Data Processing Agreement

Soverain s.r.o. Version 1.4 — Published: 18 September 2026 Effective: 18 October 2026

Version 1.4 is a material change, so under §13 it takes effect 30 days after we publish it and notify your registered contact. OnTask gains a Team tab, on for every site, that shows a user the time the colleagues they select logged in Jira. Annex 1 now names that purpose and the personal data it involves: logged work time per person, read live and not stored; the display names and avatars the tab shows, also read live and not stored; and saved views that hold colleagues' account IDs under a name the user types. Annex 1 also now lists what OnTask already held for each user: their clock, history, submission records, preferences and the bookkeeping for Atlassian's Personal Data Reporting, and no longer lists an unsent draft, which the app has never stored. Nothing in this version reduces a commitment made in version 1.3. Until 18 October 2026, version 1.3 of 6 September 2026 still applies, and its text is available from privacy@soverain.cz on request. Every change in version 1.4 concerns OnTask; for Kanban+ the two versions are the same in substance.

This Data Processing Agreement ("DPA") sets out the terms on which Soverain s.r.o. processes personal data on behalf of its customers. It is written to satisfy Article 28(3) of Regulation (EU) 2016/679 ("GDPR").

How this DPA takes effect. This DPA applies automatically to every customer who uses a Soverain product that processes personal data, and forms part of the agreement between us. No signature is required. If your procurement process needs a countersigned copy, email privacy@soverain.cz and we will sign this document as published. We publish one DPA for everyone rather than negotiating bespoke variations; if your procurement process needs something this document does not cover, write to the same address and we will tell you what we can do.

1. Parties and definitions

"Soverain" — Soverain s.r.o., IČO 29693144, Chabařovická 1324/21, Kobylisy, 182 00 Praha 8, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, file C 450889. The processor.

"Customer", "you" — the organisation that has licensed or is using a Soverain product. The controller.

"Products" — all Soverain s.r.o. products, services and websites, including the Kanban+ app for Jira Cloud, and any Soverain product released later. This DPA is deliberately written per company and per role, not per app or per sales channel, so it applies unchanged to future products and future distribution routes.

In practice it is our two Atlassian apps, Kanban+ and OnTask, that engage it. Diagon, our desktop app, runs entirely on the user's own machine — including its bundled AI — and diagram content never reaches us, so there is no Customer Personal Data for us to process on your behalf.

"Customer Personal Data" — personal data within the Products that Soverain processes on your behalf.

"Data Protection Law" — GDPR, the UK GDPR where applicable, and Czech Act No. 110/2019 Coll. on personal data processing.

Terms such as controller, processor, processing, personal data, data subject, sub-processor and personal data breach carry their GDPR meanings.

2. Roles

You are the controller of Customer Personal Data. Soverain is the processor. Details of the processing are in Annex 1.

Where Soverain determines its own purposes — for example our commercial relationship with you, application logs, or support correspondence — Soverain acts as a controller and that processing is governed by our Privacy Policy, not by this DPA.

You are responsible for having a lawful basis for the personal data you put into the Products, for issuing any required privacy notices to your own staff, and for the lawfulness of your instructions.

3. Processing instructions (Art. 28(3)(a))

Soverain processes Customer Personal Data only on your documented instructions, including as to international transfers, unless required otherwise by EU or Member State law — in which case Soverain will inform you before processing unless that law prohibits it on important grounds of public interest.

Your instructions consist of: this DPA; the product documentation; and your configuration and use of the Products.

Soverain will immediately inform you if, in its opinion, an instruction infringes Data Protection Law.

Soverain will not:

• process Customer Personal Data for its own purposes;
• sell, rent or otherwise disclose Customer Personal Data;
• use Customer Personal Data to train machine-learning models;
• combine Customer Personal Data with data from other sources.

4. Confidentiality (Art. 28(3)(b))

Soverain ensures that every person authorised to process Customer Personal Data is bound by an obligation of confidentiality, whether contractual or statutory, that survives the end of their engagement.

Soverain is currently a one-person company. Its sole director and operator is bound by statutory confidentiality duties. Every future employee or contractor will be under a written confidentiality obligation before being granted access.

Access is limited to those who need it to deliver or support the Products.

5. Security (Art. 28(3)(c), Art. 32)

Soverain implements appropriate technical and organisational measures, described in Annex 2 and in our Security Statement.

