Data Processing Agreement

Access Review for Jira · Bobook Limited

This Data Processing Agreement ("DPA") forms part of the agreement between Bobook Limited, Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland ("Processor") and the customer organisation that installs Access Review for Jira ("Controller"), and governs processing of personal data under Article 28 of the EU General Data Protection Regulation (GDPR).

Version 1.0 · 1 September 2026

1. Roles

The Controller determines the purposes and means of processing personal data in its Jira site. Bobook Limited acts solely as a Processor and processes personal data only on the Controller's documented instructions, which for this app are given by installing and running it.

2. Subject matter, duration, nature and purpose

Subject matter. Providing the Access Review for Jira app.

Duration. For as long as the app is installed on the Controller's site.

Nature and purpose. Reading the project list and permission scheme configuration already present in the Controller's Jira site in order to produce a report showing who holds a selected permission on each project, and returning that report to the administrator who requested it.

3. Types of personal data

Permission scheme configuration read transiently to build the report: project keys and names, scheme names, and the holders of each grant.

Holders are ordinarily groups and project roles, which are not personal data. Jira also permits a grant to a single named individual; where the Controller's site contains such a grant, that individual's display name is read and shown in the report. The app does not expand group membership and holds no scope that would allow it to.

Bobook Limited does not store any of this data. It is read when a report is run, held in memory for the duration of that request, returned to the requesting administrator's browser, and discarded.

The only data the app stores is a single configuration value: the permission key last selected, for example BROWSE_PROJECTS.

4. Categories of data subjects

Users of the Controller's Jira site who hold a permission granted to them individually.

5. Where processing happens

Entirely within Atlassian's cloud, on the Atlassian Forge platform. The app declares no egress permissions and makes no network calls outside Atlassian. No personal data is transmitted to Bobook Limited or to any third party.

6. Sub-processors

Atlassian Pty Ltd, which hosts both the Controller's Jira site and the app.

There are no other sub-processors. Bobook Limited will inform the Controller before adding or replacing a sub-processor, and the Controller may object.

7. Security measures

• The app requests read-only scopes (read:jira-work) and cannot grant, revoke or edit any permission. This is enforced by the Atlassian platform.
• All reads are performed as the signed-in user, so the app cannot expose configuration that user could not already access.
• No egress. The app cannot transmit data outside Atlassian.
• No permission data is persisted; only a single configuration value is stored, in Atlassian's Forge storage.
• Access to the app's source and deployment is limited to Bobook Limited personnel using multi-factor authentication.

Bobook Limited holds no security certifications, and none is claimed.

8. Confidentiality

Personnel authorised to process personal data are bound by confidentiality.

9. Assisting the Controller

Because the app stores no personal data, requests from data subjects for access, rectification, erasure, restriction, portability or objection are satisfied by the Controller within Jira itself. Bobook Limited will assist on request as far as the nature of the processing allows.

10. Personal data breach

Bobook Limited will notify the Controller without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting the Controller's personal data, at the administrative contact on record.

11. Deletion

Uninstalling the app removes its stored configuration value. No permission or personal data is retained at any point, so no further deletion is required.

12. Audit

Bobook Limited will make available the information necessary to demonstrate compliance with Article 28 and will contribute to audits conducted by the Controller or its auditor, on reasonable notice and no more than once a year unless required by a supervisory authority.

13. International transfers

Processing takes place within Atlassian's infrastructure under Atlassian's own data residency and transfer arrangements. Bobook Limited itself is established in Ireland and does not transfer personal data outside the EEA.

14. Contact

support@bobook.club — Bobook Limited, Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland.

Requests to sign a counterpart DPA on the Controller's own paper are welcome at the same address.