VersionSelect

VersionSelect — Data Processing Addendum

Version 1.0, published September 17, 2026. This is a standard-form DPA and becomes effective for a Customer only when the parties complete and accept the applicable execution record and schedules.

Privacy, security incident and DPA requests may be sent to support@fogsea.top. The mailbox is monitored by the Publisher. Do not include live credentials or unnecessary personal data.

This Addendum forms part of the App agreement between Customer legal entity (to be completed for the executed agreement) (Customer) and FINAL_PUBLIC_PUBLISHER_LEGAL_NAME, FINAL_PUBLIC_ADDRESS_INCLUDING_POSTAL_CODE_AND_COUNTRY (Processor). It applies when the Processor processes personal data on the Customer's behalf to provide VersionSelect. The Customer acts as controller or as a processor authorized by its controller. Applicable Data Protection Law means the laws applicable to that processing, including the GDPR where applicable.

Processing instructions and confidentiality

The Processor will process personal data only on documented Customer instructions, including the App agreement, configuration and authorized support requests, unless law requires otherwise. It will notify the Customer of a legal requirement before processing unless prohibited by law, and promptly inform the Customer if it considers an instruction to infringe applicable data protection law. Persons authorized to process personal data must be bound by confidentiality duties and receive access only as necessary for their work.

Security and incidents

The Processor will maintain technical and organizational measures appropriate to the risks, as specified in Schedule 2, and will not materially reduce the overall protection during the agreement. It will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data. Available information will include its nature, affected data and individuals where known, likely consequences, contact point, and mitigation. Information may be provided in phases without undue delay. Notification does not itself admit liability. The Customer remains responsible for its regulatory and individual notifications, with reasonable assistance from the Processor.

Subprocessors and transfers

The Customer grants general written authorization for the subprocessors specifically identified in the completed Schedule 3. Before adding or replacing a Publisher-appointed subprocessor, the Processor will give at least 30 days’ advance notice to the Customer’s designated email address, allowing an objection on reasonable data protection grounds. The Publisher must monitor upstream provider notices and communicate relevant changes; this clause does not claim control over Atlassian’s own notification timetable. The parties will seek a reasonable resolution; where no compliant alternative is available, the Customer may terminate the affected processing. The Processor will impose equivalent data protection obligations by contract and remains responsible for its subprocessor obligations as required by law.

Restricted international transfers will take place only after the parties document the applicable lawful transfer mechanism, required annexes and supplementary measures. The applicable arrangements will be recorded in the executed agreement. Customer-selected catalog APIs are documented recipients and are not automatically Publisher-appointed subprocessors.

Assistance and audit

Taking account of the processing and available information, the Processor will reasonably assist with individual rights requests, security duties, breach assessment, data protection impact assessments and regulator consultation. Requests received directly concerning Customer-controlled data will be referred promptly to the Customer unless law requires otherwise.

The Processor will make available information necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the Customer or its mandated auditor. Reasonable confidentiality, scope and scheduling arrangements may protect other customers and security but will not prevent legally required audit rights. The Processor will promptly advise if an audit instruction infringes applicable data protection law.

Return and deletion

Customer administrators can create, view, edit, delete and reorder services and versions on the manual data-source configuration page, or maintain the active API catalog in their own backend service. Removing an active catalog entry does not automatically erase old manual-catalog records or Jira field values. Those records follow their separate retention and deletion processes. The Customer initiates and controls administrator actions; the Publisher is not granted access to customer data by this workflow. Customer control of active entries does not replace the need for an available execution path for a valid retained-data deletion instruction.

At the Customer's choice, after processing services end the Processor will return or delete personal data and delete existing copies unless law requires retention. Retained data will be isolated, protected and used only for the legal requirement. The agreed deletion scope, available execution route and completion evidence must be recorded in Schedule 1 before execution. A limitation of the current UI does not waive the Processor’s legal or contractual deletion obligations. If a lawful instruction cannot be fulfilled while the installation remains active, the parties must agree a compliant alternative or stop the affected processing; the Processor must not report an unresolved deletion as complete. Jira values and Customer-selected API records require action by the responsible operator; the Processor will assist within its control.

