VeloWiseengineering delivery intelligence

Data Processing Addendum

Last updated:

This addendum applies when an organization (the “Customer”) stores personal information in VeloWise. It forms part of the Terms of Service between the Customer and the operator of this deployment (the “Processor”).

1. Roles and scope

For personal information in delivery data that the Customer stores in its organization (“Customer Personal Data”), the Customer is the controller and the Processor is its processor under Article 28 of the EU and UK GDPR, and its service provider under the California Consumer Privacy Act (CCPA). This addendum does not cover data the Processor handles as a controller, such as account, billing and website analytics data; the privacy policy covers that.

2. Details of the processing

  • Subject matter and purpose: storing and analyzing the Customer’s engineering delivery data to provide VeloWise to the Customer.
  • Nature: storage, retrieval, calculation of delivery metrics, display to authorized members, sharing of aggregate report snapshots on the Customer’s instruction, and deletion.
  • Duration: until the Customer deletes the data or the organization, or this addendum ends.
  • Data subjects: the Customer’s staff and contractors whose names or work appear in delivery data, and the Customer’s members.
  • Types of data: names of assignees and other people in imported fields, issue keys, summaries, descriptions, sprint names, status history, original CSV row values and calculated findings. No special categories of data are needed, and the Customer should not import them.

3. Processor obligations

The Processor will:

  • process Customer Personal Data only on the Customer’s documented instructions, which are these terms and the Customer’s use of VeloWise, unless the law requires otherwise, in which case it will tell the Customer first where the law allows;
  • ensure that people authorized to process Customer Personal Data are bound by confidentiality;
  • apply the technical and organizational measures in section 9;
  • use subprocessors only as described in section 4;
  • help the Customer, taking into account the nature of the processing, to respond to data subject requests, and with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR;
  • delete or return Customer Personal Data at the end of the service as described in section 6;
  • make available the information needed to demonstrate compliance, as described in section 7, and tell the Customer if it believes an instruction breaks data protection law.

4. Subprocessors

The Customer gives general authorization to the subprocessors listed on the subprocessors page. The Processor will update that page before a new subprocessor processes Customer Personal Data. The Customer may object on reasonable data protection grounds by contacting the operator of this deployment; if the parties cannot resolve the objection, the Customer may stop using the affected service and delete its organization. The Processor imposes data protection obligations on each subprocessor that are no less protective than this addendum and remains responsible for its subprocessors.

5. Personal data breaches

The Processor will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information may be provided in phases as it becomes available.

6. Deletion and return

Owners and admins can delete imports and projects at any time, and owners can delete the organization, which deletes its Customer Personal Data from the live database. When the service ends, the Processor deletes remaining Customer Personal Data from live systems. On request before deletion, the Processor will return Customer Personal Data it still holds in a machine-readable format. Copies in provider backups are removed when those backups expire, unless the law requires them to be kept.

7. Audits

The Processor demonstrates compliance through documentation: this addendum, the security page, the data handling page and written answers to reasonable security questionnaires. Where that documentation is not enough to meet a legal requirement, or a supervisory authority requires it, the parties will agree on the scope, timing and cost of a further audit.

8. International transfers

Where Customer Personal Data is transferred from the EU or EEA to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, Module 2 (controller to processor), apply and are incorporated by reference. For UK data, the UK International Data Transfer Addendum applies. Where a subprocessor is certified under the EU-US Data Privacy Framework or its UK Extension, transfers to it may rely on that certification.

9. Technical and organizational measures

  • Organization isolation enforced by database row-level security on every organization table, with automated tests that try to cross organization boundaries.
  • Role-based access for owners, admins, members and viewers.
  • Browsers hold only the low-privilege public database key; privileged keys stay server-side.
  • Jira OAuth tokens encrypted with AES-256-GCM in a private table browser roles cannot read; read-only Jira scopes.
  • Shared report links and access codes stored only as hashes; shared reports contain aggregates, not individual issues.
  • Support staff use multi-factor authentication, have no database access to Customer Personal Data, and their actions are recorded in an audit log kept for 2 years.
  • No processing of Customer Personal Data by AI or large language model services.

10. CCPA service provider terms

For personal information subject to the CCPA, the Processor:

  • will not sell or share it, including for cross-context behavioral advertising;
  • will not retain, use or disclose it for any purpose other than providing VeloWise to the Customer, or outside the direct business relationship with the Customer;
  • will not combine it with personal information from other sources, except as the CCPA permits;
  • will comply with the CCPA, provide the same level of privacy protection it requires, and notify the Customer if it can no longer meet these obligations;
  • allows the Customer to take reasonable steps to stop and remediate unauthorized use of the information.

11. Order of precedence

If this addendum conflicts with the Terms of Service on the processing of Customer Personal Data, this addendum applies. If it conflicts with the Standard Contractual Clauses, the Clauses apply. Questions or a request for a signed copy: the operator of this deployment.