Atlassian Data Processing Addendum
Eﬀec%ve star%ng: the earlier of (i) October 6, 2024 and (ii) the date the Atlassian Intelligence and Rovo Product-Speciﬁc Terms are eﬀec%ve.
This Data Processing Addendum (“DPA”) supplements the Atlassian Customer Agreement, or other agreement in place between Customer
and Atlassian covering Customer’s use of Atlassian’s Products and related Support and Advisory Services (the “Agreement”). Unless otherwise
deﬁned in this DPA or in the Agreement, all capitalized terms used in this DPA will have the meanings given to them in SecGon 9 of this DPA.
1.

Scope and Term.
1.1. Roles of the ParGes.
(a)
Customer Personal Data. Atlassian will Process Customer Personal Data as Customer’s Processor in accordancewith Customer’s instrucGons as outlined in SecGon 2.1 (Customer InstrucGons).
(b)

(c)

(d)

Atlassian Account Data. Atlassian will Process Atlassian Account Data as a Controller for the following purposes:(i) to provide and improve the Products; (ii) to manage the Customer relaGonship (communicaGng with Customer
and Users in accordance with their account preferences, responding to Customer inquiries and providing technicalsupport, etc.), (iii) to facilitate security, fraud prevenGon, performance monitoring, business conGnuity anddisaster recovery; and (iv) to carry out core business funcGons such as accounGng, billing, and ﬁling taxes.
Atlassian Usage Data. Atlassian will Process Atlassian Usage Data as a Controller for the following purposes: (i) toprovide, opGmize, secure, and maintain the Products; (ii) to opGmize user experience; and (iii) to inform Atlassian’s
business strategy.
DescripGon of the Processing. Details regarding the Processing of Personal Data by Atlassian are stated in Schedule
1 (DescripGon of Processing).

1.2. Term of the DPA. The term of this DPA coincides with the term of the Agreement and terminates upon expiraGon or earlier
terminaGon of the Agreement (or, if later, the date on which Atlassian ceases all Processing of Customer Personal Data).
1.3. Order of Precedence. If there is any conﬂict or inconsistency among the following documents, the order of precedence is: (1)the applicable terms stated in Schedule 2 (Region-Speciﬁc Terms including any transfer provisions); (2) the main body of this
DPA; and (3) the Agreement.
2.

Processing of Personal Data.
2.1. Customer InstrucGons. Atlassian must Process Customer Personal Data in accordance with the documented lawful instrucGonsof Customer as stated in the Agreement (including this DPA) and respecGve Orders, as necessary to (i) provide the Products
and related Support and Advisory Services to Customer and enable the use of various features and funcGonaliGes inaccordance with the DocumentaGon (including as directed by Users through the Cloud Products), (ii) invesGgate Security
Incidents and enforce the Acceptable Use Policy (e.g. enforce the prohibiGon on illegal content such as child sexual abusematerial), or (iii) comply with its legal obligaGons. Atlassian will noGfy Customer if it becomes aware, or reasonably believes,that Customer’s instrucGons violate Applicable Data ProtecGon Law.
2.2. ConﬁdenGality. Atlassian must treat Customer Personal Data as Customer’s ConﬁdenGal InformaGon under the Agreement.
Atlassian must ensure personnel authorized to Process Personal Data are bound by wriVen or statutory obligaGons of
conﬁdenGality.

3.

Security.
3.1. Security Measures. Atlassian has implemented and will maintain appropriate technical and organizaGonal measures designed
to protect the security, conﬁdenGality, integrity and availability of Customer Data and protect against Security Incidents.
Customer is responsible for conﬁguring the Products and using features and funcGonaliGes made available by Atlassian tomaintain appropriate security in light of the nature of Customer Data. Atlassian’s current technical and organizaGonal
measures are described here. Customer acknowledges that the Security Measures are subject to technical progress anddevelopment and that Atlassian may update or modify the Security Measures from Gme to Gme, provided that such updates
and modiﬁcaGons do not materially decrease the overall security of the Cloud Products during a SubscripGon Term.
3.2. Security Incidents. Atlassian must noGfy Customer without undue delay and, where feasible, no later than seventy-two (72)hours a[er becoming aware of a Security Incident. Atlassian must make reasonable eﬀorts to idenGfy the cause of the Security
Incident, miGgate the eﬀects and remediate the cause to the extent within Atlassian’s reasonable control. Upon Customer’s
request and taking into account the nature of the Processing and the informaGon available to Atlassian, Atlassian must assist
Customer by providing informaGon reasonably necessary for Customer to meet its Security Incident noGﬁcaGon obligaGons
under Applicable Data ProtecGon Law. Atlassian’s noGﬁcaGon of a Security Incident is not an acknowledgment by Atlassian ofits fault or liability.

