Compliance Glossary for Confluence Data Processing Agreement

Effective: 26 September 2026 · Last updated: 13 October 2026

This Data Processing Agreement ("DPA") forms part of the agreement between the entity installing Compliance Glossary for Confluence ("Customer," "you," "Controller") and DailyMind LTD, a company registered in Cyprus ("Processor," "we," "us"), pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

By installing the App from the Atlassian Marketplace, you accept this DPA.

Scope of this DPA

This DPA covers only the Confluence App ("App data") — data processed by the Compliance Glossary for Confluence Forge application, including terminology workflows, scanning, enterprise evidence, file ingestion, optional GitHub processing, and Forge LLM functions. It does not cover the separate marketing website (compliance-glossary.teamkit.dev). Marketing-website processing is disclosed in the Privacy Policy and is outside the controller-processor relationship established by this DPA.

1. Definitions

• "App" means Compliance Glossary for Confluence, a Forge-based application running on Atlassian's infrastructure.
• "Personal Data" means personal data contained in App data, including Atlassian account IDs and personal data that a Customer includes in Confluence content, uploaded evidence, GitHub source content, terminology records, or related metadata.
• "Processing" means any operation performed on Personal Data, including storage, retrieval, and erasure.
• "Sub-processor" means a third party engaged by the Processor to process Personal Data on behalf of the Controller.
• "Customer-directed provider" means a service selected, configured, and separately controlled by the Customer, including the Customer's GitHub service.

2. Scope and Purpose of Processing

The App processes Personal Data solely for the following purposes:

• Recording which user created, edited, submitted, approved, or deprecated each glossary term (audit trail)
• Recording which user resolved compliance scanner findings
• Maintaining role-based access control (administrator list)
• Reporting stored account IDs to the Atlassian platform for personal data lifecycle management
• Scanning Confluence content and approved external evidence for terminology findings and usage classifications
• Creating, verifying, exporting, and importing evidence baselines, archives, hashes, coverage records, and trace links
• Processing administrator-selected evidence through Forge LLM functions for draft-only curation and usage classification
• Processing configured GitHub repositories and allow-listed paths when an administrator enables the optional GitHub connector

2.1 Categories of Personal Data

Routine scan findings exclude full page bodies and context snippets. Enterprise baseline freezes store the selected Confluence revision's storage-format body in Forge Object Store. Uploaded evidence bytes are stored in Forge Object Store. Display names are fetched on demand from Confluence and kept only in a bounded in-memory browser cache.

2.2 Categories of Data Subjects

Users of the Customer's Atlassian Confluence instance and individuals whose Personal Data the Customer includes in Confluence content, uploaded evidence, GitHub source content, terminology records, or related metadata.

3. Processor Obligations

1. Lawful processing — We process Personal Data only on your documented instructions (i.e., your use of the App's features) and as described in this DPA.
2. Confidentiality — Personnel with potential access to Personal Data are bound by confidentiality obligations.
3. Security measures — We implement appropriate technical measures as described in our Security Policy. The App runs on Atlassian Forge and uses Forge KVS, SQL, Object Store, Secure Storage, and Forge LLM functions. DailyMind does not operate an external app database or app server.
4. Sub-processors — We will not engage additional sub-processors without prior notification (see Section 5).
5. Assistance — We will assist you in fulfilling data subject requests and GDPR obligations to the extent technically feasible within the Forge platform.
6. Deletion — On uninstall, Atlassian soft-deletes all Forge-hosted storage and destroys it at the end of the retention period in Atlassian's Standard Data Retention and Disposal policy (see Atlassian's Forge hosted-storage data lifecycle). DailyMind does not retain an independent copy. Administrators remain responsible for exported files downloaded to their systems.
7. Audit — We will make available information necessary to demonstrate compliance with this DPA upon reasonable request, no more than once per year, via written questionnaire.

4. Data Security

The App's architecture provides the following protections:

• Forge-hosted application — App storage and runtime processing use Atlassian Forge. DailyMind does not operate an external app server or database.
• Data isolation — Each Atlassian installation has its own isolated data partition. No installation can access another's data.
• Encryption — Data is encrypted at rest and in transit by Atlassian's infrastructure.
• Minimized external processing — The optional GitHub connector sends authenticated requests only to https://api.github.com. Allowed source content is processed in Forge memory and is not stored as source content in findings.
• Credential protection — Optional GitHub App private keys and webhook secrets are stored in Forge Secure Storage. Short-lived GitHub installation tokens remain in invocation memory.
• AI controls — Forge LLM inputs use selected, bounded evidence. Secret-like assignments are redacted before curation prompts. Stored curation records exclude prompts, excerpts, page bodies, reasoning, and raw model responses.
• Evidence integrity — Enterprise evidence uses content hashes and tenant-scoped records. Integrity controls do not replace the Customer's legal retention, access-control, or validation obligations.

