Data Processing Agreement

Soverain s.r.o. Version 1.1 — Last updated: 3 August 2026

This Data Processing Agreement ("DPA") sets out the terms on which Soverain s.r.o. processes personal data on behalf of its customers. It is written to satisfy Article 28(3) of Regulation (EU) 2016/679 ("GDPR").

How this DPA takes effect. This DPA applies automatically to every customer who uses a Soverain product that processes personal data, and forms part of the agreement between us. No signature is required. If your procurement process needs a countersigned copy, email privacy@soverain.cz and we will sign this document as published. We publish one DPA for everyone rather than negotiating bespoke variations; if your procurement process needs something this document does not cover, write to the same address and we will tell you what we can do.

1. Parties and definitions

"Soverain" — Soverain s.r.o., IČO 29693144, Chabařovická 1324/21, Kobylisy, 182 00 Praha 8, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, file C 450889. The processor.

"Customer", "you" — the organisation that has licensed or is using a Soverain product. The controller.

"Products" — all Soverain s.r.o. products, services and websites, including the Kanban+ app for Jira Cloud, and any Soverain product released later. This DPA is deliberately written per company and per role, not per app or per sales channel, so it applies unchanged to future products and future distribution routes.

In practice it is Kanban+ that engages it. Diagon, our desktop app, runs entirely on the user's own machine — including its bundled AI — and diagram content never reaches us, so there is no Customer Personal Data for us to process on your behalf.

"Customer Personal Data" — personal data within the Products that Soverain processes on your behalf.

"Data Protection Law" — GDPR, the UK GDPR where applicable, and Czech Act No. 110/2019 Coll. on personal data processing.

Terms such as controller, processor, processing, personal data, data subject, sub-processor and personal data breach carry their GDPR meanings.

2. Roles

You are the controller of Customer Personal Data. Soverain is the processor. Details of the processing are in Annex 1.

Where Soverain determines its own purposes — for example our commercial relationship with you, application logs, or support correspondence — Soverain acts as a controller and that processing is governed by our Privacy Policy, not by this DPA.

You are responsible for having a lawful basis for the personal data you put into the Products, for issuing any required privacy notices to your own staff, and for the lawfulness of your instructions.

3. Processing instructions (Art. 28(3)(a))

Soverain processes Customer Personal Data only on your documented instructions, including as to international transfers, unless required otherwise by EU or Member State law — in which case Soverain will inform you before processing unless that law prohibits it on important grounds of public interest.

Your instructions consist of: this DPA; the product documentation; and your configuration and use of the Products.

Soverain will immediately inform you if, in its opinion, an instruction infringes Data Protection Law.

Soverain will not:

• process Customer Personal Data for its own purposes;
• sell, rent or otherwise disclose Customer Personal Data;
• use Customer Personal Data to train machine-learning models;
• combine Customer Personal Data with data from other sources.

4. Confidentiality (Art. 28(3)(b))

Soverain ensures that every person authorised to process Customer Personal Data is bound by an obligation of confidentiality, whether contractual or statutory, that survives the end of their engagement.

Soverain is currently a one-person company. Its sole director and operator is bound by statutory confidentiality duties. Every future employee or contractor will be under a written confidentiality obligation before being granted access.

Access is limited to those who need it to deliver or support the Products.

5. Security (Art. 28(3)(c), Art. 32)

Soverain implements appropriate technical and organisational measures, described in Annex 2 and in our Security Statement.

The core measure is architectural: Soverain products process Customer Personal Data exclusively on Atlassian-hosted infrastructure, inside your own Atlassian installation. Soverain operates no servers, no databases and no data stores. Customer Personal Data is not copied to any Soverain system. This removes whole categories of risk rather than mitigating them.

6. Sub-processors (Art. 28(2), 28(3)(d), 28(4))

You give general written authorisation for Soverain to engage sub-processors on the terms in this section.

Current sub-processors

That is the complete list. Soverain engages no analytics provider, no error-tracking service, no hosting provider of its own, no AI or machine-learning service, and no email provider that touches Customer Personal Data.