4.

Sub-processing.

1
Atlassian Data Processing Addendum
October 2024 Version

4.1. General AuthorizaGon. By entering into this DPA, Customer provides general authorizaGon for Atlassian to engage Subprocessors to Process Customer Personal Data. Atlassian must: (i) enter into a wriVen agreement with each Sub-processor
imposing data protecGon terms that require the Sub-processor to protect Customer Personal Data to the standard requiredby Applicable Data ProtecGon Law and to the same standard provided by this DPA; and (ii) remain liable to Customer if such
Sub-processor fails to fulﬁll its data protecGon obligaGons with regard to the relevant Processing acGviGes under the
Agreement.
4.2. NoGce of New Sub-processors. Atlassian maintains an up-to-date list of its Sub-processors here, which contains a mechanism
for Customer to subscribe to noGﬁcaGons of new Sub-processors. Atlassian will provide such noGce, to those emails
subscribed, at least thirty (30) days before allowing any new Sub-processor to Process Customer Personal Data (the “Subprocessor No@ce Period”).
4.3. ObjecGon to New Sub-processors. Customer may object to Atlassian’s appointment of a new Sub-processor during the Subprocessor NoGce Period. If Customer objects, Customer, as its sole and exclusive remedy, may terminate the applicable Orderfor the aﬀected Cloud Product and related Support and Advisory Services in accordance with SecGon 12.2 (TerminaGon forConvenience) of the Agreement.
5.

Assistance and Coopera@on Obliga@ons.
5.1. Data Subject Rights. Taking into account the nature of the Processing, Atlassian must provide reasonable and Gmely assistanceto Customer to enable Customer to respond to requests for exercising a data subject’s rights (including rights of access,recGﬁcaGon, erasure, restricGon, objecGon, and data portability) in respect to Customer Personal Data.
5.2. CooperaGon ObligaGons. Upon Customer’s reasonable request, and taking into account the nature of the Processing, Atlassian
will provide reasonable assistance to Customer in fulﬁlling Customer’s obligaGons under Applicable Data ProtecGon Law(including data protecGon impact assessments and consultaGons with regulatory authoriGes), provided that Customer cannot
reasonably fulﬁll such obligaGons independently with help of available DocumentaGon.

6.

5.3. Third Party Requests. Unless prohibited by Law, Atlassian will promptly noGfy Customer of any valid, enforceable subpoena,
warrant, or court order from law enforcement or public authoriGes compelling Atlassian to disclose Customer Personal Data.
Atlassian will follow its law enforcement guidelines in responding to such requests. In the event that Atlassian receives aninquiry or a request for informaGon from any other third party (such as a regulator or data subject) concerning the Processingof Customer Personal Data, Atlassian will redirect such inquiries to Customer, and will not provide any informaGon unlessrequired to do so under applicable Law.
Dele@on and Return of Customer Personal Data.
6.1. During SubscripGon Term. During the SubscripGon Term, Customer and its Users may, through the features of the Cloud
Products, access, retrieve or delete Customer Personal Data.

7.

