Data Processing Agreement

“Controller” means the Customer — your Atlassian organization that installs and uses SuperTemplates.

“Processor” means Konkret.dev, a registered business (działalność gospodarcza) in Poland, operating as SuperTemplates — we process data only as necessary to provide the App's functionality. Full company details are available on our Contact page.

“Sub-processor” means a third party engaged by the Processor to assist in data processing (e.g., Atlassian Forge, which provides cloud hosting, storage, and AI inference).

“Personal Data” means any information relating to an identified or identifiable natural person, as defined by GDPR Article 4(1).

We process personal data solely to provide the App's functionality:

We implement the following technical and organizational measures:

The Controller authorizes the use of the following sub-processors. We will notify the Controller of any intended changes to this list (additions or replacements) with at least 30 days' advance notice via email to site administrators.

The Controller may object to a new sub-processor by notifying us in writing within 14 days of receiving our notice. If the Controller objects and we cannot reasonably accommodate the objection, either party may terminate the affected service with 30 days' notice. We will not engage the objected sub-processor for the Controller's data during the objection period.

In the event of a personal data breach, we will notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach, enabling the Controller to fulfill its obligation to notify the supervisory authority under GDPR Article 33.

Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will assist the Controller in notifying affected data subjects without undue delay, in accordance with GDPR Article 34.

The notification will include sufficient information for the Controller to fulfill its own obligations under GDPR Articles 33 and 34, including:

• The nature of the breach
• Categories and approximate number of data subjects and records affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach, including mitigation
• Contact details of our Data Protection Lead for further information

Personal data may be transferred to sub-processors located outside the EEA. We ensure lawful transfer through the following mechanisms:

• EU-US Data Privacy Framework (DPF): Where the sub-processor is certified under the DPF (e.g., Google LLC). We verify certification status annually.
• Standard Contractual Clauses (SCCs): For sub-processors not certified under the DPF, we rely on the European Commission's Standard Contractual Clauses (Module 3: Processor to Sub-processor) as the legal basis for transfer.
• Technical safeguards: Known Jira user display names are pseudonymized (replaced with anonymous codes) before AI generation. AI inference happens inside Atlassian's Forge platform — prompts are not transmitted to any external AI provider. System identifiers (account IDs, emails, project keys, board names) are never included in AI prompts. We acknowledge that user-entered prompts may contain personal data and treat all prompt data accordingly.
• Data residency: App data in Forge Key-Value Storage follows your Atlassian Cloud data residency region. AI inference is handled by Atlassian within its own infrastructure.

Customer obligation: Users should avoid including sensitive personal data (health data, financial data, national ID numbers) in AI generation prompts. The App is designed for project management content, not processing of special category data.