The core measure is architectural: Soverain products process Customer Personal Data exclusively on Atlassian-hosted infrastructure, inside your own Atlassian installation. Soverain operates no servers, no databases and no data stores. Customer Personal Data is not copied to any Soverain system. This removes whole categories of risk rather than mitigating them.

6. Sub-processors (Art. 28(2), 28(3)(d), 28(4))

You give general written authorisation for Soverain to engage sub-processors on the terms in this section.

Current sub-processors

That is the complete list for Customer Personal Data — the data Soverain processes on your behalf under this DPA, which is the data Kanban+ and OnTask hold inside your own Atlassian installation. Soverain engages no analytics provider, no error-tracking service, no hosting provider of its own, no AI or machine-learning service, and no email provider that touches it.

The Security Statement §3 lists three providers rather than one. That is not a different answer: the other two, FastSpring and Microsoft Azure, exist only in the path by which Diagon is bought and licensed. They never touch Customer Personal Data as defined here, and Soverain is the controller — not your processor — for the purchase records they handle.

Changes

Soverain will give you at least 30 days' notice before adding or replacing a sub-processor, by email to your registered contact and by updating the Security Statement. If you reasonably object on data protection grounds within that period, we will work with you in good faith; if we cannot resolve it, you may terminate your use of the affected Product and, where you bought through the Atlassian Marketplace, seek any refund available under Atlassian's terms.

Soverain imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains fully liable to you for its sub-processors' performance.

7. Assistance with data subject rights (Art. 28(3)(e))

Given the architecture, you can usually satisfy data subject requests yourself: Customer Personal Data sits in your own Atlassian installation and the Products give you controls to view, correct and delete it.

Where you cannot, Soverain will provide reasonable assistance by appropriate technical and organisational measures, taking into account the nature of the processing.

If a data subject contacts Soverain directly about Customer Personal Data, Soverain will not respond substantively. It will forward the request to you without undue delay, unless you have instructed otherwise or law requires otherwise.

Erasure while the app remains installed. Atlassian provides no way for a site administrator to clear an app's storage without uninstalling. Soverain has built that missing control in both apps, and in each it runs while the app is still installed, so it actually completes.

Kanban+ contains an administrator-gated function that deletes every record the app holds for your site. It requires Jira site-administrator rights and an explicit confirmation. There is no self-service screen for it yet — email support@soverain.cz and we will assist your site administrator in running it.

OnTask ships its controls in the app's own interface, under Settings & privacy, so while your subscription is active, running them needs no correspondence with us. Delete everyone's deletes every record the app holds for your site; it is restricted to Jira site administrators, and that check is made on the server rather than in the browser. It does need an active subscription: when one lapses OnTask replaces its interface with a lock screen, Settings & privacy is no longer reachable, and a site administrator who wants every record erased before uninstalling should email support@soverain.cz. Delete my OnTask data deletes the records that are exactly one user's own; it is available to any user, with no administrator involved, and it is on that lock screen too, so an erasure request from one of your staff can be satisfied without you or us acting at all, subscription or no subscription. Because other people's saved Team views name the erased person, that erasure also reaches across people: the erased person is taken out of every view anyone else saved, a removal that cannot be finished at the time is recorded for the daily job to retry in batches, and a view left with nobody in it is deleted. Where even that record cannot be written, the user is told so and asked to run the control again. Neither control touches the worklogs or comments OnTask wrote into Jira — those are ordinary Jira data, and they are erased in Jira.

8. Assistance with compliance obligations (Art. 28(3)(f))

Taking into account the nature of processing and the information available to it, Soverain assists you in complying with Articles 32 to 36 GDPR — security, breach notification, breach communication, data protection impact assessments, and prior consultation.

Breach notification

Soverain will notify you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point.

Where a breach originates in Atlassian's infrastructure, Atlassian may notify you directly under its own agreement with you; Soverain will notify you of anything it learns and will not assume Atlassian has already done so.

Soverain will not notify a supervisory authority or data subjects about a breach of Customer Personal Data on your behalf unless you instruct it to. That determination is yours as controller.

9. Deletion and return (Art. 28(3)(g))

At your choice, Soverain deletes or returns all Customer Personal Data at the end of the provision of services, and deletes existing copies, unless EU or Member State law requires storage.