6.2. Post TerminaGon. Following expiraGon or terminaGon of the Agreement, Atlassian must, in accordance with theDocumentaGon, delete all Customer Personal Data. Notwithstanding the foregoing, Atlassian may retain Customer Personal
Data (i) as required by Applicable Data ProtecGon Law or (ii) in accordance with its standard backup or record retenGon
policies, provided that, in either case, Atlassian will maintain the conﬁdenGality of, and otherwise comply with the applicableprovisions of this DPA with respect to retained Customer Personal Data and not further Process it except as required by
Applicable Data ProtecGon Law.
Audit.
7.1. Audit Reports. Atlassian is regularly audited by independent third-party auditors and/or internal auditors, including as
described here. Upon request, and on the condiGon that Customer has entered into an applicable non-disclosure agreementwith Atlassian, Atlassian will supply a summary copy of relevant audit report(s) (“Report”) to Customer, so Customer can verify
Atlassian’s compliance with the audit standards against which it has been assessed, and this DPA. If Customer cannot
reasonably verify Atlassian’s compliance with the terms of this DPA, Atlassian will provide wriVen responses (on a conﬁdenGal
basis) to all reasonable requests for informaGon made by Customer related to its Processing of Customer Personal Data,
provided that such right may be exercised no more than once every twelve (12) months.
7.2. On-site Audits. Only to the extent Customer cannot reasonably saGsfy Atlassian’s compliance with this DPA through theexercise of its rights under SecGon 7.1 above, or where required by Applicable Data ProtecGon Law or a regulatory authority,
Customer, or its authorized representaGves, may, at Customer’s expense, conduct audits (including inspecGons) during theterm of the Agreement to assess Atlassian’s compliance with the terms of this DPA. Any audit must (i) be conducted during
Atlassian’s regular business hours, with reasonable advance wriVen noGce of at least sixty (60) calendar days (unless
Applicable Data ProtecGon Law or a regulatory authority requires a shorter noGce period); (ii) be subject to reasonable
conﬁdenGality controls obligaGng Customer (and its authorized representaGves) to keep conﬁdenGal any informaGon
disclosed that, by its nature, should be conﬁdenGal; (iii) occur no more than once every twelve (12) months; and (iv) restrict
its ﬁndings to only informaGon relevant to Customer.

2
Atlassian Data Processing Addendum
October 2024 Version

8.

Interna@onal Provisions. To the extent Atlassian Processes Personal Data protected by Applicable Data ProtecGon Laws in one of theregions listed in Schedule 2 (Region-Speciﬁc Terms), the terms speciﬁed for the applicable regions will also apply, including theprovisions relevant for internaGonal transfers of Personal Data (directly or via onward transfer).

9.

Deﬁni@ons.
“Applicable Data Protec@on Law” means all Laws applicable to the Processing of Personal Data under the Agreement.
“Atlassian Account Data” means Personal Data relaGng to Customer’s relaGonship with Atlassian, including: (i) Users’ accountinformaGon (e.g. name, email address, or Atlassian’s account ID (AAID)); (ii) billing and contact informaGon of individual(s) associatedwith Customer’s Atlassian account (e.g. billing address, email address, or name); (iii) Users’ device and connecGon informaGon (e.g. IP
address); and (iv) content/descripGon of technical support requests (excluding aVachments) alongside with the Support EnGtlement
Number (SEN).
“Atlassian Usage Data” means Personal Data relaGng to or obtained in connecGon with the use, performance, operaGon, support oruse of the Products, including via their connecGon to Third-Party Products. Atlassian Usage Data may include event name (i.e. what
acGon Users performed), event Gmestamps, browser informaGon, diagnosGc data, data types, ﬁle sizes, and similar informaGon
associated with data from the Products and Third-Party Products that Customer connects to the Products. For clarity, Atlassian Usage
Data does not include Customer Personal Data.
“Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines
the purposes and means of the Processing of Personal Data.
“Customer Personal Data'' means Personal Data contained in Customer Data and/or Customer Materials that Atlassian Processes underthe Agreement solely on behalf of Customer. For clarity, Customer Personal Data includes any Personal Data included in the aVachments
provided by Customer or its Users in any technical support requests.
“Personal Data” means informaGon about an idenGﬁed or idenGﬁable natural person, or which otherwise consGtutes “personal data”,“personal informaGon”, “personally idenGﬁable informaGon” or similar terms as deﬁned in Applicable Data ProtecGon Law.
“Processing” (and “Process”) means any operaGon or set of operaGons which is performed on Personal Data or on sets of Personal Data,
whether or not by automated means, such as collecGon, recording, organizaGon, structuring, storage, adaptaGon or alteraGon, retrieval,consultaGon, use, disclosure by transmission, disseminaGon or otherwise making available, alignment or combinaGon, restricGon,
erasure, or destrucGon.
“Processor” means the enGty which Processes Personal Data on behalf of the Controller.
“Security Incident'' means any breach of security leading to the accidental or unlawful destrucGon, loss, alteraGon, unauthorized
disclosure of, or access to Customer Data Processed by Atlassian and/or its Sub-processors.
“Sub-processor” means any third party (inc. Atlassian Aﬃliates) engaged by Atlassian to Process Customer Personal Data.

