What is it?

As per google:

On 25 May 2018, the most significant piece of European data protection legislation to be introduced in 20 years will come into force. The EU General Data Protection Regulation (GDPR) replaces the 1995 EU Data Protection Directive. The GDPR strengthens the rights that individuals have regarding personal data relating to them and seeks to unify data protection laws across Europe, regardless of where that data is processed.

Data Protection after 31 DEC 2020

• https://www.legislation.gov.uk/uksi/2019/419/introduction/made

• https://www.itgovernance.co.uk/eu-gdpr-uk-dpa-2018-uk-gdpr

For purposes of simplicity, references to GDPR will, after 31 DEC 2020 mean UK GDPR.

Definitions

GDPR terms : https://gdpr-info.eu/art-4-gdpr/

The Plugin People Ltd :"We", "Us", "The Company"

Enterprise Mail Handler for Jira (DC) : JEMH

Enterprise Mail Handler for Jira (Cloud) : JEMHC

Personally Identifying Information : PII

Sub Pages

Introduction

What follows is a variation on the topics covered in the Atlassian Privacy & GDPR section on their licensing page.  Related to this is our Data security & privacy statement, GDPR affects Us in the following main areas:

Billing

PII data obtained through billing would only be used by us, in relation to the service(s) the customer has purchased from us.  We track and record name/email address of all customers making purchases with us directly, as part of the transaction.  We are legally required to retain history of such transactions for 7years, that includes email traffic, quotes, invoices, purchase orders, in addition to order-related spread sheets.  Where 3rd parties require details of our activities relating to sales (accounting) , personal details are removed.

Cloud

The cloud version of the Enterprise Mail Handler for Jira Cloud (JEMHC) processes email from customer mailboxes and drives issue creation/update in customer Jira instances.

Data Flow Diagram

The following diagram illustrates how data travels to/from JEMHC:

About JEMHC

JEMHC on installation gets the billing contact user email address, we use this to populate the JEMHC > Licensing > System Notifications > Email Addresses field.  This field is CSV, and is maintained by the Jira instance administrator not us.  We do not have functional access to your data to make changes.  We have a back office system that exposes basic system contact details to us.  JEMHC mails out to this list every month a status email summarizing JEMHC usage, if there is any.

JEMHC uses credentials you supply (user/password) in order to retrieve mail from, and send mail through your specified mail servers, we don't use this in any way beyond that scenario.

JEMHC uses tokens you supply for Slack and other services, we don't use these in any way beyond that scenario.

JEMHC can retain copies of incoming and outbound emails, for short-term auditing and fault-finding by the Jira instance administrator.  The Jira instance owner can opt out of this entirely.  We can only gain access to 'inbound' emails when the Jira instance administrator flags such messages for Support, in such cases the senders full email content would be available to us for support purposes.

JEMHC system email notifications are sent through our (Plugin People) mailbox, which tends to retain a copy in 'sent' items.  We don't use this in any way.

JEMHC system statistics are periodically reviewed and sometimes notice particular customers instances having problems in some way (excessive maintenance mail typically).  We do try to proactively reach out to customers directly based on the limited information available.  We don't currently have an opt-in.  Not being able to be proactive because of GDPR seems a bad thing, and is likely to be detrimental to customers usage of JEMHC (e.g. you may consume your Plan Capacity much sooner than you expect, resulting in system not operating as you would like).

JEMHC Database is backed up daily on a rotating schedule, we retain 7days of history.

JEMHC Subscriptions must remain licensed and active to be retained in  our database.  Once lapsed, you'll loose access to JEMHC functionality interactively and through scheduled jobs.  After 30 days JEMHC automatically purges ALL retained data about your instance.  On expiry, JEMHC does nothing to your Jira instance, the data that was sent through JEMHC resides in your Jira instance, and is owned by the instance owner.

JEMHC tracks system throughput, we retain Atlassian host URL references indefinitely, as they form part of aggregated usage over time, no PII is involved.

JEMHC software build validates core data processing functionality through unit tests.  Due to the complexities of email, sometimes we use customer emails that have been made available to us, sometimes the data is left untouched (e.g. sender name and email address).  The data we collect is very limited, and it must be provided by the customer in the first place.  We do not use this data in any other way beyond testing.  The email content, along with our source code, is stored in source control.  Due to source control, it will be retained indefinitely.

The online shop hosted with http://www.e-junkie.com (privacy statement here) and the payment processor https://www.paypal.co.uk/ (privacy statement here) that enables purchasing of Data Packs for JEMHC.  We are copied by email on all Data Pack purchases with transaction details and information from the PayPal user account (including registered name, email, IP). For tax reasons we retain all communications relating to purchases for 7 years.

Operationally, and this is the tricky point.  JEMHC receives email from ANYONE, maybe a Jira registered user, maybe a Portal user, maybe an email user who has never even heard of Jira.  In the latter case, its probably expected by the sender, that their email address would be used to communicate back to them (e.g. a support response), and in order for that to happen, the email address (and possibly name, and additional email recipients) would need to be retained (stored on the issue), but we have no way to request permission to store their data.  This only applies to EU senders but its impossible to accurately determine.

