Data Processing Addendum — Backlog Ranking for Jira Automation

Last updated: 29 October 2026

This Data Processing Addendum ("DPA") is part of the terms under which a customer ("you") uses Backlog Ranking for Jira Automation ("the app") obtained from the Atlassian Marketplace. It applies when the app processes personal data on your behalf and the EU or UK General Data Protection Regulation or a similar law applies. The processor is the acty.dev developer identity of Pavel Krieger, 89 Rothschild St., Petah Tikva 4933301, Israel, [email protected] ("we").

1. Roles. You are the controller, or a processor acting for your controller. We are your processor, or sub-processor.
2. Subject matter, nature, purpose and duration. We process personal data only to move work items to the top or the bottom of a board backlog when one of your Jira Automation rules runs an action of the app, for as long as the app is installed on your site.
3. Personal data and data subjects. The identity of the user who connected the action: Jira Automation runs the action as that user, and Atlassian Forge may pass the app that user's Atlassian account ID. It is processed together with work item keys and board IDs. Data subjects are users of your Jira site who connect the action. The app processes no special categories of personal data.
4. Instructions. We process personal data only on your documented instructions, which are the actions and settings you configure in your rules, unless the law requires otherwise; in that case we tell you first unless the law forbids it.
5. Confidentiality. On our side, only the developer has access to the app's logs and is bound to keep them confidential.
6. Security. The app runs only on Atlassian's Forge platform, requests only the Jira permissions it needs, works with the permissions of the user who connected the action, stores no personal data, writes no personal data into its own log lines and sends no data outside Atlassian.
7. Sub-processors. You authorize Atlassian to host the app on Forge under Atlassian's Forge Data Processing Addendum. We announce any new sub-processor on this page at least 30 days before it starts; you may object by email to [email protected] and stop using the app.
8. Assistance. We help you respond to data subject requests and meet your obligations on security, breach notification, impact assessments and prior consultation, taking into account that the app stores no personal data.
9. Personal data breaches. We notify you without undue delay, and no later than 72 hours after we become aware of a breach that affects your personal data, through the technical contact that Atlassian provides for your subscription.
10. Deletion. The app stores no personal data. Processing stops when you uninstall the app; Forge log lines expire after 30 days.
11. Information and audits. On request we make available the information needed to demonstrate compliance with this DPA and allow for and contribute to audits by you or an auditor you mandate, with reasonable notice.
12. Location. The app runs on Atlassian's platform; Forge aims to run it in the same location as your Jira site. We are located in Israel.
13. CCPA. Where the California Consumer Privacy Act applies, we act as your service provider: we do not sell or share personal information and use it only to provide the app.
14. Precedence. If this DPA conflicts with other terms for the app on the processing of personal data, this DPA prevails.