3
Atlassian Data Processing Addendum
October 2024 Version

Schedule 1
Descrip@on of Processing
1.

Categories of data subjects whose Personal Data is Processed: Customer and its Users.

2.

Categories of Personal Data Processed: Atlassian Account Data, Atlassian Usage Data, and Customer Personal Data.

3.

Sensi@ve data transferred: Atlassian Account Data and Atlassian Usage Data do not contain data (i) revealing racial or ethnic origin,poliGcal opinions, religious or philosophical beliefs, or trade union membership, (ii) geneGc data, biometric data Processed for the
purposes of uniquely idenGfying a natural person, data concerning health, or data concerning a natural person's sex life or sexual
orientaGon, or (iii) relaGng to criminal convicGons and oﬀences (altogether “Sensi@ve Data”). Subject to SecGon 6.3 of the Agreement(SensiGve Health InformaGon and HIPAA), Customer or its Users may upload content to the Cloud Products which may include
SensiGve Data, the extent of which is determined and controlled solely by Customer.

4.

The frequency of the transfer: ConGnuous.

5.

Nature of the Processing: Atlassian will Process Personal Data in order to provide the Products and related Support and Advisory
Services in accordance with the Agreement, including this DPA. AddiGonal informaGon regarding the nature of the Processing(including transfer) is described in respecGve Orders for relevant Products and DocumentaGon referring to technical capabiliGes andfeatures, including but not limited to collecGon, structuring, storage, transmission, or otherwise making available of Personal Data byautomated means.

6.

Purpose(s) of the Processing:
6.1. Customer Personal Data: Atlassian will Process Customer Personal Data as Processor in accordance with Customer’s
instrucGons as set out in SecGon 2.1 (Customer InstrucGons).
6.2. Atlassian Account Data and Atlassian Usage Data: Atlassian will Process Atlassian Account Data and Atlassian Usage Data forthe limited and speciﬁed purposes outlined in SecGon 1.1 (Roles of the ParGes).

7.

8.

Dura@on of Processing:
7.1. Customer Personal Data: Atlassian will Process Customer Personal Data for the term of the Agreement as outlined in SecGon
6 (DeleGon and Return of Customer Personal Data).
7.2. Atlassian Account Data and Atlassian Usage Data: Atlassian will Process Atlassian Account Data and Atlassian Usage Data only
as long as required (a) to provide Products and related Support and Advisory Services to Customer in accordance with theAgreement; (b) for Atlassian’s legiGmate business purposes outlined in SecGon 1.1 (Roles of the ParGes); or (c) by applicable
Law(s).
Transfers to Sub-processors: Atlassian will transfer Customer Personal Data to Sub-processors as permiVed in SecGon 4(Subprocessing).

4
Atlassian Data Processing Addendum
October 2024 Version

Schedule 2
Region-Speciﬁc Terms
Unless otherwise deﬁned in this DPA or in the Agreement, all capitalized terms used in this Schedule will have the meanings given to them in
SecGon 4 of this Schedule.
1.

