Data Processing Agreement (DPA)

Overview

This Data Processing Agreement ("DPA") sets out the terms on which Orbiscend OÜ processes personal data on your behalf when you use our Atlassian Forge apps. For our Forge-native apps, including Aevon Timesheets, all data remains within Atlassian's infrastructure (Forge storage and native Jira); Orbiscend keeps no separate copy, and the apps send no end-user data to external hosts.

Under the GDPR you (the customer) act as the data controller and Orbiscend acts as your data processor; under the CCPA/CPRA, Orbiscend acts as a service provider.

What the DPA covers

• Nature, purpose and duration of processing, and the categories of personal data and data subjects
• Your rights and our obligations as a data processor (GDPR Article 28)
• Technical and organisational security measures
• Personal data breach notification within 72 hours
• Sub-processors and our change-notification process
• International data transfer mechanisms
• Return and deletion of data via the Atlassian Forge data lifecycle

How it applies

This DPA is incorporated into the agreement under which you license the app — the Atlassian Marketplace standard end-user agreement together with our Provider-Specific Terms — and applies automatically when you install or use the app. No separate signature is required for it to be binding.

If your organisation requires a counter-signed copy, we're happy to provide one. Contact legal@orbiscend.com.