FrisForge LLC Data Processing Addendum v1.0
Provider: FrisForge LLC Version: 1.0 Effective Date: The effective date of the applicable Main Agreement.
1. Incorporation
This FrisForge LLC Data Processing Addendum consists of the Bonterms Data Processing Addendum Version 2.0 (Attachment Version), these DPA Details, and the applicable Product Processing Schedule.
The Bonterms Data Processing Addendum Version 2.0, including its Exhibit A (Cross-Border Transfer Mechanisms) and Exhibit B (Region-Specific Terms), is incorporated into the Main Agreement between Customer and FrisForge LLC.
The applicable Product Processing Schedule identifies the Product and provides the Product-specific processing details, Subprocessor information, technical and organizational measures, retention information, and related clarifications required for that Product.
Capitalized terms not defined in these DPA Details or the applicable Product Processing Schedule have the meanings given in the Bonterms Data Processing Addendum Version 2.0.
2. Key Terms
Main Agreement: The Bonterms Standard End User Agreement Version 1.0 applicable to the Product through Atlassian Marketplace, together with the applicable Provider-Specific Terms and Marketplace Order. DPA Effective Date: The Effective Date of the Main Agreement. Provider: FrisForge LLC. Provider data-protection contact: [email protected]. Provider main address: 14900 Inspire Way, Apt 1306, Jacksonville, FL 32258, United States. Customer: The customer identified in the applicable Atlassian Marketplace Order. Customer contact and address: As identified in the applicable Marketplace Order, Customer account, or other notice information supplied by Customer. Product: The FrisForge LLC product identified in the applicable Product Processing Schedule. Subprocessor List: As identified in the applicable Product Processing Schedule. Subprocessor Notice Method: Email to the applicable Customer administrator or contact associated with the Customer's Marketplace relationship. Designated EU Governing Law: Ireland. Designated EU Member State: Ireland.
3. Processing Details
The processing details for the applicable Product are set out in its Product Processing Schedule.
The Product Processing Schedule identifies, as applicable:
- the activities and roles of Customer and FrisForge LLC;
- categories of Data Subjects;
- categories of Customer Personal Data;
- Sensitive Data or special-category treatment;
- frequency, nature, purpose, and duration of Processing;
- retention behavior;
- applicable Subprocessors;
- Product-specific technical and organizational measures; and
- Product-specific data-return or deletion clarifications.
4. Cross-Border Transfers
Where a Restricted Transfer exists between Customer and FrisForge LLC, the cross-border mechanisms in Exhibit A of the Bonterms Data Processing Addendum Version 2.0 apply.
Where Customer is a Controller and FrisForge LLC is a Processor, the applicable EU SCC Controller-to-Processor module applies.
Where Customer is a Processor acting for another Controller and FrisForge LLC is a Processor, the applicable EU SCC Processor-to-Processor module applies.
Transfers from FrisForge LLC through an applicable Subprocessor are additionally governed by the data-processing and cross-border transfer provisions applicable to that Subprocessor, as identified in the applicable Product Processing Schedule.
FrisForge LLC does not represent that it participates in or is certified under the EU-U.S. Data Privacy Framework merely because a Subprocessor may maintain such certification.
5. Technical and Organizational Measures
The technical and organizational measures applicable to a Product are set out in the applicable Product Processing Schedule.
Where a Product is hosted on Atlassian Forge, the underlying Forge hosting environment is additionally subject to Atlassian's technical and organizational measures under the applicable Forge Data Processing Addendum.
6. California Processing
To the extent the California Consumer Privacy Act applies to Customer Personal Data processed under the Main Agreement, FrisForge LLC acts as a service provider to the extent required by applicable law and the California provisions of the incorporated Bonterms Data Processing Addendum Version 2.0.
FrisForge LLC does not sell or share Customer Personal Data received under the Main Agreement and processes such data only for the limited business purpose of providing the applicable Product and otherwise performing the Main Agreement as permitted by applicable law.
7. Clarification Regarding Data Return and Deletion
Any deletion or return obligation under the incorporated DPA applies to Customer Personal Data in FrisForge LLC's possession, custody, or control.
Product-specific retention, deletion, and Customer-system clarifications are set out in the applicable Product Processing Schedule.
Customer Personal Data that remains stored in the Customer's Atlassian environment remains under the Customer's Atlassian environment except to the extent the applicable Product Processing Schedule expressly describes a Product-held copy.
8. Additional Terms
Except for these DPA Details and the applicable Product Processing Schedule, no additional modification to the Bonterms Data Processing Addendum Version 2.0 is intended.
Product Processing Schedule — Sprint Scope Guard v1.0
Provider: FrisForge LLC. Product: Sprint Scope Guard. Platform: Jira Cloud. Schedule Version: 1.0. Effective Date: The DPA Effective Date.
This Product Processing Schedule supplies the SSG-specific processing details for the existing FrisForge LLC Data Processing Addendum.