Europe, United Kingdom and Switzerland.
1.1. Customer InstrucGons. In addiGon to SecGon 2.1 (Customer InstrucGons) of the DPA above, Atlassian will Process Customer
Personal Data only on documented instrucGons from Customer, including with regard to transfers of such Customer Personal
Data to a third country or an internaGonal organisaGon, unless required to do so by Applicable Data ProtecGon Law to which
Atlassian is subject; in such a case, Atlassian shall inform Customer of that legal requirement before Processing, unless thatlaw prohibits such informaGon on important grounds of public interest. Atlassian will promptly inform Customer if it becomesaware that Customer's Processing instrucGons infringe Applicable Data ProtecGon Law.
1.2. European Transfers. Where Personal Data protected by the EU Data ProtecGon Law is transferred, either directly or via onward
transfer, to a country outside of Europe that is not subject to an adequacy decision, the following applies:(a)

The EU SCCs are hereby incorporated into this DPA by reference as follows:(i)

Customer is the “data exporter” and Atlassian is the “data importer”.

(ii)

Module One (Controller to Controller) applies where Atlassian is Processing Atlassian Account Data or
Atlassian Usage Data.

(iii)

Module Two (Controller to Processor) applies where Customer is a Controller of Customer Personal Data
and Atlassian is Processing Customer Personal data as a Processor.
Module Three (Processor to Processor) applies where Customer is a Processor of Customer Personal Data
and Atlassian is Processing Customer Personal Data as another Processor.

(iv)
(v)
(b)

By entering into this DPA, each party is deemed to have signed the EU SCCs as of the commencement dateof the Agreement.

For each Module, where applicable:(i)

In Clause 7, the opGonal docking clause does not apply.

(ii)
(iii)

In Clause 9, OpGon 2 applies, and the Gme period for prior noGce of Sub-processor changes is stated in
SecGon 4 (Subprocessing) of this DPA.
In Clause 11, the opGonal language does not apply.

(iv)

In Clause 17, OpGon 1 applies, and the EU SCCs are governed by Irish law.

(v)

In Clause 18(b), disputes will be resolved before the courts of Ireland.

(vi)

The Appendix of EU SCCs is populated as follows:• The informaGon required for Annex I(A) is located in the Agreement and/or relevant Orders.
•

The informaGon required for Annex I(B) is located in Schedule 1 (DescripGon of Processing) of thisDPA.

•

The competent supervisory authority in Annex I(C) will be determined in accordance with theApplicable Data ProtecGon Law; and• The informaGon required for Annex II is located here.
1.3. Swiss Transfers. Where Personal Data protected by the Swiss FADP is transferred, either directly or via onward transfer, to any
other country that is not subject to an adequacy decision, the EU SCCs apply as stated in in SecGon 1.2 (European Transfers)
above with the following modiﬁcaGons:(a)

All references in the EU SCCs to “RegulaGon (EU) 2016/679” will be interpreted as references to the Swiss FADP,
and references to speciﬁc ArGcles of “RegulaGon (EU) 2016/679” will be replaced with the equivalent arGcle orsecGon of the Swiss FADP; all references to the EU Data ProtecGon Law in this DPA will be interpreted as references
to the FADP.

(b)

In Clause 13, the competent supervisory authority is the Swiss Federal Data ProtecGon and InformaGon
Commissioner.

(c)

In Clause 17, the EU SCCs are governed by the laws of Switzerland.

(d)

In Clause 18(b), disputes will be resolved before the courts of Switzerland.

(e)

All references to Member State will be interpreted to include Switzerland and Data Subjects in Switzerland are notexcluded from enforcing their rights in their place of habitual residence in accordance with Clause 18(c).

5Atlassian Data Processing Addendum
October 2024 Version

1.4. United Kingdom Transfers. Where Personal Data protected by the UK Data ProtecGon Law is transferred, either directly or via
onward transfer, to a country outside of the United Kingdom that is not subject to an adequacy decision, the following applies:(a)

The EU SCCs apply as set forth in SecGon 1.2 (European Transfers) above with the following modiﬁcaGons:(i)
Each party shall be deemed to have signed the UK Addendum.
(ii)

(b)

(iii)

For Table 1 of the UK Addendum, the parGes’ key contact informaGon is located in the Agreement and/or
relevant Orders.
For Table 2 of the UK Addendum, the relevant informaGon about the version of the EU SCCs, modules, andselected clauses which this UK Addendum is appended to is located above in SecGon 1.2 (European
Transfers) of this Schedule.

