Vesper Data Processing Addendum

Effective date: 23 August 2026
Last updated: 23 August 2026

This Data Processing Addendum (the DPA) supplements the agreement governing a customer's use of the Vesper Forge app, including the Vesper end-user agreement and the applicable Atlassian Marketplace Order (the Agreement). It addresses processor-contract requirements that apply when Vesper processes personal data on a customer's behalf.

1. Parties and effective date

Customer: The person or organisation identified as the customer in the applicable Atlassian Marketplace Order or other written Agreement.

Provider: Abhay Bharadwaj, an individual developer operating Vesper, based in Bengaluru, Karnataka, India. Privacy and legal contact: contact@vesperfocus.com. The Provider's postal notice address will be the address stated in the Marketplace listing or Order.

This DPA becomes effective when the Customer accepts an Agreement that incorporates this DPA, and continues while the Provider processes Customer Personal Data.

2. Definitions and scope

Applicable Data Protection Law means privacy and data-protection law applicable to the processing under the Agreement, including, where applicable:

the EU General Data Protection Regulation 2016/679 (EU GDPR);
the EU GDPR as incorporated into EEA law;
the UK GDPR and Data Protection Act 2018 (UK Data Protection Law);
the Swiss Federal Act on Data Protection (Swiss FADP);
India's Digital Personal Data Protection Act, 2023 and rules made under it (India DPDP Law); and
United States state privacy laws that apply to a Customer's use of Vesper.

Customer Personal Data means personal data contained in Jira data or support material that the Provider processes on the Customer's behalf through Vesper. It does not include information for which the Provider independently determines the purposes and means of processing, such as the Provider's direct business, legal, security, or Marketplace-administration records.

The terms Controller, Processor, Data Subject, Personal Data, Process, and Security Incident have the meanings given by Applicable Data Protection Law. Under India DPDP Law, references to Controller and Data Subject include Data Fiduciary and Data Principal respectively.

If the Customer acts as a Processor for another Controller, Vesper acts as the Customer's Sub-processor, the Customer confirms that it has authority to issue the instructions in this DPA, and references to Customer instructions include the relevant Controller's instructions passed through the Customer.

3. Roles and instructions

The Customer is the Controller of Customer Personal Data and the Provider is its Processor. The Customer instructs the Provider to process Customer Personal Data only as necessary to:

provide the Vesper functionality selected and configured by the Customer;
maintain, secure, troubleshoot, and support Vesper;
comply with the Agreement and Applicable Data Protection Law; and
carry out other documented instructions agreed in writing by both parties.

The Agreement, the Customer's Jira and Vesper configuration, and the Customer's authorised use of Vesper constitute documented instructions. The Provider will notify the Customer if, in the Provider's reasonable opinion, an instruction infringes Applicable Data Protection Law, unless the Provider is legally prohibited from doing so. The Provider may suspend the affected processing while the parties resolve that instruction.

The Customer is responsible for the lawfulness, accuracy, and quality of Customer Personal Data and for providing all required notices and obtaining all required rights or legal bases. The Customer must configure Jira permissions so that each user may access only the Customer Personal Data they are authorised to see.

4. Confidentiality and access

The Provider will ensure that each person authorised by it to process Customer Personal Data is bound by an appropriate duty of confidentiality and accesses the data only where necessary to perform the Agreement. The Provider will not disclose Customer Personal Data to another person except as permitted by this DPA, instructed by the Customer, or required by law.

5. Security

Taking into account the nature of processing, available technology, cost of implementation, and risk to individuals, the Provider will maintain appropriate technical and organisational measures described in Annex 2. The Provider may update those measures as Vesper and Forge change, provided the overall protection is not materially reduced during an active subscription.

The Customer acknowledges that Vesper is a Forge app and that security is a shared responsibility among the Customer, the Provider, and Atlassian. The Customer remains responsible for its Jira site, users, permissions, configuration, endpoints, and credentials.

6. Security incidents

The Provider will notify the Customer without undue delay and, where feasible, within 72 hours after becoming aware of a confirmed Security Incident affecting Customer Personal Data. The notice will include information then reasonably available concerning:

the nature and known scope of the incident;
the categories of affected data and people;
likely consequences;
containment, mitigation, and remediation measures; and
a contact for follow-up questions.

The Provider will provide reasonable updates and assistance needed for the Customer to satisfy its notification duties. Notification is not an admission of fault or liability. The Customer is responsible for deciding whether it must notify regulators, Data Subjects, or other parties unless the Provider has a separate direct legal obligation.