5. Service Providers and Customer-Directed Services

Atlassian processes App data under its applicable Data Processing Addendum and Forge terms. GitHub is selected and controlled by the Customer rather than engaged by DailyMind as an independent hosting provider. Enabling the connector instructs the App to exchange configured repository requests and content with the Customer's GitHub service.

The Customer must ensure that its GitHub agreement authorizes this processing and provides any required international-transfer mechanism. Where the GitHub Data Protection Agreement applies, it identifies the EU-US Data Privacy Framework and the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914, including Module Two or Module Three as applicable.

Note on the marketing website: the separate marketing website (compliance-glossary.teamkit.dev) uses additional processors: Cloudflare, Inc. (USA) for site hosting and CDN; Resend, Inc. (USA) for template-download email delivery; and Anthropic PBC (USA) for the in-page chat assistant. Those processors are outside the scope of this DPA and are fully disclosed in the Privacy Policy. They do not process App data (data stored in Atlassian Forge).

We will notify Customers of new sub-processors for the App by updating this page and, where technically feasible, by notification through the Atlassian Marketplace, at least 30 days before engagement. Customers who object to a new sub-processor may contact [email protected] within 30 days. If the objection cannot be resolved, the Customer may terminate the agreement by uninstalling the App. For paid customers, termination under this clause includes a pro-rata refund of any prepaid fees, in line with the exit-rights principle of DORA Art. 30(3) (termination without undue cost or disruption).

6. Data Subject Rights

The App supports the following data subject rights:

• Account-reference erasure — When Atlassian signals that a user account has closed, catalogued KVS actor references are replaced with account-deleted, enterprise SQL actor fields are replaced with [deleted-user], and matching manager membership is removed.
• Right of access — Site administrators can view all stored data through the App's interface and export it via the Audit Export feature (CSV).
• Personal data reporting — The App reports all stored account IDs to the Atlassian platform weekly, enabling Atlassian's data lifecycle management.

The account-closure callback does not search free-text fields, Confluence content, GitHub source content, uploaded files, or Object Store objects for embedded Personal Data. Customers must contact [email protected] for a scoped request involving those records. Shared evidence is not deleted solely because one actor account closes.

7. International Data Transfers

Forge-hosted App data follows the Customer's Atlassian data-residency configuration. Atlassian's transfer mechanisms are described in its Data Processing Addendum and Data Transfer Impact Assessment.

If an administrator enables the optional GitHub connector, the App sends configured repository identifiers, allow-listed paths, immutable commit references, and authenticated requests to GitHub and receives the requested content. GitHub may process Personal Data outside the EEA.

The Customer instructs this transfer by configuring the connector and must ensure that an approved transfer mechanism applies to its GitHub service. Where the GitHub Data Protection Agreement applies, Section 7 identifies the EU-US Data Privacy Framework and/or the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914. Module Two or Module Three applies as appropriate. The connector must not be enabled where the Customer has not established a lawful transfer basis.

8. Data Breach Notification

In the event of a Personal Data breach affecting the App, we will:

1. Notify the affected Customer without undue delay and, where feasible, within 72 hours of becoming aware of the breach
2. Provide a description of the nature of the breach, categories of data affected, and remediation measures taken
3. Cooperate with the Customer to fulfil their notification obligations under GDPR Art. 33 and Art. 34

For breaches originating in the Atlassian platform itself, Atlassian's incident response and notification processes apply.

9. Term and Termination

This DPA is effective from the date you install the App and terminates when the App is uninstalled. On uninstall, Atlassian soft-deletes all Forge-hosted storage (KVS, Entity Store, Forge SQL and Object Store) and destroys it at the end of the retention period in Atlassian's Standard Data Retention and Disposal policy, as described in Atlassian's Forge hosted-storage data lifecycle. A request within 21 days of uninstallation can relink a reinstallation to the old data. DailyMind does not retain an independent copy of Customer data. Files exported to the Customer's browser or systems remain under the Customer's control.

10. Limitation of Liability

DailyMind's liability under this DPA is subject to the limitations set forth in the Terms of Service, except that liability for GDPR obligations cannot be limited to the extent prohibited by applicable law (GDPR Art. 82–83).

11. Contact

For DPA-related inquiries: [email protected]

DailyMind LTD
Limassol, Cyprus
VAT: CY10439959M