1. Product and purpose
SSG is a read-only Jira Cloud administration utility. It diagnoses a selected user's Manage Sprints coverage across a proven, supported company-managed Scrum board scope and monitors a healthy board/user baseline. It does not modify Jira configuration or issue data, grant permissions, operate sprints, or send alerts.
2. Customer and Provider roles
Customer / Data Exporter: The Customer identified in the applicable Marketplace order; use of Jira Cloud and SSG for internal Jira administration; Controller of Customer Personal Data, or Processor when acting on behalf of another Controller.
Provider / Data Importer: FrisForge LLC; provision of SSG; Processor to the extent it processes Customer Personal Data on Customer's behalf.
3. Data Subjects and Customer Personal Data
Data Subjects include Jira administrators using the app and the Jira users selected for permission diagnosis and Guard monitoring. Customer-authored board, project, and filter configuration may contain personal information depending on Customer input.
During an evaluation, SSG processes board/filter/project evidence, selected account identifiers and current identity-display information, and permission responses. In Forge-hosted storage it retains selected account identifiers linked to board IDs, project-ID baselines and versions, baseline/evaluation times, recent outcomes and reasons, deficient project IDs, Guard states, scheduler deduplication information, earliest retained-data retrieval timestamps, and privacy-reporting cycle/pending-erasure metadata. Short-lived tokens coordinate concurrent operations.
The app does not persist issue content, display names, email addresses, avatars, project names, filter JQL, permission schemes, group/role membership, or credentials in its Guard records. Personal information supplied in support communications is processed separately to provide and administer support, investigate defects/security concerns, maintain appropriate records, and meet legal obligations.
4. Sensitive or special categories
SSG does not require Sensitive Data or special-category personal data for its functionality. Customers should not include unnecessary sensitive information in app-related configuration or support communications. The incorporated Main Agreement's Sensitive Data treatment applies.
5. Frequency, nature, and purpose of Processing
Processing occurs when an authorized Jira administrator invokes an app action, during scheduled Guard evaluation, and as needed for privacy-reporting and erasure handling. Processing includes retrieval, consultation, permission evaluation, transient use, Forge-hosted storage of minimum Guard state, baseline comparison, result display, reporting retained identifiers to Atlassian, and handling applicable update/erasure instructions.
The purpose is to provide the supported diagnosis and monitoring function, preserve the last valid healthy baseline through regression or incomplete evidence, and operate the required stored-user privacy lifecycle. SSG does not use a customer-facing AI model to determine its diagnosis.
6. Duration, retention, and deletion
Transient evaluation data is used for the relevant app/runtime session. Guard records remain while enabled, until administrator removal or privacy-lifecycle erasure. SSG has no fixed Guard-record application TTL.
The app follows Atlassian's returned reporting cycle. A closed or updated account instruction removes that account's Guards and associated reporting metadata. Guards are not silently recreated; an administrator must explicitly establish a fresh healthy baseline. Legacy records without trustworthy retrieval timestamps are removed during migration. Reporting metadata is removed when no records remain for an account.
The pre-uninstall handler attempts application-record cleanup. Underlying Forge backup, recovery, deletion, and residual post-uninstallation behavior remain governed by the applicable Atlassian-hosted platform lifecycle. No exact physical purge deadline is represented. Customer source records remain in Jira; removing a Guard does not delete Jira boards, projects, users, or configuration.
Support communications may be retained for as long as reasonably needed for the purposes described above and applicable legal obligations. Any return or deletion obligation under the DPA applies to Customer Personal Data in FrisForge's possession, custody, or control, subject to the applicable hosting lifecycle.
7. Subprocessor and processing locations
Subprocessor: Atlassian Pty Ltd (Forge). Function: Jira platform services, Forge execution, Forge-hosted application storage, and related platform services required for SSG. Processing locations: As identified in Atlassian's then-current Forge data-transfer and subprocessor documentation.
SSG's core runtime has no separate external application backend, external customer database, Forge Remote, or third-party application analytics destination. Support communications are separate from this core runtime inventory; no unverified support-mail processor is designated by this Schedule.
8. Technical and Organizational Measures
- Execution and Guard storage on Atlassian Forge.
- Jira authentication and server-side administrator checks for interactive app actions.
- Read-only Jira behavior and permissions limited to supported evidence retrieval.
- Selected-user permission evaluation in that user's context.
- Complete, consistent evidence requirements and fail-closed INDETERMINATE handling.
- Healthy-baseline initialization only from fresh SUFFICIENT evidence.
- Installation-scoped native storage and concurrent-update coordination.
- Account-age/cycle tracking and personal-data reporting/update/erasure handling.
- No required customer passwords, API tokens, shared secrets, external backend, Remote, or external app-data destination.
- Aggregate scheduled application logs rather than raw identifiers/customer payloads.
These are SSG application measures. Atlassian's underlying hosting controls and platform logs remain subject to its applicable Forge agreements and documentation. No independent FrisForge certification or penetration test is claimed.
9. Product-specific additional terms
Except for the SSG-specific processing details and clarifications in this Schedule, no additional modification to the existing FrisForge LLC DPA or the incorporated Bonterms DPA Version 2.0 is intended.