Business Sign-off & Approval for Jira
This Data Processing Addendum (“DPA”) forms part of the agreement between Cahaba Forge LLC (“Cahaba Forge”, “we”, “us”, or “Processor”) and the customer (“Licensee”, “you”, or “Controller”) under which Licensee has licensed the Business Sign-off & Approval for Jira application (“the App”) via the Atlassian Marketplace (the “Agreement”). “The Agreement” means the Cahaba Forge End User License Agreement under which Licensee has licensed the App, together with any applicable Atlassian Marketplace license terms.
This DPA sets out the terms under which Cahaba Forge processes Personal Data on behalf of Licensee in connection with Licensee’s use of the App. It is designed to satisfy the requirements of Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), the UK GDPR, and, where applicable, the California Consumer Privacy Act of 2018 (“CCPA”).
In the event of any conflict between this DPA and the Agreement or Cahaba Forge’s Privacy Policy, this DPA shall take precedence with respect to the processing of Personal Data.
Unless otherwise defined in this DPA, capitalized terms have the meanings given to them in the GDPR. For clarity:
3.1 Licensee is the Controller of all Personal Data Processed by the App within Licensee’s Jira Cloud site.
3.2 Cahaba Forge is the Processor and Processes Personal Data solely on behalf of Licensee and in accordance with Licensee’s documented instructions, including those set out in this DPA, the Agreement, and Licensee’s configuration of the App.
3.3 Atlassian acts as a Sub-processor, providing the Forge platform, hosted storage, and Jira Cloud infrastructure on which the App operates. Cahaba Forge does not operate an external backend or data store for the App’s configured approval-data processing. Product-support information received directly by Cahaba Forge is handled separately as described in the Privacy Policy.
Subject matter: Processing Personal Data as necessary to provide the approval workflow, audit trail, notification, and configuration functionality of the App.
Duration: For the term of the Agreement and until all Personal Data is deleted or returned in accordance with Section 11 of this DPA.
Nature of Processing: Collection, storage, retrieval, display, pseudonymization, and deletion of Personal Data within the Atlassian Forge platform and Jira Cloud.
Purpose of Processing: To enable approval workflows, enforce permission and Separation of Duties rules, administer and configure the App, provide compliance and audit functionality, deliver notifications, support troubleshooting and operational support, measure feature use within Atlassian’s Forge infrastructure, and perform required Atlassian personal-data and account lifecycle reporting. Information intentionally provided directly to Cahaba Forge for product support is handled separately as described in the Privacy Policy.
These categories do not imply that every operational log, platform measurement, or metadata item contains Personal Data. Atlassian’s platform logging and measurement practices are subject to its applicable policies; the counter-payload exclusions described below do not extend to all platform metadata.
The App does not request Atlassian passwords, API tokens, customer-managed secrets, or third-party service credentials for normal App operation. The App does not load external analytics scripts; it records numeric feature-use counts within Atlassian’s infrastructure. The App’s submitted counter payload does not include account identifiers, display names, email addresses, issue identifiers, decision comments, or audit content. Platform measurements are not guaranteed to be anonymous or unassociated with an installation. See the Privacy Policy for logs and measurements.
The App is not designed for Sensitive Data, including special categories of Personal Data as defined in GDPR Article 9. Licensee’s restrictions on submitting such data are set out in the Agreement; customer-provided text can nevertheless contain personal or sensitive information.
Cahaba Forge shall:
6.1 Process Personal Data only on documented instructions from Licensee, including as set out in the Agreement, this DPA, and Licensee’s configuration of the App, unless required to do otherwise by applicable law. In such a case, Cahaba Forge shall inform Licensee of that legal requirement before Processing, unless the law prohibits such disclosure.
6.2 Ensure that persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
6.3 Implement and maintain appropriate technical and organizational measures to protect Personal Data as described in Section 7.
6.4 Assist Licensee, insofar as reasonably possible and taking into account the nature of the Processing, in fulfilling Licensee’s obligations to respond to Data Subject requests (Section 9).
6.5 Assist Licensee in ensuring compliance with its obligations under GDPR Articles 32 to 36, including security of Processing, breach notification, data protection impact assessments, and prior consultation with supervisory authorities, taking into account the nature of Processing and the information available to Cahaba Forge.
6.6 Not engage any Sub-processor without compliance with Section 8.
6.7 Make available to Licensee all information reasonably necessary to demonstrate compliance with the obligations under Article 28 of the GDPR and allow for and contribute to audits in accordance with Section 10.