7. Data-subject requests and compliance assistance

Taking into account the nature of Vesper's processing, the Provider will provide reasonable assistance for requests concerning access, correction, erasure, restriction, objection, portability, or other rights under Applicable Data Protection Law.

If the Provider receives a request concerning Customer Personal Data directly from a Data Subject, it will ordinarily direct the requester to the Customer or notify the Customer and will not independently fulfil the request unless the Customer instructs it to do so or law requires otherwise.

The Provider will provide reasonable information and assistance for the Customer's data-protection impact assessments, regulator consultations, and compliance inquiries, taking into account the information available to the Provider. Assistance that requires exceptional engineering or professional services may be subject to reasonable fees agreed in advance, unless the need for assistance arose from the Provider's breach of this DPA.

8. Sub-processors

The Customer grants general written authorisation for the Provider to use the Sub-processors listed in Annex 3. Atlassian provides Forge compute, hosted storage, app delivery, and related platform services and is Vesper's current Sub-processor.

The Provider will impose materially equivalent data-protection obligations on each Sub-processor to the extent required by Applicable Data Protection Law and will remain responsible for the Sub-processor's performance to the extent required by that law and the Agreement.

The Provider will give at least 30 days' advance notice before appointing or replacing a direct Sub-processor that will process Customer Personal Data, where reasonably practicable. Atlassian's own downstream Sub-processors and change-notification mechanism are maintained on Atlassian's published Sub-processor page under the Forge Data Processing Addendum.

The Customer may object during the notice period on reasonable data-protection grounds. The parties will work in good faith on a reasonable solution. If no solution is available, either party may terminate the affected Vesper Order, and the Customer's exclusive remedy will be any refund required by the Agreement or mandatory law.

9. International transfers

Customer Personal Data is processed using Atlassian Forge. Its processing and storage locations are governed by Atlassian's Forge data-residency, Sub-processor, and transfer terms. The Provider will not independently transfer Customer Personal Data outside Forge unless the Customer instructs it or the parties agree appropriate safeguards in writing.

Where use of Vesper results in a Restricted Transfer, the applicable terms in Section 13 will apply. If a regulator or law requires another valid transfer mechanism, the parties will cooperate in good faith to implement it.

10. Return, deletion, and retention

During the Agreement, the Provider will delete or correct Customer Personal Data on the Customer's documented instruction unless retention is required by law. On uninstall or termination, Vesper's normal Forge pre-uninstall process requests deletion of its installation-scoped and account-scoped app storage.

Vesper's implemented retention schedule is:

complete Jira issue, comment, and sprint snapshots are not persisted in Vesper's Forge storage;
cleared work-queue entries expire after 14 days;
daily stand-up cleared state expires at the end of the configured business day;
cleared state is capped at 400 entries per Atlassian account;
manual role-change audit history is capped at 20 events, including no more than 50 sampled affected accounts per event;
each user's My Work baseline replaces the preceding baseline when that user next opens the page; and
configuration, current persona assignments, bounded audit history, commit metadata, and portfolio baselines remain until replaced, deleted, or the app is uninstalled.

Deletion from active Vesper storage does not necessarily remove data from Atlassian's disaster-recovery or recoverable platform copies immediately. Atlassian's documented Forge recovery period applies, currently up to 28 days after uninstall, unless law requires longer retention.

11. Information and audits

On reasonable written request, no more than once in a 12-month period unless a Security Incident or regulator requires otherwise, the Provider will provide information reasonably necessary to demonstrate compliance with this DPA.

The Customer must first use current documentation, certifications, and audit reports made available by the Provider or Atlassian. If those are insufficient, the parties may agree a proportionate remote audit that avoids compromising other customers, security, confidential information, or Atlassian systems. The Customer bears its audit costs unless the audit identifies a material breach by the Provider. No Customer audit grants a right to inspect Atlassian facilities or systems.

12. Government requests

Unless prohibited by law, the Provider will notify the Customer before disclosing Customer Personal Data in response to a legally binding government or law-enforcement demand. The Provider will review the demand for validity, challenge it where reasonable grounds exist, and disclose only the data legally required.

13. Region-specific terms

These terms apply only to processing governed by the stated law. They prevail over conflicting provisions of the main DPA for that processing.

