RGBIQ Release Views for Jira · Version 1 · Prepared October 25, 2026

Data Processing Addendum

This details schedule incorporates the unchanged Bonterms Data Protection Addendum Version 2.0 (Attachment Version), including its Exhibits A and B, into the Main Agreement when that Agreement expressly incorporates this DPA. Defined terms have the meanings in that standard or the Main Agreement. This schedule supplies the Key Terms and Processing Details; no other Additional Terms are specified.

Key Term	Detail
Provider / data importer	RGB Brands LLC DBA RGBIQ. 12404 Kelly Place, Thonotosassa, FL 33592, United States. Contact: support@rgbiq.com. Activities: operating RGBIQ Release Views for Jira and related support. Role: Processor, or subprocessor where Customer is a Processor.
Customer / data exporter	The legal entity entering the applicable Marketplace Order. Its address and data-protection/administrative contact are those supplied in the Order or otherwise provided to Provider for the Agreement. Activities: using the service for business reporting and related support. Role: Controller, or Processor for its own controller as applicable. Customer will supply and keep its relevant exporter and contact details current.
Main Agreement	The Bonterms Standard End User Agreement Version 1.0 and Provider-Specific Terms for the applicable Marketplace Order for RGBIQ Release Views for Jira.
DPA Effective Date	The effective date of the Agreement that expressly incorporates this DPA.
Subprocessor List	https://www.rgbiq.com/release-views/legal/subprocessors.html
Designated EU Governing Law	Irish law, where the EU Standard Contractual Clauses apply.
Designated EU Member State	Ireland, where the EU Standard Contractual Clauses apply. The competent supervisory authority is determined under Clause 13 for the relevant exporter and processing circumstances.

Subject matter, purpose and instructions

Provide customer-configured Jira release reporting, saved views and Release Sets, hierarchy and linked-item reports, charts, exports, permissions and related technical support. Customer instructions include authorized installation and use, view and sharing settings, selected fields and filters, refresh/export/cleanup actions and other documented instructions consistent with the service.

Data subjects and personal data

Data subjects include authorized Jira users, Customer employees and contractors, and other individuals whose information appears in Customer-selected Jira fields or technical support evidence. Personal data may include account IDs and visible profile information; release and work-item information, selected custom fields, relationships, estimates, status, approvals and available development summaries; saved view names/JQL/settings, ownership/sharing references and personal layouts; temporary report data; and technical support correspondence and attachments.

Customer-selected text and fields may contain sensitive information. The service is not intended for prohibited sensitive information under the Main Agreement. Customer should avoid unnecessary sensitive data and credentials. Any intended special-category processing requires separate assessment and documented safeguards.

Nature, frequency and duration

The service reads, retrieves, structures, calculates, caches, displays, exports and erases app-controlled data in response to authorized use. Privacy maintenance also runs periodically. Processing recurs during the service term and continues as necessary for the return/deletion and permitted retention provisions of the standard DPA.

Processing locations and recipients

Jira reports operate in Atlassian services and the user’s browser. Persistent in-scope Forge storage follows the host Jira site’s supported residency. The app does not automatically send Jira report data to a separate RGBIQ server. Christian Brown provides authorized RGBIQ support and administration from the United States. Optional website/email support uses the providers identified in the Subprocessor List. Provider operations and support may involve international processing; hosting residency is not an EEA-only processing commitment.

Retention, return and deletion

Cached ticket bodies expire from app reuse after 24 hours and request storage expiry. Saved views, Release Sets, settings and necessary ownership/sharing/privacy references remain while needed for the installation. Views in Trash have no automatic expiry. Browser preferences remain until replaced or cleared.

Users can export report data to CSV. Additional app-controlled data return or deletion requests are handled with an authenticated Customer administrator. Label cleanup retains necessary permission/privacy references and does not anonymize every saved field. Native Jira data remains under Customer’s control. On termination or a valid request, the standard DPA’s return/deletion provisions apply, including its lawful-retention limits.

Optional support database messages request expiry after 90 days, rate counters after two hours and support diagnostic logs after 14 days. Mailbox copies are managed separately while needed. Platform recovery copies and disposal follow applicable upstream terms; application-level cleanup does not promise instantaneous physical removal from every recovery copy.

Technical and organizational security measures

The app uses signed-in-user Jira reads, installation-scoped Forge storage and server-side saved-view authorization. Sharing a view does not broaden native Jira permissions. Cached user objects minimize raw profile details; report caches are bounded; logging is designed to exclude ticket bodies and raw profiles. Privacy reporting/cleanup and administrative cache/label controls support data-request handling, including when the app license is inactive.

The support service uses private encrypted storage and a role limited to its own service resources and notification purpose. Upstream platforms provide their contracted security measures. RGBIQ’s founder handles security/privacy requests, failure alerts, access review and incident coordination. RGBIQ limits access to authorized personnel and maintains procedures for authenticated data requests, incident response and provider-change notices.

No independent RGBIQ SOC 2/ISO certification, bug-bounty participation or human penetration-test certification is asserted. Applicable platform assurance evidence and available implementation/testing information can be provided through the standard DPA’s assurance process.

International transfers

The applicable modules and UK/Swiss adaptations are those specified in the incorporated standard, according to the parties’ roles and the actual transfer. The processing details above identify the importer, categories, purposes and measures. Exporter details are supplied through the applicable Order or separately to Provider. Irish SCC law/courts do not change the Main Agreement’s governing law/courts or automatically determine every exporter’s supervisory authority.