Data Processing Agreement

“Controller” means the Customer — your Atlassian organization that installs and uses SuperTemplates.

“Processor” means Konkret.dev, a registered business (działalność gospodarcza) in Poland, operating as SuperTemplates — we process data only as necessary to provide the App's functionality. Full company details are available on our Contact page.

“Sub-processor” means a third party engaged by the Processor to assist in data processing (AI providers, Atlassian Forge).

“Personal Data” means any information relating to an identified or identifiable natural person, as defined by GDPR Article 4(1).

We process personal data solely to provide the App's functionality:

We implement the following technical and organizational measures:

The Controller authorizes the use of the following sub-processors. We will notify the Controller of any intended changes to this list (additions or replacements) with at least 30 days' advance notice via email to site administrators.

The Controller may object to a new sub-processor by notifying us in writing within 14 days of receiving our notice. If the Controller objects and we cannot reasonably accommodate the objection, either party may terminate the affected service with 30 days' notice. We will not engage the objected sub-processor for the Controller's data during the objection period.

In the event of a personal data breach, we will notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach, enabling the Controller to fulfill its obligation to notify the supervisory authority under GDPR Article 33.

Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will assist the Controller in notifying affected data subjects without undue delay, in accordance with GDPR Article 34.

The notification will include sufficient information for the Controller to fulfill its own obligations under GDPR Articles 33 and 34, including:

• The nature of the breach
• Categories and approximate number of data subjects and records affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach, including mitigation
• Contact details of our Data Protection Lead for further information

Personal data may be transferred to sub-processors located outside the EEA. We ensure lawful transfer through the following mechanisms:

• EU-US Data Privacy Framework (DPF): Where the sub-processor is certified under the DPF (e.g., Google LLC). We verify certification status annually.
• Standard Contractual Clauses (SCCs): For sub-processors not certified under the DPF, we rely on the European Commission's Standard Contractual Clauses (Module 3: Processor to Sub-processor) as the legal basis for transfer. For Cerebras (US-based), SCCs with UK Addendum are incorporated in the Cerebras DPA. A Transfer Impact Assessment (TIA) has been conducted; supplementary measures include zero data retention and a contractual no-training guarantee.
• Technical safeguards: Known Jira user display names are pseudonymized (replaced with anonymous codes) before data leaves Forge. System identifiers (account IDs, emails, project keys, board names) are stripped entirely and never transmitted. We acknowledge that user-entered prompts may contain personal data and treat all prompt data accordingly.
• EU-only processing: Available via Google Vertex AI European regional endpoints (regions depend on model version; currently includes Netherlands, Belgium, Finland, France, Spain, Poland). When AI models are updated or replaced, available regions are determined by Google and may change. We will always prefer EU endpoints when available.

Customer obligation: Users should avoid including sensitive personal data (health data, financial data, national ID numbers) in AI generation prompts. The App is designed for project management content, not processing of special category data.