Data Processing Addendum

1. Parties and scope

This Data Processing Addendum (“DPA”) applies to Churrie Works Inc. (“Churrie Works”, “we”, “us”, or “our”) and the organization or person using one or more of our Atlassian Marketplace apps (“Customer”, “you”, or “your”).

It applies when Churrie Works processes End-User Data on behalf of Customer in connection with the Apps listed in Schedule A, including without limitation WorkPulse, WorkPulse Basic, Cadence, Timeaway, FormHub, Converse Hub, Greenlight, Classifier for Confluence, Classifier Bridge for Jira, and One-Way Sync for Confluence, and any successor or related Marketplace listings we publish under Churrie Works Inc.

This DPA supplements, and does not replace, the Atlassian Marketplace Terms of Use, Atlassian Developer Terms, and any applicable End User License Agreement for an App.

2. Definitions

Apps means the Atlassian Marketplace applications published by Churrie Works Inc. and covered by Schedule A, including Cloud and Data Center editions where listed.

End-User Data means data, content, or information about an end user that is accessed, collected, stored, or otherwise processed by an App in connection with Customer’s Atlassian site.

Personal Data has the meaning given under applicable data protection laws, including the GDPR, UK GDPR, and similar privacy laws.

Customer Content means content, configuration, work items, pages, form responses, leave records, time records, conversations, classification metadata, sync payloads, and related material provided by Customer or Customer’s end users through Atlassian products or the Apps.

3. Roles of the parties

For purposes of applicable data protection laws, Customer is generally the controller or business for End-User Data submitted to or configured in the Apps, and Churrie Works is generally the processor or service provider for that End-User Data when we process it on Customer’s behalf.

Churrie Works may act as a controller for its own account, billing, security, support, Marketplace compliance, and business records.

Data Center note: For Data Center Apps that run on Customer’s infrastructure, End-User Data typically remains on Customer’s servers. In that case, Churrie Works processes End-User Data as a processor only to the limited extent needed for support, licensing, security investigation, or other services Customer expressly requests — not as a routine host of Customer Content.

4. Customer instructions

Customer instructs Churrie Works to process End-User Data as necessary to provide the Apps, as configured by Customer, and as described in this DPA, the applicable Marketplace listing, product documentation, privacy policy, and any applicable order or written agreement.

If Churrie Works believes an instruction violates applicable data protection law, Churrie Works may notify Customer and suspend the affected processing until the issue is resolved.

5. Confidentiality and access

Churrie Works limits access to End-User Data to personnel and subprocessors who need access to provide, secure, support, or maintain the Apps. Personnel with access to End-User Data are subject to confidentiality obligations.

6. Security measures

Churrie Works uses reasonable technical and organizational safeguards appropriate to the nature of each App and the data processed. These safeguards commonly include:

• Use of Atlassian Forge hosting, storage, authentication, and permission models for Cloud Apps.
• Least-privilege Atlassian app scopes where reasonably practicable for app functionality.
• Server-side enforcement of Customer-configured access controls where the App provides them.
• Storage of app secrets using Forge secret storage where available.
• Input validation, output escaping, and size limits appropriate to the feature.
• Operational logging designed to avoid intentionally logging unnecessary personal data or Customer Content.
• Personal data reporting to Atlassian for stored Atlassian account identifiers as required by Marketplace privacy requirements.
• For Data Center Apps, reliance on Customer’s hosting, network, and access controls for data at rest on Customer infrastructure.

7. Subprocessors

Customer authorizes Churrie Works to use subprocessors to provide the Apps. Churrie Works remains responsible for subprocessors it engages to process End-User Data on behalf of Customer. Current subprocessors are listed in Schedule C.

Churrie Works may update Schedule C from time to time. Material changes will be reflected on this page or in related customer notices.

8. International transfers

End-User Data may be transferred to, processed in, or accessed from countries outside the European Economic Area, the United Kingdom, or Switzerland, including the United States, depending on Customer’s Atlassian configuration, Atlassian infrastructure, Churrie Works operations, and any optional integrations Customer enables.

Where required by applicable law, Churrie Works will rely on appropriate transfer mechanisms, which may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, subprocessors’ transfer mechanisms, or other lawful transfer bases.

9. Deletion, return, and retention

Customer controls many deletion actions through Atlassian products, including uninstalling Apps and deleting Jira issues, Confluence pages, attachments, and related content. Cloud Apps may retain app data in Forge storage as needed to provide history, configuration, access controls, lifecycle features, and support.

Upon uninstall, expiration, or written request, Churrie Works will delete or return End-User Data within a reasonable period unless retention is required by law, security, billing, dispute resolution, backup, or legitimate business purposes. Data written into Customer’s Jira or Confluence remains subject to Customer’s Atlassian product configuration and deletion controls.

10. Assistance with privacy requests

Churrie Works will provide reasonable assistance, taking into account the nature of processing and information available to Churrie Works, for Customer to respond to data subject requests, security inquiries, and privacy obligations. Customers should send requests to customerService@churrieworks.com.

11. Security incidents

If Churrie Works becomes aware of a confirmed security incident involving End-User Data processed by an App, Churrie Works will notify affected customers without undue delay and provide information reasonably available to help customers meet their obligations. Security issues may be reported to customerService@churrieworks.com.

12. Audits and information

Churrie Works will make reasonable information available to demonstrate compliance with this DPA. To protect other customers and the app environment, audits must be reasonable in scope, scheduled in advance, and subject to confidentiality and security requirements.

13. CCPA and similar privacy laws

To the extent the California Consumer Privacy Act or similar laws apply, Churrie Works acts as a service provider or processor for Customer Content. Churrie Works does not sell End-User Data submitted through the Apps and does not use it for cross-context behavioral advertising.

Schedule A — Products covered

This DPA covers Churrie Works Inc. Atlassian Marketplace apps, including without limitation:

Successor names, editions (e.g. Standard / Advanced), and related TimeSuite apps may be added by updating this schedule without rewriting the body of the DPA.

Schedule B — Categories of End-User Data

Depending on the App and Customer configuration, processing may include the categories below. Customer decides what content to put into Atlassian products and should not use the Apps to collect sensitive personal data unless Customer has a lawful basis and appropriate safeguards.

Schedule C — Subprocessors and infrastructure

Optional third-party integrations configured by Customer are Customer’s responsibility to assess under Customer’s own vendor and transfer policies. Churrie Works does not control Customer-managed webhook destinations after egress.