LogQuillData processing terms
What LogQuill processes on your organization's behalf, how, and by whom, for your data protection records.
Draft
The contract itself (the obligations of each party, liability, audits, governing law) is still to be added, based on a lawyer-reviewed template or the European Commission's Standard Contractual Clauses. What follows are its annexes: the facts of the processing, which are ours to describe. [to fill: how a customer signs or accepts the terms, for example by email to us or as part of the Marketplace terms.]
Annex I: Description of the processing
Parties. Your organization, which installs the app on its Jira site, is the controller. [to fill: legal name], [to fill: address], is the processor.
People whose data is processed. The people with an account on your Jira site who appear in the app: employees, contractors and anyone else your organization gives Jira access to.
Personal data processed.
- Identity: Atlassian account ID, display name, profile picture address, email address when Jira shares it, time zone, language, account status.
- Time records: worklogs and plans, with their descriptions, durations, days, issues, work types, accounts, billable hours and other worklog fields; timesheets, their notes and review history.
- Use of the app: role, personal settings, saved reports and shares, an audit log of changes.
- Jira activity used for suggested worklogs: which issues a person created, commented on or changed each day, and when.
- Optional, only when connected: calendar events (read, not stored), the encrypted access to the calendar, and the ids of the Out of office events LogQuill added for a person who asked for it; a Tempo API token, encrypted.
- Support requests: the message, reply address, screenshots and technical details the person sends.
Special categories of data. None are needed. Descriptions and notes are free text written by your users; please make sure they don't put special category data there.
Nature and purpose. Recording, planning, reviewing and reporting time spent on Jira work; suggesting worklogs; sending the emails the app sends; answering support requests.
Duration. For as long as the app is installed with an active subscription, then 60 days, after which all of the site's data is deleted. Some data is deleted sooner; see the privacy policy.
Where. The database is in the European Union (Frankfurt, Germany). Requests are handled on Cloudflare's global network, nearest to the person using the app. [to fill: the safeguard for data leaving the European Union, for example the Standard Contractual Clauses or the EU-US Data Privacy Framework, for each subprocessor outside it.]
Annex II: Technical and organizational measures
Described in full on Security. In short:
- Every request signed by Atlassian and verified; data limited to the site it belongs to.
- Jira read with the person's own permissions; roles decide what each person sees in the app; worklogs only changed by their owner.
- TLS for every connection; the database encrypted at rest; stored secrets also encrypted by the app (AES-256-GCM).
- An audit log of changes, kept 6 to 7 months.
- Point-in-time backups, with restores rehearsed.
- Deletion of the whole site's data 60 days after uninstalling.
- Error reports without IP addresses or request credentials.
- Automated checks, including permission tests, on every code change.
- Incident notification to your administrators without undue delay.
Annex III: Subprocessors
The current list, with what each receives and where, is on Subprocessors.