Changes

Soverain will give you at least 30 days' notice before adding or replacing a sub-processor, by email to your registered contact and by updating the Security Statement. If you reasonably object on data protection grounds within that period, we will work with you in good faith; if we cannot resolve it, you may terminate your use of the affected Product and, where you bought through the Atlassian Marketplace, seek any refund available under Atlassian's terms.

Soverain imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains fully liable to you for its sub-processors' performance.

7. Assistance with data subject rights (Art. 28(3)(e))

Given the architecture, you can usually satisfy data subject requests yourself: Customer Personal Data sits in your own Atlassian installation and the Products give you controls to view, correct and delete it.

Where you cannot, Soverain will provide reasonable assistance by appropriate technical and organisational measures, taking into account the nature of the processing.

If a data subject contacts Soverain directly about Customer Personal Data, Soverain will not respond substantively. It will forward the request to you without undue delay, unless you have instructed otherwise or law requires otherwise.

Erasure while the app remains installed. Atlassian provides no way for a site administrator to clear an app's storage without uninstalling. Soverain has built that missing control: Kanban+ contains an administrator-gated function that deletes every record the app holds for your site. It requires Jira site-administrator rights and an explicit confirmation, and it runs while the app is still installed, so it actually completes. There is no self-service screen for it yet — email support@soverain.cz and we will assist your site administrator in running it.

8. Assistance with compliance obligations (Art. 28(3)(f))

Taking into account the nature of processing and the information available to it, Soverain assists you in complying with Articles 32 to 36 GDPR — security, breach notification, breach communication, data protection impact assessments, and prior consultation.

Breach notification

Soverain will notify you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point.

Where a breach originates in Atlassian's infrastructure, Atlassian may notify you directly under its own agreement with you; Soverain will notify you of anything it learns and will not assume Atlassian has already done so.

Soverain will not notify a supervisory authority or data subjects about a breach of Customer Personal Data on your behalf unless you instruct it to. That determination is yours as controller.

9. Deletion and return (Art. 28(3)(g))

At your choice, Soverain deletes or returns all Customer Personal Data at the end of the provision of services, and deletes existing copies, unless EU or Member State law requires storage.

In practice this is straightforward, and it is important to understand who does what:

• Soverain holds no copy of Customer Personal Data. There is nothing on our side to return or delete.
• Customer Personal Data lives in Forge hosted storage inside your Atlassian installation. When you uninstall, Atlassian deletes it — soft-deleted first, then disposed of; Atlassian documents 28 days of retention for Forge hosted storage after uninstallation, and a 21-day window in which you may ask Atlassian to relink a reinstallation to the previous data.
• Before or instead of uninstalling, you can use the deletion controls described in §7 and in the App Data Annex.

Soverain does not implement an uninstall-time deletion hook. Atlassian already performs the deletion, the only available platform hook is documented as non-blocking and so could not support a reliable commitment, and eager deletion would destroy your 21-day relink window. We would rather describe Atlassian's behaviour accurately than promise an action we do not perform.

Application logs held by Soverain as controller are deleted by Atlassian after 30 days.

10. Audits and information (Art. 28(3)(h))

Soverain makes available to you all information necessary to demonstrate compliance with Article 28, and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate.

In practice, and proportionate to a small company processing data it never holds:

1. Documentation first. Our Security Statement and App Data Annex are maintained as current and are intended to answer most assessments without correspondence. 2. Questionnaires. We will complete a reasonable security questionnaire once per year at no charge. 3. Atlassian's assurance. Because all processing happens on Atlassian infrastructure, the relevant infrastructure controls are evidenced by Atlassian's own certifications and SOC 2 reporting, available from Atlassian's trust centre. Soverain cannot audit Atlassian on your behalf and does not claim its certifications as its own. 4. On-site inspection. Available on reasonable written notice, not more than once per year except after a personal data breach, during business hours, subject to confidentiality, and without disrupting operations. You bear the cost unless the audit reveals a material breach of this DPA.

11. International transfers

Soverain does not transfer Customer Personal Data outside the EEA. The data remains in your Atlassian environment, subject to your data residency configuration.

Where Atlassian, as sub-processor, transfers data internationally as part of operating its platform, those transfers are governed by Atlassian's own transfer mechanisms, including the European Commission's Standard Contractual Clauses. Those are Atlassian's documents to maintain and revise: the data processing addendum and transfer terms in force at any time are the ones Atlassian publishes in its trust centre, and we point you there rather than reproduce a copy here that would quietly go out of date.