Do We process personal data?

Yes. We process personal data to provide our products and services and for other purposes as outlined in our Privacy Policy.

Can We assist my company with responding to an Individual Rights Request (Subject Access Request)?

Yes, where data is 'owned' by us (part of billing, part of support).  In cases where data is not owned by us we will still help.  Typically data stored by JEMHC will be 'owned' by the customer, for whom we may have limited contact capability.  Data JEMHC 'uses' can also be 'owned' by Atlassian such as the Billing Contact for the subscription to JEMHC.

Where do We store and send customer data?

See Data Residency .

How do We handle onward transfers of data outside of the EU?

This applies to JEMHC only, in a few parts:

• Email: The system sends a variety of email to involved parties, located anywhere.  Messages that aren't processed are forwarded to JEMHC instance admins, any or all could be located outside the EU.  The delivery of such email is done using the onward mail server system that the JEMHC instance administrator has defined, typically secured by SSL.

• Files:  If the JEMHC administrator configures External Storage it is possible for JEMHC to enable Jira users to store attachments in remote cloud storage.  Users with access to the issue can download resources related to that issue through that issue.  Different mechanisms for accessing downloaded resources exist (e.g. "time-limited-validity multi-use links", or streamed content delivery).  Such delivery is always done over an SSL protocol link.

• Logs: JEMHC application generates logs, we can retrieve these remotely, but even in that case, the logs have been obfuscated in terms of PII (email subjects and the vast majority of email addresses are hashed - non happy-path scenarios may show up email addresses to aid diagnosis)

Can I opt out of having customer data collected or shared?

Yes. However, it has an impact. Opting out of data storage means unprocessed emails will be lost. Avoiding data loss is the main reason for implementing our Auditing feature, requiring email retention.

Customer data from emails is used only to deliver the expected app functionality. Customer data is never disclosed to third parties beyond what is necessary to provide the expected app functionality and support for it.

Administrators can opt-out of auditing (support contact needed to re-enable), covering recent events and inbound/outbound traffic in the last 30 days. Raw mail content storage is purged after 30 days (by policy).

When an Issue is created, email addresses are stored in JEMHC auditing tables and the issue (either through the reporter or in a custom field).  When issues are closed out, the reporter/email address remains, the management of the Jira instance is not our responsibility.  JEMHC Instance administrators would routinely retain such information in order to better support the customer by being able to understand prior problems (eg if the issue were to be re-opened, and communication expected to continue).

JEMHC supports a per-issue unsubscribe feature, enabling email users to self-remove themselves on a per-issue basis.  System notifications also have a per-recipient unsubscribe feature.

How do We secure customer data?

Transmission

Billing data is stored in cloud servers, secured by SSL. Access is by named party only. All communication between the application and Jira Cloud is also done over SSL. All outbound SMTP mail can be sent over SSL, but every mail hop beyond can't be guaranteed to be SSL; the same goes in reverse for inbound IMAP/POP3 traffic.

Storage

See Data Storage.

Sub-Processors

Changing or removing your information or to ask for it not to be used

JEMHC lists contact email addresses in the System Notifications section (its CSV), but have left the related company and continue to be notified of JEMHC specific aspects (e.g. usage alerts, monthly status etc).  Such notifications now include an unsubscribe feature, allowing recipients to remove themselves without involving the instance owner (who we may not be able to contact either, due to limited contact details being available).

JEMHC Profiles contain a Forward user email address.  Potentially that user could leave the company and want to be forgotten.  We do not configure customer instances.  Again the same problem we have is that in order to even communicate with the business we need to get more contact information about the Jira instance, than we currently have access too.  Sometimes even the billing contact is a dead end, in such cases, even Atlassian has in the past been unable to help.  We have discussed this with Atlassian and logged it as a scenario affecting us.

You want to move your data from one provider to another

JEMHC Templates, Themes, Profiles, Test Case emails and even recent Audit emails can be exported into their native formats.

GDPR Authorised Representative

For United Kingdom GDPR and the Data Protection Act 2018 is The Plugin People Ltd

For United Kingdom GDPR and the Data Protection Act 2018 is The Plugin People Ltd

Email address: privacy@thepluginpeople.com

Telephone number: +44 1242 802 757

Address: The Plugin People Ltd, Pure Offices, Hatherley Lane, Cheltenham, GL51-6SH, UK

EU Authorised Representative

To comply with (Art. 27 GDPR – Representatives of controllers or processors not established in the Union - General Data Protection Regulation (GDPR) ), we have appointed IT Governance Europe Limited to act as our EU Representative. If you wish to exercise your rights under the EU General Data Protection Regulation (GDPR), or have any queries in relation to your rights or privacy matters generally as applicable to EU customers please email our Representative:

Email: eurep@itgovernance.eu

Address: EU Representative, IT Governance Europe, The Mill Enterprise Hub, Stagreenan, Drogheda,

Co. Louth, A92 CD3D, Ireland.