Data Processing Agreement

1. Roles of the parties

For personal data processed through our products, you act as the data controller (or as a processor on behalf of your own customers), and HelpingBrains acts as your data processor. You are responsible for establishing a lawful basis for the processing and for the accuracy and lawfulness of your instructions. HelpingBrains processes personal data only on your documented instructions, including as set out in the Terms, this DPA, and the product documentation.

2. Subject matter, nature and duration

The subject matter is the processing of personal data necessary to provide, secure, support, and improve the products you use. The nature and purpose of processing is the operation of those products. Processing continues for the duration of your subscription or use of the products, plus any period required to return or delete data as described below.

3. Categories of data and data subjects

The personal data processed depends on the product and the data you choose to provide. It may include:

• Data subjects: your users, employees, team members, and — for some products — your own customers.
• Data categories: account and contact identifiers (names, email addresses, account IDs), authentication data, usage and configuration data, availability/PTO information (Sprint Reality), product-catalog attributes (CatalogOps), and any personal data contained in content you process through the products.

4. Processor obligations (Art. 28)

HelpingBrains, as processor, undertakes to:

• Process personal data only on your documented instructions, including for international transfers, unless required by law (in which case we will inform you where legally permitted).
• Ensure that persons authorized to process personal data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (see below), as required by Art. 32.
• Respect the conditions for engaging sub-processors set out below.
• Assist you, taking into account the nature of processing, in responding to data subject rights requests.
• Assist you in ensuring compliance with security, breach-notification, and data protection impact assessment obligations (Art. 32–36).
• Delete or return personal data at the end of the services, as described below.
• Make available information necessary to demonstrate compliance and allow for and contribute to audits, subject to reasonable conditions.

5. Security measures

We apply appropriate technical and organizational measures designed to protect personal data, including:

• Encryption of data in transit.
• Access controls and least-privilege permissions, with access limited to authorized personnel.
• Secure storage of secrets and credentials.
• Logging and monitoring of significant actions.
• Regular review of our security controls and vendors.
• Platform-level protections inherited from the infrastructure we build on (for example, Atlassian Forge for our Jira apps).

6. Sub-processors

You provide general authorization for HelpingBrains to engage sub-processors to process personal data in connection with the products. We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance.

Depending on the product and the integrations you enable, our sub-processors may include: cloud hosting and infrastructure providers; Atlassian (Forge platform and app hosting for our Jira apps); email delivery (Resend); messaging integrations (Slack, Microsoft Teams) when enabled; AI processing (Anthropic) when you enable optional AI features; and payment or marketplace billing providers. We will inform you of intended changes to sub-processors and give you the opportunity to object on reasonable data protection grounds.

7. International data transfers

We prioritize processing and hosting within the European Economic Area. Where personal data is transferred outside the EEA, we rely on an appropriate transfer mechanism under Chapter V of the GDPR, such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

8. Personal data breach

HelpingBrains will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and will provide information reasonably available to help you meet your own notification obligations.

9. Data subject rights

Taking into account the nature of the processing, HelpingBrains will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects exercising their rights under the GDPR. If we receive such a request directly, we will, where legally permitted, direct the data subject to you.

10. Return and deletion of data

On termination or expiry of the services, HelpingBrains will, at your choice, delete or return the personal data processed on your behalf and delete existing copies, unless retention is required by law. For our apps, associated data in platform storage (for example, Atlassian Forge Storage) is removed in accordance with the platform’s uninstall lifecycle.

11. Audits

HelpingBrains will make available to you the information reasonably necessary to demonstrate compliance with Art. 28, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. Audits are subject to reasonable advance notice, confidentiality, and frequency limits, and must not compromise the security or data of other customers.

12. Liability, term and governing law

This DPA is subject to the liability provisions of the Terms of Use. It takes effect when you accept the Terms or begin using the products and remains in force for as long as HelpingBrains processes personal data on your behalf. It is governed by the laws of the Federal Republic of Germany, consistent with the Terms.

13. Contact and signed copies

To request a countersigned copy of this DPA, add specific sub-processor details, or discuss your data protection requirements, contact privacy@helpingbrains.info. This DPA supplements our Privacy Policy and Terms of Use.