If a future transfer by Soverain becomes necessary, we will implement a valid Chapter V transfer mechanism and update this DPA under §13.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the agreement governing your use of the Products — for Marketplace customers, the end user agreement elected on the Atlassian Marketplace listing. Nothing in this DPA limits liability that cannot lawfully be limited, including a data subject's rights under Article 82 GDPR.

13. Changes to this DPA

Soverain may update this DPA to reflect changes in law, sub-processors or product architecture. Material changes take effect 30 days after we publish them and notify your registered contact. The version number and date at the top always identify the current version.

14. Order of precedence

If this DPA conflicts with any other agreement between you and Soverain on the subject of processing personal data, this DPA prevails to the extent of the conflict.

Annex 1 — Description of the processing

(Required by Article 28(3))

Subject matter. Provision of Soverain's software products to the Customer.

Duration. For as long as the Customer uses the Products, plus the deletion periods in §9.

Nature of the processing. Collection, structuring, storage, retrieval, display, calculation, transmission within the Customer's own Atlassian environment, and erasure — all performed by software running on Atlassian-hosted infrastructure inside the Customer's installation, without human access by Soverain.

Purpose. Delivering the functionality the Customer configured: project boards, timelines, backlog and sprint management, reporting and analytics, workflow automation, service-level tracking, cross-board dependency tracking, and team retrospectives.

Categories of data subjects.

• The Customer's employees, contractors and other Jira users;
• individuals named or described in the Customer's Jira content;
• the Customer's nominated technical and billing contacts (note: in relation to those contacts Soverain acts as controller, not processor — see the Privacy Policy).

Categories of personal data.

A field-level inventory is in the App Data Annex.

Special category data (Art. 9) and criminal offence data (Art. 10). Soverain does not request, require or intentionally process any special category or criminal offence data. The Products contain free-text fields — notably retrospective boards — into which a Customer's users could enter such data. The Customer, as controller, is responsible for governing what its users enter.

Sub-processors. Atlassian only. See §6.

Frequency. Continuous, for as long as the Products are installed.

Annex 2 — Technical and organisational measures

(Article 32 GDPR)

Fuller detail is in the Security Statement.

Architecture — the primary control. Products run exclusively on Atlassian-hosted compute and storage. Soverain operates no servers, no databases and no data stores. Kanban+ declares no external network permissions and makes no outbound requests, so there is no code path by which Customer Personal Data can leave the Atlassian environment. Data inherits the Customer's Atlassian data residency configuration.

Confidentiality. Access limited to personnel who need it. Confidentiality obligations on all personnel. No Soverain administrative interface exists that could read Customer Personal Data from outside the Customer's own Jira instance. Multi-factor authentication on the Atlassian developer and Marketplace partner accounts. No third-party API credentials are stored by the Products.

Integrity. Authorisation checks in the app enforce Jira permissions; destructive operations additionally require site-administrator rights and explicit confirmation. Board records are revision-counted to detect conflicting concurrent writes. Data in transit is protected by TLS as provided by the Atlassian platform.

Availability and resilience. Provided by the Atlassian Forge platform, including backup and disaster recovery of Forge hosted storage. Soverain adds no infrastructure and therefore no additional single point of failure.

Testing and evaluation. Automated test suite, ESLint static analysis and a full frontend build run in continuous integration on every push and on every pull request; all three must pass. Dependencies are checked for known vulnerabilities as part of preparing a release, not by an always-on scanning service — we have not enabled automated dependency scanning, and we would rather say so than imply continuous coverage we do not have. Every release is reviewed against Atlassian Marketplace security requirements.

Data minimisation. The Products persist configuration and derived scheduling data rather than copying Jira content. Jira data is read, rendered in the user's browser and discarded. Documented exceptions and one known minimisation gap are disclosed in the App Data Annex.

Retention. Automated retention enforced in the product: analytics snapshots 365 days; alert cooldown markers 48 hours; audit log capped at 100 entries per board. Deleting a board cascades to its dependent records.

Related: Privacy Policy · App Data Annex · Security Statement