In practice this is straightforward, and it is important to understand who does what:

• Soverain holds no copy of Customer Personal Data. There is nothing on our side to return or delete.
• Customer Personal Data lives in Forge hosted storage inside your Atlassian installation. When you uninstall, Atlassian deletes it — soft-deleted first, then disposed of; Atlassian documents 28 days of retention for Forge hosted storage after uninstallation, and a 21-day window in which you may ask Atlassian to relink a reinstallation to the previous data.
• Before or instead of uninstalling, you can use the deletion controls described in §7 and in the App Data Annex.

Soverain does not implement an uninstall-time deletion hook. Atlassian already performs the deletion, the only available platform hook is documented as non-blocking and so could not support a reliable commitment, and eager deletion would destroy your 21-day relink window. We would rather describe Atlassian's behaviour accurately than promise an action we do not perform.

Application logs held by Soverain as controller are deleted by Atlassian after 30 days.

10. Audits and information (Art. 28(3)(h))

Soverain makes available to you all information necessary to demonstrate compliance with Article 28, and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate.

In practice, and proportionate to a small company processing data it never holds:

1. 01Documentation first. Our Security Statement and App Data Annex are maintained as current and are intended to answer most assessments without correspondence.
2. 02Questionnaires. We will complete a reasonable security questionnaire once per year at no charge.
3. 03Atlassian's assurance. Because all processing happens on Atlassian infrastructure, the relevant infrastructure controls are evidenced by Atlassian's own certifications and SOC 2 reporting, available from Atlassian's trust centre. Soverain cannot audit Atlassian on your behalf and does not claim its certifications as its own.
4. 04On-site inspection. Available on reasonable written notice, not more than once per year except after a personal data breach, during business hours, subject to confidentiality, and without disrupting operations. You bear the cost unless the audit reveals a material breach of this DPA.

11. International transfers

Soverain does not transfer Customer Personal Data outside the EEA. The data remains in your Atlassian environment, subject to your data residency configuration.

Where Atlassian, as sub-processor, transfers data internationally as part of operating its platform, those transfers are governed by Atlassian's own transfer mechanisms, including the European Commission's Standard Contractual Clauses. Those are Atlassian's documents to maintain and revise: the data processing addendum and transfer terms in force at any time are the ones Atlassian publishes in its trust centre, and we point you there rather than reproduce a copy here that would quietly go out of date.

If a future transfer by Soverain becomes necessary, we will implement a valid Chapter V transfer mechanism and update this DPA under §13.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the agreement governing your use of the Products — for Marketplace customers, the end user agreement elected on the Atlassian Marketplace listing. Nothing in this DPA limits liability that cannot lawfully be limited, including a data subject's rights under Article 82 GDPR.

13. Changes to this DPA

Soverain may update this DPA to reflect changes in law, sub-processors or product architecture. Material changes take effect 30 days after we publish them and notify your registered contact. The version number and date at the top always identify the current version.

14. Order of precedence

If this DPA conflicts with any other agreement between you and Soverain on the subject of processing personal data, this DPA prevails to the extent of the conflict.

Annex 1 — Description of the processing

(Required by Article 28(3))

Subject matter. Provision of Soverain's software products to the Customer.

Duration. For as long as the Customer uses the Products, plus the deletion periods in §9.

Nature of the processing. Collection, structuring, storage, retrieval, display, calculation, transmission within the Customer's own Atlassian environment, and erasure — all performed by software running on Atlassian-hosted infrastructure inside the Customer's installation, without human access by Soverain.

Purpose. Delivering the functionality the Customer configured: project boards, timelines, backlog and sprint management, reporting and analytics, workflow automation, service-level tracking, cross-board dependency tracking, and team retrospectives.

For OnTask: ranking each user's own assigned issues, running their work clock, writing the worklogs they confirm, and showing a user the time logged in Jira by the colleagues they select, with the views they save. OnTask's Team tab is on for every site, and any user with OnTask can open it. Viewing colleagues' logged time is a workplace monitoring use; under §2 the Customer needs a lawful basis for it and must inform its staff where the law requires it.

Categories of data subjects.

• The Customer's employees, contractors and other Jira users;
• individuals named or described in the Customer's Jira content;
• the Customer's nominated technical and billing contacts (note: in relation to those contacts Soverain acts as controller, not processor — see the Privacy Policy).

Categories of personal data.

A field-level inventory is in the App Data Annex.

Special category data (Art. 9) and criminal offence data (Art. 10). Soverain does not request, require or intentionally process any special category or criminal offence data. The Products contain free-text fields — notably retrospective boards — into which a Customer's users could enter such data. The Customer, as controller, is responsible for governing what its users enter.

