Data Processing Addendum

Last Updated: October 29, 2026

This document applies to Planyway for Jira Cloud. For other Planyway products, see Data Processing Addendum.

This Data Processing Addendum ("DPA") forms part of the Terms of Use ("Agreement") between the Customer and Rsoftware LLP (“Rsoftware”) for the Planyway app for Jira Cloud ("Service"). When we write “Planyway” or “we” or “us”, we’re referring to Rsoftware.

1. Definitions

  1. “Data Protection Legislation” means the GDPR, the UK GDPR, the CCPA and other data protection laws applicable to the processing of Personal Data under the Agreement.
  2. “Personal Data” means any information relating to an identified or identifiable natural person that Planyway processes on behalf of the Customer under the Agreement.
  3. “Subprocessor” means any third party appointed by Planyway to process Personal Data on behalf of the Customer.
  4. The terms "Controller", "Processor", "Data Subject", "Personal Data Breach" and "Processing" have the meanings given in the GDPR.

2. Scope and roles

  1. The Service is built on the Atlassian Forge platform. Jira data and the app data are stored in Jira and in the Atlassian infrastructure. Their processing is governed by the agreements between the Customer and Atlassian.
  2. Personal Data that Planyway processes outside the Atlassian infrastructure in connection with the Service includes usage and diagnostic data and support data.
  3. This DPA applies only to Personal Data that Planyway processes on behalf of the Customer as a Processor. Processing for which Planyway determines the purposes and means, including product analytics, maintenance and newsletters, is performed by Planyway as an independent Controller and is governed by the Privacy Policy rather than this DPA.

3. Processing of Personal Data

  1. Personal Data processed by Planyway on behalf of the Customer under this DPA is processed only on documented instructions of the Customer, which consist of the Agreement and this DPA, except where otherwise required by applicable law.
  2. Categories of Data Subjects: users of the Service on the Customer’s Jira site.
  3. Categories of Personal Data: as described in Planyway and GDPR.
  4. Duration: for the term of the Agreement.

4. International Transfers

Planyway may transfer Personal Data from the EEA, UK and Switzerland to the USA. Transfers to Subprocessors rely on the EU-U.S. Data Privacy Framework (where the Subprocessor is certified) and/or Standard Contractual Clauses.

5. Confidentiality

Persons authorized by Planyway to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

6. Security

Planyway implements appropriate technical and organisational measures to protect Personal Data, as described in Security.

7. Subprocessors

  1. The Customer authorizes Planyway to engage the Subprocessors listed in Planyway and GDPR.
  2. Planyway imposes on each Subprocessor data protection obligations no less protective than those in this DPA.
  3. The Customer can request prior notification of changes to the list by emailing support@planyway.com and may object on reasonable grounds within thirty (30) days.

8. Data Subject Rights

Planyway will provide reasonable assistance to the Customer in responding to requests from Data Subjects to exercise their rights under Data Protection Legislation.

9. Personal Data Breach

Planyway will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data under this DPA and will provide information reasonably required for the Customer to meet its obligations.

10. Deletion

At the end of the Agreement, upon the Customer’s request, Planyway will delete Personal Data processed under this DPA, unless retention is required by law.

11. Audit

Planyway will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires.

12. CCPA

Planyway does not sell or share Personal Data. Personal Data processed by Planyway on behalf of the Customer under this DPA is retained, used and disclosed only for the purposes described in this DPA and the Customer’s documented instructions, except where otherwise required by applicable law.