Data Processing Addendum

Last Updated: October 29, 2026

This document applies to Planyway for Jira Data Center. For other Planyway products, see Data Processing Addendum.

This Data Processing Addendum ("DPA") forms part of the Terms of Use ("Agreement") between the Customer and Rsoftware LLP (“Rsoftware”) for the Planyway app for Jira Data Center ("Service"). When we write “Planyway” or “we” or “us”, we’re referring to Rsoftware.

1. Definitions

  1. “Data Protection Legislation” means the GDPR, the UK GDPR, the CCPA and other data protection laws applicable to the processing of Personal Data under the Agreement.
  2. “Personal Data” means any information relating to an identified or identifiable natural person that Planyway processes in connection with the Service.
  3. “Subprocessor” means any third party appointed by Planyway to process Personal Data.
  4. The terms "Controller", "Processor", "Data Subject", "Personal Data Breach" and "Processing" have the meanings given in the GDPR.

2. Scope and roles

  1. The Service runs on the Customer’s Jira Data Center. Jira project and issue content and the app data are stored in the Customer’s infrastructure and are not transmitted to Planyway.
  2. Personal Data that Planyway receives in connection with the Service includes data shared after the Customer’s Jira system administrator enabled “Share usage and diagnostic data”, and support data.
  3. By enabling data sharing, the Customer confirms that it has the authority to do so on behalf of its organization and has informed its users.
  4. This DPA applies only to Personal Data that Planyway processes on behalf of the Customer as a Processor. Processing for which Planyway determines the purposes and means, including product analytics and maintenance, is performed by Planyway as an independent Controller and is governed by the Privacy Policy rather than this DPA.

3. Processing of Personal Data

  1. Categories of Data Subjects: users of the Service on the Customer’s Jira instance.
  2. Categories of Personal Data: as described in Planyway and GDPR.
  3. Duration: for the term of the Agreement or until Personal Data shared under this DPA is deleted at the Customer’s request submitted to support@planyway.com.

4. International Transfers

Planyway may transfer Personal Data from the EEA, UK and Switzerland to the USA. Transfers to Subprocessors rely on the EU-U.S. Data Privacy Framework (where the Subprocessor is certified) and/or Standard Contractual Clauses.

5. Confidentiality

Persons authorized by Planyway to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

6. Security

Planyway implements appropriate technical and organisational measures to protect Personal Data, as described in Security.

7. Subprocessors

  1. The Customer authorizes Planyway to engage the Subprocessors listed in Planyway and GDPR.
  2. Planyway imposes on each Subprocessor data protection obligations no less protective than those in this DPA.
  3. The Customer can request prior notification of changes to the list by emailing support@planyway.com and may object on reasonable grounds within thirty (30) days.

8. Data Subject Rights

Planyway will provide reasonable assistance to the Customer in responding to requests from Data Subjects.

9. Personal Data Breach

Planyway will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data under this DPA.

10. Deletion

Upon the Customer’s request, Planyway will delete Personal Data received under this DPA, unless retention is required by law.

11. Audit

Planyway will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires.

12. CCPA

Planyway does not sell or share Personal Data. Personal Data processed by Planyway on behalf of the Customer under this DPA is retained, used and disclosed only for the purposes described in this DPA and the Customer’s documented instructions, except where otherwise required by applicable law.