APPENDIX NO. 2

PERSONAL DATA STORED BY THE CLOUD-BASED APPLICATIONS

JETI Cloud

Subject Matter

META-INF’s provision of the Services and related technical support to Customer.

Duration of the Processing

45th day from the uninstallation of the application, or urgently but not later than 8 days when the Controller requires the deletion of all Customer Data by META-INF in accordance with the Data Processing Addendum.

Nature and Purpose of the Processing

Processor will process Customer Data submitted, stored, sent or received by Customer, via the Services for the purposes of providing the Services and related technical support to Customer.

Categories of Data

Personal data submitted, stored, sent or received by Customer, using the application may include the following categories of data:

Email Audit (log)

• Full email body, except attachments
• Sender and recipient names and email addresses
• Sender user's anonymized user id (Atlassian Account ID)

Outgoing emails

Sending server

• Username and password
• User password are encrypted using a cryptographically strong algorithm (https://en.wikipedia.org/wiki/PKCS standard)

Email sending configurations (manual email sending, notification schemes, workflow post functions)

• Sender and recipient names and email addresses

Outgoing email queues

• Sender user's anonymized user id (Atlassian Account ID)

Incoming emails

Mailbox settings

• Username and password
• User password are encrypted using a cryptographically strong algorithm (https://en.wikipedia.org/wiki/PKCS standard)

Mail handler configurations

• Sender and recipient names and email addresses

Mail handler audit logs

• Sender and recipient names and email addresses
• Email addresses and names found during processing and evaluation
• The anonymized user id (Atlassian Account ID) of the user on behalf of the mail handler actions are executed

Incoming mail queue

• Sender name and email address
• Email headers of the processed messages

Sending/receiving restrictions

Email addresses

‍

Data Subjects

Personal data submitted, stored, sent or received via the Services may concern the following categories of data subjects: End Users including Customer’s employees and contractors; the personnel of Customer’s customers, suppliers and subcontractors; and any other person who transmits data via the Services, including individuals collaborating and communicating with End Users.

Content Exporter

Subject Matter

META-INF’s provision of the Services and related technical support to Customer.

Duration of the Processing

At most 1 day from the date of the export activity.

Nature and Purpose of the Processing

Processor will process Customer Data submitted, stored, sent or received by Customer, via the Services for the purposes of providing the Services and related technical support to Customer.

Categories of Data

Personal data submitted, stored, sent or received by Customer, using the application may include the following categories of data: documents, presentations, images, and the Atlassian Account ID of the Customer regarding the last export.

Data Subjects

Personal data submitted, stored, sent or received via the Services may concern the following categories of data subjects: End Users including Customer’s employees and contractors; the personnel of Customer’s customers, suppliers and subcontractors; and any other person who transmits data via the Services, including individuals collaborating and communicating with End Users.

Glass Project Documentation for Jira

Subject Matter

META-INF’s provision of the Services and related technical support to Customer.

Duration of the Processing

45th day from the uninstallation of the application, or urgently but not later than 8 days when the Controller requires the deletion of all Customer Data by META-INF in accordance with the Data Processing Addendum.

In addition to the above, META-INF processes the Customer Data with respect to the saved Jira projects until the next day after the Customer deletes it within the application.

Nature and Purpose of the Processing

Processor will process Customer Data submitted, stored, sent or received by Customer, via the Services for the purposes of providing the Services and related technical support to Customer.

Categories of Data

Personal data submitted, stored, sent or received by Customer, using the application may include the following categories of data:

Confluence OAuth Token

Account ID

Access Token

Refresh Token

Saved Jira Project Configuration

Schemes, workflows details, permissions and general project settings

Users in the project

Data Subjects

Personal data submitted, stored, sent or received via the Services may concern the following categories of data subjects: End Users including Customer’s employees and contractors; the personnel of Customer’s customers, suppliers and subcontractors; and any other person who transmits data via the Services, including individuals collaborating and communicating with End Users.

‍