13.1 European Economic Area

The Provider will comply with processor obligations under Article 28 of the EU GDPR. For a transfer of Customer Personal Data protected by the EU GDPR to the Provider in India that is not otherwise covered by an adequacy decision or another lawful transfer mechanism, the parties enter into the European Commission Standard Contractual Clauses adopted by Decision (EU) 2021/914 (EU SCCs), incorporated by reference without modification as follows:

Module Two (Controller to Processor) applies when Customer is a Controller;
Module Three (Processor to Processor) applies when Customer is a Processor;
Clause 7 (docking) applies;
Clause 9 uses Option 2, general written authorisation, with the notice period in Section 8;
the optional language in Clause 11 does not apply;
in Clause 17, Option 1 applies and the governing law is Ireland;
under Clause 18, disputes will be resolved by the courts of Ireland;
the competent supervisory authority under Clause 13 is determined by the data exporter's establishment or representative; otherwise it is the Irish Data Protection Commission; and
Annexes 1, 2, and 3 of this DPA complete Annexes I, II, and III of the EU SCCs respectively.

Nothing in this DPA varies or contradicts the EU SCCs. If the EU SCCs conflict with another provision, the EU SCCs control for the Restricted Transfer.

13.2 United Kingdom

For a Restricted Transfer governed by UK Data Protection Law, the parties incorporate the UK Information Commissioner's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0 in force 21 March 2022 (UK Addendum), as revised under its mandatory terms:

Table 1 is completed by the party information in Section 1 and Annex 1;
Table 2 selects the EU SCC modules and options stated in Section 13.1;
Table 3 is completed by Annexes 1, 2, and 3;
for Table 4, neither party may end the UK Addendum solely because the ICO issues a revised approved addendum; and
the laws and courts selected by the mandatory UK Addendum are the laws and courts of England and Wales, and the competent regulator is the UK Information Commissioner's Office.

If the UK Addendum conflicts with another provision, its mandatory clauses control for the Restricted Transfer.

13.3 Switzerland

For Customer Personal Data protected by the Swiss FADP, references in the EU SCCs to the EU GDPR include the Swiss FADP where applicable; references to a Member State include Switzerland; the competent regulator is the Swiss Federal Data Protection and Information Commissioner; and Data Subjects in Switzerland may enforce their rights in Switzerland. These adaptations apply only to the extent necessary for the EU SCCs to provide an appropriate Swiss transfer safeguard.

13.4 India

Where India DPDP Law applies, the Customer is the Data Fiduciary and may engage the Provider as Data Processor under this DPA. The Provider will process personal data only for the purposes and instructions described here, maintain reasonable security safeguards, assist the Customer with Data Principal requests and breach obligations, and delete data in accordance with Section 10 unless retention is legally required. Transfers outside India remain subject to restrictions notified by the Government of India.

13.5 United States state privacy laws

Where the Provider is a service provider, contractor, or processor under an applicable United States state privacy law, it will:

process Customer Personal Data only for the limited business purposes in the Agreement and this DPA;
not sell or share Customer Personal Data, including for cross-context behavioural advertising;
not retain, use, or disclose Customer Personal Data outside the direct business relationship except as permitted by applicable law;
not combine it with personal data received from another person or collected from the Provider's own interaction with an individual except where legally permitted to provide the service;
notify the Customer if it determines it can no longer meet these obligations; and
allow the Customer to take reasonable and appropriate steps to stop and remediate unauthorised use.

14. Liability and order of precedence

The liability provisions and limitations in the Agreement apply to this DPA to the fullest extent permitted by law. Mandatory rights under Applicable Data Protection Law and the EU SCCs or UK Addendum are not limited by this Section.

For data-protection matters, the order of precedence is: (1) mandatory transfer terms in Section 13; (2) the remainder of this DPA; and (3) the Agreement.

15. Changes

The Provider may update this DPA to reflect changes in law, Forge, or Vesper, provided an update does not materially reduce protection of Customer Personal Data during an active paid subscription. Material changes will be announced through the Marketplace listing, the Vesper website, or another reasonable customer communication channel before they take effect where practicable.

Annex 1 — Description of processing

A. Parties

Data exporter: The Customer identified in the Marketplace Order or Agreement. The Customer is a Controller or Processor, as described in Section 2. Its contact is the contact stated in that Order or Agreement.

Data importer: Abhay Bharadwaj, operating Vesper, Bengaluru, Karnataka, India; contact@vesperfocus.com. The Provider acts as Processor or Sub-processor.

