Data Processing Addendum Base Template

Owner	Flowdence Legal and Security
Applies to app	All Flowdence Marketplace cloud apps
Review cadence	Quarterly and before publication
Status	Draft template aligned for Marketplace cloud apps

1. Parties and roles

• Provider: Flowdence
• Customer: Marketplace customer entity
• Role model: Customer acts as Data Controller for End-User Data processed through the app; Flowdence acts as Data Processor for that End-User Data. Flowdence acts as an independent Data Controller only for limited business-operational data (for example account management, billing records, support correspondence, and security-abuse logs) where Flowdence determines purpose and means of processing.

2. Subject matter and duration

• Subject matter: Processing required to deliver the app service.
• Duration: For the term of the subscription and limited post-termination retention required by law or contract.

3. Categories of data

• Atlassian account identifiers: Yes, where required for app features, permissions checks, and support.
• Product content metadata: Yes, where required to render app functionality and context.
• Operational telemetry and logs: Yes, limited to operational troubleshooting, reliability, and security.
• Other end-user data: App-specific. Each app discloses additional categories in its own data-handling disclosure.

4. Purpose of processing

• Deliver product functionality.
• Operate, secure, and support the service.
• Perform troubleshooting and incident response.

5. Security controls

• Access controls and least privilege.
• Encryption in transit and at rest where applicable.
• Secrets management controls.
• Logging and monitoring controls.

6. Subprocessors

• Subprocessor governance: Flowdence maintains a subprocessor change communication plan. See Subprocessor Change Communication Plan for details.
• Notification process for subprocessor changes: Flowdence will provide at least 30 days’ advance notice before adding or replacing a subprocessor that materially affects personal data processing. Notice will include subprocessor name, processing location, and purpose. Customers may raise objections within 5 business days via support channel. Flowdence will work in good faith on mitigation, transition, or reasonable alternatives.

7. International transfers

Where personal data is transferred across borders, Flowdence applies appropriate transfer safeguards required by applicable privacy law. For restricted transfers, these safeguards may include standard contractual clauses or equivalent legal mechanisms recognized by competent regulators.

8. Data subject rights and assistance

Provider supports customer obligations for access, rectification, and deletion requests as applicable.

9. Retention and deletion

• Retention periods are defined in each app’s data handling disclosure.
• Deletion process on termination: Unless legally required to retain specific records, Flowdence will delete or irreversibly de-identify customer personal data within 90 days after service termination or written deletion request, subject to backup lifecycle and technical constraints.

10. Audit and evidence

Flowdence will provide reasonable documentation and information demonstrating its security and privacy controls, including policy artifacts and independent assurance summaries where available. Customer audit requests must be reasonable in scope, proportional, and not more than once annually unless a material incident justifies additional review.