Sub-processors. Atlassian only. See §6.

Frequency. Continuous, for as long as the Products are installed.

Annex 2 — Technical and organisational measures

(Article 32 GDPR)

Fuller detail is in the Security Statement.

Architecture — the primary control. Products run exclusively on Atlassian-hosted compute and storage. Soverain operates no servers, no databases and no data stores. Kanban+ and OnTask each declare no external network permissions and make no outbound requests, so there is no code path by which Customer Personal Data can leave the Atlassian environment; OnTask declares no remote host and uses no content delivery network, and even its typefaces are bundled with the app rather than fetched from a font service. OnTask's Team tab is computed where it is displayed: the worklogs it reads are added up in the viewer's browser, recomputed on every load and discarded, and nothing the Team tab reads about anyone's time is written to storage. Data inherits the Customer's Atlassian data residency configuration.

Confidentiality. Access limited to personnel who need it. Confidentiality obligations on all personnel. No Soverain administrative interface exists that could read Customer Personal Data from outside the Customer's own Jira instance. Within OnTask, no user is shown another user's own OnTask records — their ranking and the score behind it, their clock, their session history, the summaries they wrote about their own work, their preferences or their saved views. The Team tab reads Jira worklogs instead, and never the comment text on a worklog, which may hold the summary a colleague typed. Multi-factor authentication on the Atlassian developer and Marketplace partner accounts. No third-party API credentials are stored by the Products.

Integrity. Authorisation checks in the app enforce Jira permissions, and destructive controls ask for an explicit confirmation before they run. Erasing every record an app holds for a site requires Jira site-administrator rights, checked on the server. Deleting a Kanban+ board requires board-administrator or site-administrator rights, and cascades to that board's dependent records. A user erasing their own OnTask data needs no rights beyond their own account: the only records of other people it reaches are the saved views naming them, and all it does there is take that person out. Every Jira call OnTask's Team tab makes is made as the signed-in viewer, through Forge's browser-side Jira bridge, and it makes no call as the app, so Jira's own permissions decide whose time a viewer can see and the tab shows nothing Jira does not already show that viewer. There is no manager role and no privileged view: everyone who can use OnTask sees the same Team tab, and nobody obtains a view of a person that the person's own colleagues could not open as well. Board records are revision-counted to detect conflicting concurrent writes. A save that would put a person back into a saved Team view after their erasure took them out of it is refused and the view reloaded. Data in transit is protected by TLS as provided by the Atlassian platform.

Availability and resilience. Provided by the Atlassian Forge platform, including backup and disaster recovery of Forge hosted storage. Soverain adds no infrastructure and therefore no additional single point of failure.

Testing and evaluation. Before every production deploy the automated test suite, ESLint with its security plugin, a Semgrep static-analysis scan, a production dependency audit and a full frontend build are run locally, and all of them must pass; a software bill of materials is regenerated and committed at the same time. Pull requests are required for production changes, and we say plainly that this is our own rule rather than a platform control: our repository plan offers no branch protection to enforce it. Dependency alerts are enabled on every repository and are triaged as they arrive, and the same scans are re-run and recorded quarterly. There is no continuous integration server — the checks run on the developer workstation before a deploy, not automatically after a push, and we would rather say so than imply coverage we do not have. Every release is reviewed against Atlassian Marketplace security requirements, and each Forge app carries a written OWASP Top 10 review.

Data minimisation. The Products persist configuration and derived scheduling data rather than copying Jira content. Jira data is read, rendered in the user's browser and discarded. Documented exceptions and one known minimisation gap are disclosed in the App Data Annex.

Retention. Automated retention enforced in the product: analytics snapshots 365 days; alert cooldown markers 48 hours; audit log capped at 100 entries per board. Deleting a board cascades to its dependent records. In OnTask, session history is kept 12 months and the records that prevent a duplicate worklog 30 days. Saved Team views are visible only to the person who saved them, are capped at 20 views a person and 50 people a view, and are not aged out — a view is kept until its owner deletes it, until the owner's data is erased, or until a site administrator erases everyone's. Besides those views, the Team tab adds only which saved view a person had open, stored with their preferences, and — where taking an erased person out of colleagues' views could not be finished at the time — a note for the daily job to finish it. A person whose data is erased is taken out of every saved view, and a view left with nobody in it is deleted.

Related: Privacy Policy · App Data Annex · Security Statement