The parties' acceptance of the Agreement incorporating this DPA constitutes signature of the applicable transfer terms to the extent electronic acceptance is permitted by law.

B. Processing details

Subject matter: Operation, maintenance, security, and support of the Vesper Forge app for Jira Cloud.

Duration: For the active Agreement and the limited deletion and recovery period described in Section 10.

Nature and purpose: Reading Jira data available to an invoking user; analysing it deterministically to generate role-aware delivery views; storing limited configuration, persona, audit, queue, and baseline state; securing and supporting the app; and deleting stored state in accordance with Customer instructions and the retention schedule.

Frequency: Continuous or intermittent according to authorised users' use of Vesper, scheduled or lifecycle operations, configuration changes, and support requests.

Data Subjects: Customer employees, workers, contractors, Jira users, Jira administrators, project participants, issue reporters, assignees, commenters, and individuals identified in Jira work records or support material.

Categories of Customer Personal Data:

Atlassian account IDs, display names, group membership, application roles, and permissions;
Jira project, board, sprint, release, and issue data, including issue keys, summaries, types, priorities, statuses, hierarchy, links, labels, mapped custom fields, assignees, reporters, due dates, versions, and timestamps;
Jira comments and comment-author information when the Customer enables comment evidence;
attachment and linked-resource metadata, but not persisted attachment contents;
Vesper persona assignments, administrator identifiers and names, and bounded role-change audit information;
user-scoped cleared-queue identifiers and timestamps, assigned issue-key baselines, and previously seen mention identifiers; and
personal data voluntarily included in a support request.

Sensitive data: Vesper does not require special-category, sensitive, or criminal-offence data. Because Jira fields and comments are controlled by the Customer, such data may be processed if the Customer or its users place it in Jira. The Customer instructs Vesper to process any such data only as necessary to provide the selected app functionality and must apply appropriate Jira permissions and lawful bases.

Storage period: As described in Section 10.

Purpose of transfer: Provision and support of Vesper using Atlassian Forge.

Data Subject contact: Requests should ordinarily be directed to the Customer. Vesper's privacy contact is contact@vesperfocus.com.

Annex 2 — Technical and organisational measures

Vesper's current measures include:

Atlassian-hosted Forge compute, static resources, and hosted app storage;
no Vesper-operated external production database and no external egress declared in the Forge manifest;
Jira reads performed in the invoking user's context and constrained by that user's Jira permissions;
granular, read-oriented Jira scopes and no Jira data-write scope;
Forge installation-scoped storage isolation and account-ID checks before serving account-scoped state;
administrator checks for configuration and manual persona management;
data minimisation, bounded records, automatic expiry, replacement, and pre-uninstall deletion controls described in Section 10;
no transmission of Jira content to an LLM, advertising network, or external analytics service;
source control, automated tests, type checking, production builds, Forge linting, and development-environment deployment checks for code changes;
secrets and authentication handled through Atlassian rather than collecting Atlassian passwords or Jira API tokens from users; and
an incident and privacy contact at contact@vesperfocus.com.

These measures rely in part on Atlassian's Forge platform controls and shared responsibility model. Customer-specific Jira access control remains the Customer's responsibility.

Annex 3 — Sub-processors

Sub-processor	Location	Processing	Safeguards
Atlassian Pty Ltd and relevant Atlassian affiliates	Locations described in Atlassian's Forge data-residency and transfer documentation	Forge compute, hosted storage, app delivery, platform security, and related developer services	Forge Terms, Forge Data Processing Addendum, incorporated transfer provisions, and Atlassian's published security measures
Cloudflare, Inc.	Locations described in Cloudflare's data-processing terms	DNS and inbound email routing for contact@vesperfocus.com	Cloudflare data-processing terms and security measures
Microsoft Corporation and relevant affiliates	Locations determined by the Provider's Microsoft 365 tenant configuration and Microsoft's data-residency terms	Destination mailbox used to receive, retain, secure, and respond to customer support, privacy, security, and legal correspondence	Microsoft Products and Services Data Protection Addendum and published security measures

Atlassian's current downstream Sub-processors, processing locations, and notification subscription are published at https://www.atlassian.com/legal/sub-processors. Atlassian's Forge Data Processing Addendum is published at https://developer.atlassian.com/platform/forge/resources/Forge-Data-Processing-Addendum.pdf.