Priority and signatures

This Addendum prevails over conflicting App terms for its subject matter. Mandatory rights and obligations remain unaffected. Authorized signatures and dates: Customer signature and date (to be completed), Processor signature and date (to be completed).

Schedule 1 — Processing details

Purpose/nature: provide catalog lookup, Jira field selection snapshots, configuration and customer-directed technical support. Operations: receive, transmit, query, store, retrieve, update and delete as authorized. Duration: service term plus the finalized deletion/legally required retention period.

Data subjects: Customer users or other individuals whose information is incidentally included in catalog content or customer-directed technical support material. Data: catalog names/groups/version values and IDs; lookup text; API URL and credential; operational metadata; personal data in customer-directed technical support material. Independently managed support-contact and legal-compliance records are covered by the Privacy Policy rather than this processing instruction. Special-category data is not intended or required; the Customer must not submit it through catalog fields.

Customer rights/duties: issue lawful instructions, establish a lawful basis, provide required notices, manage access and external recipients, and decide retention of Jira values and exported files.

Following a verified instruction, the Publisher will initiate the agreed return or deletion process within 30 days, unless an earlier applicable legal deadline requires action. The execution record will identify the data scope, delivery method, platform retention constraints and notification contact. Any data retained for a legal requirement will be isolated and protected. Platform residuals and their expected lifecycle will be disclosed rather than reported as immediately erased.

Schedule 2 — Measures

Implemented application measures: installation-scoped Forge hosted storage; Forge secret storage for saved catalog Tokens; no saved Token returned to the browser; HTTPS catalog requests and rejection of redirects; administrator settings separated from field resolvers; validated inputs, pagination and response limits; error mapping that avoids deliberately logging request contents or credentials. Infrastructure encryption and lifecycle depend on Atlassian's applicable service commitments.

Access to Publisher-controlled accounts is restricted to the individual Publisher and protected by multi-factor authentication. Access permissions are reviewed quarterly. Support attachments are retained for no more than 30 days after case closure unless a documented legal requirement applies. Security incidents are recorded and handled through a documented response procedure. Deletion completion is checked and recorded before confirmation is sent to the Customer.

Schedule 3 — Providers and locations

Atlassian Pty Ltd provides Forge compute, hosted storage and platform logging. The Publisher maintains records of the applicable Forge terms and data-processing arrangements for its account. Jira field values are also governed by the Customer's separate Atlassian agreement. Provider locations and applicable transfer arrangements are documented in the executed agreement.

Customer-configured catalog: Customer to record operator, endpoint origin, location, categories received and contractual role for its own catalog In manual mode the App does not call this catalog; saved API configuration can remain stored.

Support is handled by the individual Publisher from mainland China through support@fogsea.top. Customers should use synthetic examples and omit live credentials. Customer-supplied support material is received through the configured email provider, which is identified in the executed provider register. Personal data must not be sent through this support channel until any required transfer arrangements have been completed. The Publisher does not view or download customer Forge logs.

Schedule 4 — California personal information (where applicable)

Where the Customer is a business subject to the CCPA and the Publisher processes covered personal information on its behalf, the Publisher acts as a service provider for the limited purposes in Schedule 1. It will not sell or share that information; retain, use or disclose it outside those purposes or the direct business relationship; or combine it with information obtained from other customers or its own consumer interactions except as permitted by the CCPA. It will comply with applicable CCPA obligations and provide the same level of protection required by that law.

The Customer may take reasonable and appropriate steps to verify compliant use, and, on notice, stop and remediate unauthorized use. The Publisher will notify the Customer if it can no longer meet these obligations and will assist with applicable consumer requests. Subcontracted processing must be subject to a compliant written contract. The Publisher certifies that it understands and will comply with these restrictions upon execution. This clause does not assert that either party currently meets a statutory definition solely because it signs this document.

Schedule 5 — Execution record

Complete for each executed agreement; customer-specific blanks are normal contract fields, not a declaration that the agreement has already been signed.

Contact support@fogsea.top to request execution of this standard-form DPA. Publication alone does not constitute execution. Customer-specific fields and applicable schedules must be completed and accepted by both parties. Signing the DPA does not by itself complete any required international transfer mechanism.