RDIT PRODUCTS
Data Processing Addendum — RDIT Products
This is the master Addendum, stating the clauses that apply to every RDIT Products app; a given app's specific data categories and retention are in that app's annex, which forms part of this Addendum — currently: Self-Managed Connector for Jira (GitLab™ Compatible), at the annex.
Parties
RDIT Products (sole proprietorship, Netherlands, KvK 42143705, Fuchsiastraat 17, 5644 LN Eindhoven) as Processor; the customer organisation as Controller.
Location
All processing and storage happens within Atlassian's infrastructure, in the region of the Controller's Atlassian site. We operate no servers of our own and keep no independent copy of Controller data.
Sub-processors
None have access to Controller data processed by the apps — they run inside the Controller's own Atlassian tenancy. Two providers support the business itself and are named, located and dated at Sub-processors: Zoho (email, EU) and Cloudflare (website hosting).
Retention and deletion
Per data type, stated in the applicable annex. On uninstall, app storage is deleted through the Forge platform; data already in the Controller's own Atlassian site is unaffected and remains theirs.
Security
Processing inherits Atlassian's Forge platform controls, including tenancy isolation and encryption in transit and at rest. Credentials are never written to logs, in any environment — enforced in code.
Breach notice
Without undue delay and within 72 hours of becoming aware.
Audit
We make available the information needed to demonstrate compliance and contribute to audits on reasonable notice, at most once a year absent a breach or regulatory requirement.
International transfers
None beyond the region of the Controller's own Atlassian site.
California (CCPA)
Where you are a "business" under the CCPA, we act as your "service provider" and this addendum is the required contract. We process the personal information only to provide the app as described in its annex; we do not sell or share it, use it for any other purpose, or combine it with other data; we comply with the CCPA's service-provider obligations, tell you if we can no longer meet them, and let you take reasonable steps to stop and remediate unauthorised use. We certify that we understand and will comply with these restrictions.