Last updated: 11 November 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of use between the customer installing Team Estimation – Sizing Board & Planning Poker for Jira (“Customer”, controller) and Bc. Tomáš Buchta, sole trader, IČO 21540951, 30. dubna 2307/12, 702 00 Ostrava, Czech Republic (“Vendor”, processor), and applies to personal data processed by the App under Article 28 of the GDPR.

  1. Subject matter and duration. Running estimation sessions on the Customer’s Jira work items and saving the agreed estimates, for as long as the App is installed.
  2. Nature and purpose. Storing, per estimation session, the ids of its work items, the lanes and votes chosen by participants and the account ids of the participants; showing work items to each participant with that participant’s Jira permissions; writing estimates to Jira as the user who saves them.
  3. Types of personal data. Atlassian account ids of participants (creator, moderators, members, voters, the person who moved a card). Names are read from Jira for display and are not stored. Content of work items is not stored.
  4. Data subjects. Users of the Customer’s Jira site who take part in estimation sessions.
  5. Instructions. The Vendor processes personal data only to operate the App as used by the Customer and on documented instructions sent to support@tsutsei-support.atlassian.net.
  6. Where data is processed. Exclusively within Atlassian’s Forge platform (Key-Value Store) for the Customer’s site, inheriting Atlassian’s data residency. The App sends no data outside Atlassian. The Vendor has no access to the stored data.
  7. Sub-processor. Atlassian (provider of the Forge platform), under Atlassian’s own terms and data processing addendum. The Vendor will announce any new sub-processor on this page in advance.
  8. Security. Data is protected by the security measures of the Atlassian Forge platform (encryption at rest and in transit, tenant isolation). Content is copied with the user’s own permissions and never stored by the App.
  9. Confidentiality. Only the Vendor works on the App and is bound by confidentiality.
  10. Assistance. The Vendor assists the Customer with data subject requests and data protection obligations as far as the App’s design allows (moderators can delete sessions; account ids of closed accounts are erased automatically).
  11. Personal data breaches. The Vendor notifies the Customer without undue delay after becoming aware of a breach affecting the App.
  12. Deletion. Sessions that nobody changed for 180 days are deleted automatically; moderators can delete a session at any time. On uninstallation, Atlassian deletes the App’s data according to the Forge data retention policy.
  13. Audits. The Vendor makes available the information necessary to demonstrate compliance with this DPA on request.
  14. Governing law. As in the Terms of use.