CFR Dashboard — Data Processing Addendum

Effective: 30 September 2026 · Version 1.0

1. Parties and scope

This Data Processing Addendum ("DPA") is between Gergely Orbán, sole proprietor, Hungary ("Processor", "Provider") and the organization that installs the CFR Dashboard app ("Controller", "Customer"). It is the "Data Protection Addendum" referred to in the End User Terms and forms part of them.

It applies to personal data that the Provider processes on the Controller's behalf and instructions when operating the App, within the meaning of Article 4(8) and Article 28 of the GDPR and, where relevant, other applicable data protection law.

2. Subject matter, duration, nature and purpose

Item	Description
Subject matter	Processing needed to run the App for the Controller's Jira projects
Duration	From installation of the App until it is uninstalled or the agreement ends
Nature	Automated processing: retrieving Git commit data and selected Jira field values, calculating metrics, and optionally exporting events to a destination chosen by the Controller
Purpose	Calculating and displaying Change Failure Rate and Mean Time to Restore, and optionally exporting the underlying event data

3. Categories of data subjects and personal data

• Data subjects: users of the Controller's Jira site whose names or identifiers appear in Jira field values the Controller's administrator selects as context fields; people who commit to the connected Git repository, to the extent their names appear in commit message text.
• Personal data: the text content of Jira fields selected by the Controller's administrator (depends on the Controller's choice); free text of Git commit messages, which may incidentally contain personal names.
• Not included: structured commit author name or e-mail fields (not retrieved or stored), financial data, health data or other special categories. The Controller must not select fields containing such data.

4. Processor obligations

The Processor will:

1. process personal data only on the Controller's documented instructions, including administrator choices made in the App's settings (Git provider and token, context fields, destination and sync settings), and not use it for other purposes;
2. ensure that persons authorized to process the data are bound by confidentiality (the Processor being a sole developer);
3. apply appropriate technical and organizational measures, including Forge's encrypted secret storage for credentials, the least-privilege scope principle, per-request permission checks and input validation;
4. assist the Controller, within a reasonable time, in responding to data subject requests (access, rectification, erasure, portability, objection);
5. assist the Controller with obligations under Articles 32–36 of the GDPR (security, breach notification, impact assessments), to the extent of the information available to the Processor;
6. at the end of the agreement, and at the Controller's choice, delete or return the Controller's data related to the App, unless law requires retention.

5. Sub-processors

Atlassian (Forge platform). The Processor uses the Atlassian Forge platform to run the App and store its data. Atlassian's commitments are set out in the Forge Data Processing Addendum and the Atlassian Data Processing Addendum. The chain is: Controller (controller) → Provider (processor) → Atlassian (sub-processor).

The Processor will inform the Controller in advance if it engages a different or additional sub-processor. The Controller may object within 30 days of that notice.

Not sub-processors: the Git provider (GitHub, Bitbucket Cloud, GitLab.com, Azure Repos) and the export destination (Google BigQuery, Amazon S3) chosen and configured by the Controller. These are the Controller's own accounts and services, accessed with credentials the Controller supplies; the Controller's agreements with them govern their processing.

6. Personal data breach

The Processor will notify the Controller of a personal data breach affecting personal data it processes for the Controller without undue delay and in any case within 48 hours of becoming aware of it, providing the information then available on the nature of the breach, its likely consequences and the measures taken or proposed.

7. Audit

On reasonable written notice of at least 30 days, and no more than once a year, the Controller may verify the Processor's compliance with this DPA. Given the Processor's size, verification is primarily document-based (questionnaire; reference to the Forge platform's security documentation). On-site audits only in particularly justified cases on agreed terms.

8. International transfers

Where processing involves transfers outside the European Economic Area (for example through the Atlassian Forge infrastructure, or a Git provider or destination region chosen by the Controller), the transfer mechanisms set out in Atlassian's Data Transfer Impact Assessment and, between the Processor and Atlassian, the applicable Standard Contractual Clauses apply.

9. Liability, term and contact

Liability under this DPA is governed by the liability provisions of the agreement (the Standard Agreement and the Provider-Specific Terms), without affecting liability that cannot be limited under mandatory law. This DPA takes effect with the End User Terms and lasts as long as the Processor processes personal data on the Controller's behalf.

Data protection and DPA enquiries: support@cfrdashboard.app