Data Processing Information
This page summarizes processing for customer review and security questionnaires. It is not, by itself, a signed Data Processing Agreement (“DPA”). A DPA may be requested using the contact below when required by applicable law.
Processing details
| Processor | Samir El Khaout, trading as AcceptDeck, Casablanca, Morocco. |
|---|---|
| Subject matter | Providing acceptance-package creation, controlled external review, attachment access, and approval or change-request recording for Jira Cloud. |
| Duration | For the customer’s use of the App and afterward only as necessary to complete deletion, meet legal obligations, resolve disputes, or follow Atlassian platform retention. |
| Nature and purpose | Retrieving customer-selected Jira data; organizing and displaying packages; authenticating or authorizing access; recording reviewer decisions; maintaining revision history and preferences; preventing abuse; and supporting and securing the App. |
| Data subjects | Customer administrators, Jira and JSM users, personnel identified in submitted content, external reviewers, and people who contact support. |
| Data types | Atlassian account identifiers, actor labels, Jira site and issue identifiers, package and deliverable text, acceptance criteria, due dates, decisions, comments, timestamps, attachment identifiers, metadata and content, preferences, link-security records, and operational request metadata. |
| Sensitive data | The App is not designed for special-category, highly sensitive, regulated health, payment-card, government-classified, or authentication data. Customers must not include such data unless they have independently determined the processing is lawful and appropriate. |
| Customer instructions | The applicable agreement, App configuration, authorized user actions, documented features, and lawful written instructions accepted by Provider. |
Customer and Provider responsibilities
The customer determines the purposes and means of processing its submitted content and is responsible for lawful instructions, notices, data minimization, Jira permissions, recipients, retention decisions, and responding to data subjects. AcceptDeck processes that data only to provide, secure, maintain, and support the App; comply with law; and follow documented customer instructions.
Security and confidentiality
AcceptDeck uses the controls described in the Security Statement. There is no routine human access to customer content. Access would occur only where technically possible and reasonably necessary for authorized support, security investigation, legal compliance, or protection of users, and would be limited to what is necessary.
Subprocessing and transfers
Current infrastructure providers are disclosed on the Subprocessors page. Atlassian provides the Forge platform and maintains its own Forge Data Processing Addendum and subprocessor safeguards. Customers requiring contractual transfer safeguards or a countersigned DPA should contact us before submitting regulated personal data.
Data-subject requests and deletion
The customer should receive and verify requests from its users and reviewers. We will provide reasonable assistance within the App’s functionality and Forge platform capabilities. Verified requests should be sent to privacy@acceptdeck.com. We normally respond or complete available deletion actions within 30 days, unless law permits or requires a different period.
DPA requests
To request a DPA, email privacy@acceptdeck.com with the customer’s legal name, country, authorized signer, Jira Cloud site, applicable privacy law, and requested transfer mechanism. Do not include passwords, access tokens, or unnecessary personal data.
