of service providers, and we'll notify you if we determine that we can no longer meet those obligations. You may take reasonable and appropriate steps to verify our compliance and to stop and remediate unauthorized processing, subject to applicable law and the security and access limits of the Atlassian platform.

Confidentiality and security

Only people working for srcplugins who need access to provide or support the apps can access customer personal data, and they are bound by confidentiality. We maintain these technical and organizational measures:

  • Apps run only on Atlassian Forge, protected by Atlassian's hosting, storage and platform security. We operate no servers that receive your Atlassian data.
  • Each app requests only the permissions its features need, published on its page, and acts as the signed-in user where it can, so your site's permissions decide what it can see.
  • Apps are designed to keep your content, credentials and tokens out of logs. Atlassian makes app logs available to us for 30 days, and your administrators can turn off our access to them in Atlassian Administration, under the app's logs access setting.
  • We use automated testing, dependency vulnerability scanning and security checks in our release process, and publish our apps' source code for independent review.
  • We use separate Atlassian sites and non-customer test data for development and testing. We access customer data only when necessary for authorized support, troubleshooting or security purposes.

Sub-processors

You authorize us to use these sub-processors for customer personal data:

  • Atlassian (Atlassian Pty Ltd and its affiliates) hosts and runs our apps on Forge, stores their data and provides their logs. Atlassian processes this data under the Forge Data Processing Addendum, which governs its processing and its use of further sub-processors.

Atlassian Rovo, and Atlassian's other products and services, are provided to you by Atlassian under your own agreement with Atlassian, not by us as sub-processors. If you send us customer personal data in a support request, it is stored by our email provider as our Privacy Policy describes.

We engage sub-processors under written agreements requiring appropriate protection of customer personal data, and remain responsible for their performance of their data protection obligations as applicable law requires. Before appointing a new sub-processor of our own, we'll notify affected customers in writing at least 30 days in advance and update this page. Changes to Atlassian's own sub-processors are managed by Atlassian under the Forge Data Processing Addendum. If you object to a new sub-processor on reasonable data protection grounds, tell us at contact@srcplugins.com; if we can't resolve it, you may stop using the affected app by uninstalling it.

Assistance

Customer personal data stays in your Atlassian product and its Forge storage, so your administrators can usually answer data subject requests themselves. Where they can't, we'll help, taking into account the nature of the processing and the information available to us. If a data subject contacts us directly, we'll refer them to you. We'll also give you reasonable assistance with your obligations on security of processing, personal data breach notification and response, data protection impact assessments and prior consultation with supervisory authorities.

If we receive a legally binding request from a government authority or other third party to disclose customer personal data, we'll notify you before disclosure unless legally prohibited, and disclose only the information applicable law requires. We'll refer other requests concerning customer personal data to you where appropriate.

Personal data breaches

We'll notify you without undue delay after becoming aware of a personal data breach affecting customer personal data. We'll describe what happened, the likely effects and the steps taken, as far as we know them, update you as we learn more, and help you respond. We notify Atlassian as the Marketplace Partner Agreement requires.

Deletion and return

When you uninstall an app, content stored in your Atlassian product, including content the app created, remains under your control and is not automatically deleted; you can export or delete it with your Atlassian product. Data held in Forge hosted storage is subject to Atlassian's retention and deletion policies, which currently provide a 28-day retention period after uninstalling. Operational logs are retained under Atlassian's applicable retention policies. We don't independently retain copies of customer personal data, except where this addendum or our Privacy Policy says so.

At the end of the processing, or earlier if you ask, we'll delete or return customer personal data, as far as the Atlassian platform makes that feasible, unless the law requires us to keep it. Ask us at contact@srcplugins.com.

Audits

We'll make available the information reasonably needed to show that we meet this addendum, including our published source code and app documentation, and answer reasonable written questions. Where that isn't enough, we'll allow and contribute to an audit by you or an independent auditor bound by confidentiality, with at least 30 days' prior written notice, no more than once a year, at your cost. Those limits don't apply to an audit required by applicable law or a supervisory authority, or one following a personal data breach or credible evidence of material noncompliance. Atlassian's own security and audit reports cover the Forge platform.

