Privacy policy

1. Scope

This Privacy Policy describes how Purde Software processes personal data in connection with our Confluence apps and our customer-facing services (service desk, email support, public issue trackers).

It supplements Atlassian's Privacy Policy, which applies to your use of Atlassian's platforms; where our processing differs from or adds to Atlassian's, this policy controls.

Where we process personal data on a customer's behalf in our Cloud apps, our Data Processing Agreement (DPA) applies in addition to this policy.

2. Who we are

Whenever we use "we", "us", or "our", we mean:

Purde Software
Max-Friedlaender-Bogen 17
80339 München, Germany
Owner / responsible person: Andreas Purde

2.1 Our role under GDPR

• For data we collect about visitors to our service desk, email correspondents, and people creating tickets in our public Bitbucket repositories, we act as data controller.

• For Customer Data processed by our Cloud apps on behalf of a customer's Atlassian instance, we act as data processor, governed by our DPA.

2.2 Contact for privacy matters

For all privacy-related requests (access, rectification, erasure, restriction, objection, portability, withdrawal of consent, complaints), contact us via:

• Service Desk (preferred): https://purde-software.atlassian.net/servicedesk/customer/portal/2

• Email: support@purde.de

• Postal: Purde Software, Max-Friedlaender-Bogen 17, 80339 München, Germany

2.3 Data Protection Officer

Given the nature, scope, and purposes of our processing, we are not required to appoint a Data Protection Officer under Art. 37 GDPR or §38 BDSG. Andreas Purde is the responsible person for privacy matters and can be reached via the channels above.

3. Why we collect data and the legal bases we rely on

We collect personal data only to the extent necessary to provide, secure, and support our apps and services, and to comply with legal obligations. For each processing activity in §4 we identify the legal basis under Art. 6(1) GDPR:

• (b) Performance of a contract — for installing, operating, and supporting our apps under the EULA.

• (c) Legal obligation — for tax, accounting, and statutory record-keeping.

• (f) Legitimate interests — for security logging, troubleshooting, fraud prevention, and product improvement, balanced against the interests and rights of data subjects.

• (a) Consent — only where explicitly opted in (e.g., AI-assisted answers; public Bitbucket bug reports).

4. The data we process in our Confluence apps

4.1 Slack integration — additional details

The Slack integration in Smart Questions and Answers for Confluence Cloud does not collect or store any data beyond what is listed below.

5. Cookies on our websites

Our Confluence-hosted documentation and service desk are operated by Atlassian and use cookies under Atlassian's cookie policy. We do not set additional tracking cookies of our own and do not use website analytics, advertising, or marketing trackers.

6. Children

Our apps are intended for use in business contexts and are not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

7. Automated decision-making and profiling

We do not engage in automated decision-making producing legal or similarly significant effects on data subjects within the meaning of Art. 22 GDPR. The optional AI features (currently OpenAI-powered answer suggestions in Smart Questions and Answers) generate suggested content for human review and do not autonomously make decisions about data subjects.

8. Subprocessors

Last updated: YYYY-MM-DD. We engage the following subprocessors to provide our services. We give customers at least 30 days' advance notice before adding or replacing a subprocessor that processes Customer Data; customers may object on reasonable data-protection grounds, and the parties will then discuss alternatives in good faith.

We do not give your data to anyone outside the subprocessors listed above.

9. International data transfers

Primary processing location. Customer Data processed by our Cloud apps is hosted within the European Economic Area, primarily in:

• AWS (eu-central-1, Frankfurt; eu-west-1, Ireland)

• Heroku (EU region, Ireland) — being migrated to Atlassian Forge between end of 2025 and mid 2026.

Transfers outside the EEA. Some subprocessors listed in §8 are located in or transfer data to third countries, primarily the United States. For each such transfer we rely on one of the following safeguards under Chapter V GDPR:

• Adequacy decision under Art. 45 GDPR, including the EU–US Data Privacy Framework where the recipient is certified;

• Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) under Art. 46(2)(c) GDPR, supplemented by transfer impact assessments and additional technical/organizational measures where required by Schrems II.

Documentation. Customers may request the relevant transfer documentation (SCCs, DPF certifications, transfer impact assessments) by contacting us via the channels in §2.2.

10. Personal data breach notification

If we become aware of a personal data breach affecting Customer Data that we process on a customer's behalf, we will notify the affected customer without undue delay and in any event within 72 hours of becoming aware. The notification will include, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate adverse effects (Art. 33(3) GDPR).

11. Your rights

You have the following rights regarding your personal data:

• Access — obtain confirmation whether we process personal data about you and a copy of that data (Art. 15 GDPR).

• Rectification — have inaccurate data corrected and incomplete data completed (Art. 16 GDPR).

• Erasure — have your data deleted, subject to the limits in Art. 17(3) GDPR (we may need to retain certain records to comply with legal obligations or to defend legal claims, and we cannot remove information required to continue providing a service you have actively requested) (Art. 17 GDPR).

• Restriction — restrict our processing in defined circumstances (Art. 18 GDPR).

• Objection — object to processing based on legitimate interests (Art. 21 GDPR).

• Data portability — receive your data in a structured, commonly used, machine-readable format and transmit it to another controller (Art. 20 GDPR).

• Withdrawal of consent — withdraw consent for any processing based on consent (Art. 6(1)(a) GDPR), without affecting the lawfulness of processing carried out before withdrawal.

Submitting a request

Use the channels in §2.2. We aim to acknowledge requests within 5 business days and to complete them within 30 calendar days, extendable by a further two months for complex or numerous requests (Art. 12(3) GDPR), in which case we will inform you of the extension and the reasons.

12. Data Processing Agreement (DPA)

If you require a DPA for one of our Cloud apps, you may use our template or send us yours for review.

13. How to raise a complaint

If you have a concern about how we handle your personal data, please contact us first via the channels in §2.2 — we aim to acknowledge complaints within 5 business days and resolve them within 30 calendar days.

You also have the right to lodge a complaint with a data-protection supervisory authority. The competent authority for our establishment is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
https://www.lda.bayern.de

Data subjects in other EU/EEA member states may alternatively lodge a complaint with their local supervisory authority or with the authority of their habitual residence or place of work.

14. Notice and changes to this policy

• At installation. Atlassian's consent dialog clearly lists the data scopes we request when you install or grant permissions to our apps.

• In-app documentation. We link to this Privacy Policy from each app's documentation.

• Material changes. If we make material changes to how we collect or process personal data, we will post a prominent notice in the service portal and, where feasible, notify active administrators by email at least 30 days before the change takes effect.

15. Version history