Data processing agreement

Effective 15 September 2026. This agreement forms part of the terms of service for every app published on the Atlassian Marketplace by Two Little Moons Consulting (ABN 49 732 400 198, Australia), referred to as "we", "us" or "the processor". It applies automatically to any customer whose use of an app involves personal data, without needing to be signed. If you need a countersigned copy for your records, email support@twolittlemoons.com and we will return one.

It is written in plain language on purpose. The apps are small, they run inside Atlassian, and the honest description of what they do with data fits on one page.

1. Roles

You are the controller of the personal data in your Jira site. We are a processor, and only in the narrow sense that an app we publish processes that data inside your Atlassian installation on your instructions. Under the California Consumer Privacy Act we are a service provider on the same terms.

We never become a controller of your data. We do not decide what to collect, we do not use it for our own purposes, and we hold no copy of it.

2. What is processed, and why

Each app processes only the Jira data its feature needs, itemised per app in the privacy policy. In general terms:

• Categories of data: Jira work items and their fields, comments, worklogs, sprints and versions; and for the people involved, their Atlassian account ID, display name and timezone. Where an app records an approval, it also records who approved and when.
• Categories of people: users of your Jira site, and anyone named in a work item.
• Purpose: to provide the feature you installed the app for — timesheets, reports, checklists, notifications, gadgets, Git links, templates, status timing, approvals — and nothing else.
• Duration: for as long as the app is installed on your site. Uninstalling it deletes its Forge storage.
• Special categories of data are not requested by any app. If you put such data in a Jira field, an app will handle it like any other field; please do not use the apps for it.

3. Our obligations

We will:

• process personal data only as needed to provide the app, and only within your Atlassian site — never on infrastructure of our own, because we have none;
• keep the app's Atlassian scopes to the minimum its features need, and state each one on the listing;
• apply the technical and organisational measures described on the security page, and maintain them for as long as the app is listed;
• ensure that the one person who maintains the apps is bound to confidentiality and has no standing access to any customer's data;
• help you respond to a data subject's request, to the extent an app is involved, within 10 business days of your asking;
• notify you without undue delay, and in any case within 72 hours of becoming aware, of any personal data breach involving an app, with what happened, what was affected and what we are doing about it;
• delete the app's stored data when you uninstall it, which Atlassian performs automatically, and confirm this on request;
• make available on request the information needed to demonstrate compliance with this agreement, and allow an audit on reasonable notice, at your cost, no more than once a year unless a breach has occurred.

4. Sub-processors

We have one sub-processor for every app, and it is the one you already chose:

Two apps can transmit data to a further service, in each case only to an account you hold and configure, so that service is your own processor rather than our sub-processor:

• Mailpost for Jira — outbound email through your Postmark account, only if you switch it on and supply your own key.
• Git Links for Jira — your Git hosting provider, only once you connect it and, for a self-managed host, approve the destination in Atlassian's consent dialog.

We will not add a sub-processor without updating this page and the affected app's release notes at least 30 days before it takes effect, and you may object by uninstalling the app before then.

5. International transfers

Nine of the eleven apps transfer no data anywhere. They run inside Atlassian's platform, and data residency follows your Atlassian site under Atlassian's own arrangements. For those apps there is no transfer for us to make and no transfer mechanism for us to provide.

For Mailpost and Git Links, data goes only to a service you have chosen and hold your own agreement with. Where that service is outside your jurisdiction, the transfer is made under your relationship with that service, not ours. We do not offer Standard Contractual Clauses of our own, because we are not the party making the transfer.

6. Your obligations

You are responsible for having a lawful basis for the personal data in your Jira site, for the instructions you give an app through its configuration, and for your own agreements with Atlassian and any provider you connect. If an instruction would, in our view, breach data protection law, we will tell you.

7. Liability and term

Liability under this agreement is subject to the limits in the terms of service. This agreement lasts as long as an app is installed on your site and ends automatically when it is removed, except for obligations that by their nature survive, such as confidentiality.

8. Governing law

This agreement is governed by the laws of New South Wales, Australia. Where the General Data Protection Regulation or the UK GDPR applies to your processing, this agreement is intended to satisfy Article 28(3) and should be read accordingly.

Changes

We will update this page and its effective date if what the apps do with data changes. A new sub-processor or a new category of stored data is announced in the app's release notes first.