International transfers

When your Atlassian product is pinned to a supported data residency location, app data in Forge hosted storage is kept in that location; otherwise Atlassian chooses where it is kept. Atlassian may sometimes run an app's code in another location, and app logs and support may involve other countries, so data residency doesn't mean all processing happens in that location. Atlassian's transfers are covered by the Forge Data Processing Addendum, which incorporates the EU Standard Contractual Clauses.

Where processing under this addendum involves a transfer of personal data from the European Economic Area, the United Kingdom or Switzerland to us in a country without an adequacy decision, the transfer terms below apply.

Transfer terms

EU Standard Contractual Clauses

The EU Standard Contractual Clauses (Commission Decision 2021/914) are incorporated by reference and completed as follows:

  • Modules: Module Two where you are a controller; Module Three where you are a processor.
  • Clause 7: the docking clause applies.
  • Clause 9: option 2 (general written authorization), with the notice period under Sub-processors above.
  • Clause 11: the optional language doesn't apply.
  • Clause 13: the competent supervisory authority is determined as clause 13 provides.
  • Clauses 17 and 18: the law of Ireland, and the courts of Ireland.

Annex I.A: parties

  • Data exporter: you, as identified by the Atlassian site where the app is installed and the contact details in your Atlassian Marketplace records; role controller or processor; activities: using our apps with your Atlassian product. Accepting the Terms of Use counts as signing.
  • Data importer: Nicholas Gibson, an individual doing business as srcplugins, 1968 S. Coast Hwy #3946, Laguna Beach, CA 92651, United States; contact contact@srcplugins.com; role processor or sub-processor; activities: providing and supporting the apps. Publishing this addendum as part of the Terms of Use counts as signing.

Annex I.B: description of transfer

The data subjects, categories of personal data, sensitive data, frequency, nature, purpose and duration are as set out under Processing details above. Transfers to sub-processors are as set out under Sub-processors, for the same purposes and duration.

Annex I.C: competent supervisory authority

The competent supervisory authority is the one determined under clause 13 and applicable data protection law.

Annex II: technical and organizational measures

Our measures are those under Confidentiality and security above. Under Atlassian's Forge shared responsibility model, Atlassian provides these measures for the Forge platform:

  • Encryption of data at rest in Forge app storage, and TLS encryption of traffic in transit.
  • A secure runtime that isolates apps and prevents them from bypassing its security controls.
  • Segregation of Forge app storage by site, so an app installed on one site can't read another site's data.
  • Access to Atlassian APIs controlled by the app's declared permissions, and external network requests restricted to domains declared in its manifest.
  • A platform that is SOC 2 attested and ISO 27001 certified.

Annex III: sub-processors

Not applicable, as clause 9 option 2 applies. Our sub-processors are listed under Sub-processors above.

United Kingdom

For transfers from the United Kingdom, the International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0), issued by the UK Information Commissioner, applies. Table 1 is completed by Annex I.A above, Table 2 by the modules and options above, Table 3 by Annexes I and II above, and in Table 4 neither party may end the addendum under its section 19. Its mandatory clauses are Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

Switzerland

For transfers from Switzerland, the EU Standard Contractual Clauses apply as completed above, with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, references to the GDPR read as references to the Swiss Federal Act on Data Protection, clauses 17 and 18(b) referring to the laws and competent courts of Switzerland instead of Ireland, and the term "member state" not read to exclude data subjects in Switzerland from suing in their place of habitual residence.

Liability and changes

Each party's liability under this addendum is subject to the limitation of liability in the Terms of Use. That limitation doesn't override the Standard Contractual Clauses or any rights and remedies that data protection laws make mandatory. We may update this addendum to reflect changes in the law, our apps or our sub-processors, and will change the effective date when we do; we won't reduce its protection for customer personal data without notifying customers as the Terms of Use describe for material changes.

Contact

For data protection questions, or a signed copy of this addendum, email contact@srcplugins.com.