6.8 Notify Licensee without undue delay if, in Cahaba Forge’s opinion, an instruction from Licensee infringes the GDPR or other applicable data protection law.
Cahaba Forge implements and maintains the following technical and organizational measures to ensure a level of security appropriate to the risk of Processing:
For additional detail, see the Trust & Security page.
8.1 Licensee authorizes Cahaba Forge to engage the following Sub-processor in connection with the App:
8.2 Cahaba Forge shall ensure that any Sub-processor it engages is bound by data protection obligations substantially equivalent to those set out in this DPA, particularly regarding appropriate technical and organizational measures.
8.3 Cahaba Forge shall provide Licensee with notice of material Sub-processor changes in accordance with applicable data-protection law. Where a change relates to Atlassian or providers used by the Forge or Jira Cloud platform, Cahaba Forge’s notice is based on the notice and information made available to Cahaba Forge by Atlassian; Cahaba Forge does not directly select or control every provider used by Atlassian. Licensee may object within a reasonable period following notice on legitimate data-protection grounds. If the parties cannot resolve the objection in good faith, Licensee may terminate the affected App license and this DPA.
9.1 Licensee, as Controller, is responsible for responding to Data Subject requests for access, rectification, erasure, restriction, portability, and objection.
9.2 Cahaba Forge shall assist Licensee in fulfilling such requests, taking into account the nature of the Processing, including through the following App capabilities:
9.3 If Cahaba Forge receives a Data Subject request directly, it shall promptly forward the request to Licensee and shall not respond to the Data Subject directly except to confirm receipt and redirect the Data Subject to Licensee, unless legally required to do so.
9.4 Licensee acknowledges that certain audit records are retained in pseudonymized form rather than deleted for audit continuity. Issue deletion, account closure, and uninstall are not unconditional guarantees of complete erasure across all data categories or copies. Licensee should consider applicable retention duties and consult its Data Protection Officer when responding to erasure requests. These product limitations do not remove applicable privacy rights.
9.5 Where a Data Subject request cannot be fully addressed using available App capabilities, Cahaba Forge shall, upon Licensee’s request, provide reasonable assistance to Licensee where technically feasible and within Cahaba Forge’s control. Such assistance is subject to the platform, customer-managed data, and retention limitations described in Section 11 and does not guarantee complete erasure.
10.1 Cahaba Forge shall make available to Licensee, upon reasonable written request, information necessary to demonstrate compliance with this DPA and Article 28 of the GDPR.
10.2 Because the App runs entirely on Atlassian’s Forge platform and Cahaba Forge does not operate infrastructure that holds Personal Data, audit activities shall be satisfied as follows:
a) Cahaba Forge shall respond to reasonable written security questionnaires (including CAIQ or equivalent) within a reasonable time.
b) Cahaba Forge shall, upon reasonable request, provide information regarding its security testing, dependency review, and secure development practices. Additional security materials or summaries may be made available where appropriate, subject to confidentiality, security, and intellectual-property considerations.
c) For aspects of the Processing that occur within Atlassian-managed infrastructure, Cahaba Forge shall cooperate with Licensee’s review of Atlassian’s published security and compliance materials.
10.3 Given the Forge-native architecture, routine on-site audits of Cahaba Forge or Atlassian infrastructure are not supported. Security questionnaires, third-party attestations, relevant security documentation, and Atlassian’s published security and compliance materials are the primary means of satisfying audit requests. Cahaba Forge shall engage in good faith to address reasonable follow-up questions and provide reasonable additional cooperation where required by applicable data-protection law. This provision does not grant unrestricted infrastructure access, source-code review rights, penetration-testing rights, or an unconditional entitlement to sensitive security artifacts.
11.1 Termination of the Agreement does not itself erase App data. Following uninstall, Forge-hosted App data is subject to Atlassian’s retention process. As described in the Privacy Policy, hosted App data is retained for 28 days after uninstall and is not automatically restored on reinstallation. Any platform-assisted recovery depends on Atlassian’s process, customer consent, and applicable time limits; successful recovery is not guaranteed.
11.2 Jira custom field values and issue properties written by the App are native Jira data and persist after uninstall until removed by Licensee through Jira’s standard data management tools. Licensee acknowledges this behavior and is responsible for removing such data from its Jira instance if required.
11.3 Configured App processing does not send approval data to an external Cahaba Forge backend or external third-party processing service. Platform-hosted logs and measurements are subject to Atlassian’s retention policies. Information Licensee sends directly to Cahaba Forge for product support is handled separately as described in the Privacy Policy. Supported export capabilities and their limitations are described in Section 9.2; downloaded copies are subject to Licensee’s own retention controls.
