...
This Data Protection Addendum ("DPA") supplements the terms and conditions of Cappsule Sarl ("Processor") Privacy Policy and is incorporated into the Cappsule's agreement with its customers ("Controller") who use the Timesheet Tracking for JIRA plugin TimeFlow For JIRA add-on ("Plugin") in accordance with the EU General Data Protection Regulation 2016/679 ("GDPR").
...
3.1 The Processor shall only process Personal Data on behalf of the Controller and only when explicitly accepted by the Controller.
3.2 The Processor shall take all necessary technical and organizational measures to ensure that the Personal Data is processed in a manner that ensures its security, integrity, and confidentiality.
3.3 The Processor shall not process Personal Data other than on the documented features of the Plugin or use it for any purpose other than to perform the services under the Agreement, unless required to do so by law.
3.4 The Personal Data processed by the Processor is limited to worklogs, worklog attributes, durations and Display names. The Processor associates the worklogs durations to the display name of the user who entered the worklog is assigned within the Atlassian services. However, the Processor does not store or process any personal data outside of Atlassian services.
3.5 The parties agree that Atlassian's terms of service and privacy policy, as applicable to the use of the Atlassian platform, shall apply to the processing of personal data by the Processor through the Timesheet Tracking for TimeFlow For JIRA plugin.
4. Confidentiality
...