11.4 Upon Licensee’s request, Cahaba Forge shall provide reasonable assistance in understanding and using available deletion or return mechanisms. Where a request cannot be completed through normal App controls, Cahaba Forge shall assist with deletion or return of Personal Data where technically feasible and within Cahaba Forge’s control. This assistance does not imply access or capabilities Cahaba Forge does not possess, or guarantee instantaneous deletion, deletion of customer-managed native Jira data or customer-downloaded copies, or deletion of data controlled or retained by Atlassian, including platform backups, logs, and other platform-controlled systems. Applicable retention requirements and the limitations described above continue to apply.
12.1 Cahaba Forge shall notify Licensee without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Licensee’s Personal Data Processed by the App. Where the breach originates in Atlassian-managed infrastructure, Cahaba Forge’s notification obligation begins when Cahaba Forge becomes aware of the breach through Atlassian or another reliable source.
12.2 The notification shall include, to the extent known at the time:
12.3 Cahaba Forge shall cooperate with Licensee and provide reasonable assistance in meeting Licensee’s breach notification obligations under applicable law.
12.4 Licensee acknowledges that breaches originating in Atlassian-managed infrastructure are subject to Atlassian’s own incident response and notification processes. Cahaba Forge shall assist in coordination where applicable.
13.1 Personal Data Processed by the App resides within Atlassian’s infrastructure and is subject to Atlassian’s applicable data residency and international transfer policies. Forge-hosted storage follows Atlassian’s data residency model for the host product; not every platform service, operational log, or usage measurement is guaranteed to be processed in the same region as Licensee’s Jira Cloud site.
13.2 To the extent Personal Data is transferred internationally in connection with Atlassian’s provision of Forge or Jira Cloud services, such transfers are subject to the international transfer mechanisms applicable under Atlassian’s Forge Data Processing Addendum and related contractual terms, as applicable. These mechanisms may include applicable adequacy frameworks, Standard Contractual Clauses, or other lawful transfer mechanisms recognized under applicable data protection law.
13.3 Configured App processing does not send approval data to an external Cahaba Forge backend or external third-party processing service. Information Licensee sends directly for product support is handled separately under the Privacy Policy.
14.1 Where the CCPA applies, Cahaba Forge acts as a “service provider” to Licensee (where Licensee is a “business”) as those terms are defined in the CCPA.
14.2 Cahaba Forge shall not:
a) sell or share Personal Data as defined under the CCPA;
b) retain, use, or disclose Personal Data for any purpose other than the specific purpose of performing the services described in the Agreement and this DPA;
c) retain, use, or disclose Personal Data outside the direct business relationship between the parties;
d) combine Personal Data received from Licensee with Personal Data received from or on behalf of any other source, except as permitted by the CCPA.
14.3 Cahaba Forge certifies that it understands the restrictions in this Section 14 and will comply with them.
The liability of each party under this DPA shall be subject to the limitations and exclusions of liability set out in the Agreement.
This DPA shall remain in effect for the term of the Agreement and shall automatically terminate upon termination of the Agreement, except that provisions which by their nature are intended to survive (including confidentiality, liability, and obligations regarding deletion of Personal Data) shall survive such termination.
This DPA shall be governed by the governing law specified in the Agreement, provided that the mandatory data protection laws of the jurisdiction in which the Data Subjects are located shall apply to the extent required by law.
Cahaba Forge may update this DPA from time to time to reflect changes in applicable law, the App’s functionality, or Sub-processor arrangements. Material changes will be communicated at least thirty (30) days before they take effect using reasonable customer contact information or notification channels available to Cahaba Forge, including customer contact information provided through the Atlassian Marketplace where available. Website publication and other available channels may supplement direct notice. Cahaba Forge is not required to independently identify or locate a particular internal customer role to provide notice.
Routine corrections, clarifications, formatting changes, non-substantive updates, and other changes that do not materially affect customer data-protection rights or Cahaba Forge’s material obligations are not subject to this thirty (30)-day material-change notice requirement.
Continued use of the App after the effective date of an updated DPA constitutes acceptance of the revised terms. If Licensee objects to any material change, Licensee may terminate the Agreement in accordance with the EULA’s termination provisions (Section 11.2).
For questions regarding this DPA or to request a signed copy:
This Data Processing Addendum applies to Business Sign-off & Approval for Jira Cloud. It should be read together with the Cahaba Forge Privacy Policy and Trust & Security documentation.