(iv)

For Table 3 of the UK Addendum:••

The informaGon required for Annex 1A is located in the Agreement and/or relevant Orders.
The InformaGon required for Annex 1B is located in Schedule 1 (DescripGon of Processing) of thisDPA.

•

The informaGon required for Annex II is located here; and• The informaGon required for Annex III is located in SecGon 4 (Sub-processing) of this DPA.
In Table 4 of the UK Addendum, both the data importer and data exporter may end the UK Addendum.

1.5. Data Privacy Framework. Atlassian parGcipates in and cerGﬁes compliance with the Data Privacy Framework. As required by
the Data Privacy Framework, Atlassian (i) provides at least the same level of privacy protecGon as is required by the Data
Privacy Framework Principles; (ii) will noGfy Customer if Atlassian makes a determinaGon it can no longer meet its obligaGon
to provide the same level of protecGon as is required by the Data Privacy Framework Principles, and (iii) will, upon wriVennoGce, take reasonable and appropriate steps to remediate any unauthorized Processing of Personal Data.
2.

United States of America. The following terms apply where Atlassian Processes Personal Data subject to the US State Privacy Laws:
2.1. To the extent Customer Personal Data includes personal informaGon protected under US State Privacy Laws that AtlassianProcesses as a Service Provider or Processor, on behalf of Customer, Atlassian will Process such Customer Personal Data inaccordance with the US State Privacy Laws, including by complying with applicable secGons of the US State Privacy Laws andproviding the same level of privacy protecGon as required by US State Privacy Laws, and in accordance with Customer's wriVen
instrucGons, as necessary for the limited and speciﬁed purposes idenGﬁed in SecGon 1.1(a) (Customer Personal Data) and
Schedule 1 (DescripGon of Processing) of this DPA. Atlassian will not:(a)retain, use, disclose or otherwise Process such Customer Personal Data for a commercial purpose other than forthe limited and speciﬁed purposes idenGﬁed in this DPA, the Agreement, and/or any related Order, or as otherwise
permiVed under US State Privacy Laws;(b)"sell" or “share” such Customer Personal Data within the meaning of the US State Privacy Laws; and(c)retain, use, disclose or otherwise Process such Customer Personal Data outside the direct business relaGonshipwith Customer and not combine such Customer Personal Data with personal informaGon that it receives fromother sources, except as permiVed under US State Privacy Laws.

2.2. Atlassian must inform Customer if it determines that it can no longer meet its obligaGons under US State Privacy Laws within
the Gmeframe speciﬁed by such laws, in which case Customer may take reasonable and appropriate steps to prevent, stop, orremediate any unauthorized Processing of such Customer Personal Data.
2.3. To the extent Customer discloses or otherwise makes available DeidenGﬁed Data to Atlassian or to the extent Atlassian creates
DeidenGﬁed Data from Customer Personal Data, in each case in its capacity as a Service Provider, Atlassian will:

3.

(a)

adopt reasonable measures to prevent such DeidenGﬁed Data from being used to infer informaGon about, orotherwise being linked to, a parGcular natural person or household;(b)

publicly commit to maintain and use such DeidenGﬁed Data in a de-idenGﬁed form and to not aVempt to reidenGfy the DeidenGﬁed Data, except that Atlassian may aVempt to re-idenGfy such data solely for the purposeof determining whether its de-idenGﬁcaGon processes are compliant with the US State Privacy Laws; and(c)before sharing DeidenGﬁed Data with any other party, including Sub-processors, contractors, or any other persons(“Recipients”), contractually obligate any such Recipients to comply with all requirements of this SecGon 2.3(including imposing this requirement on any further Recipients).

South Korea.
3.1. Customer agrees that it has provided noGce and obtained all consents and rights necessary under Applicable Data ProtecGon
Law for Atlassian to Process Atlassian Account Data and Atlassian Usage Data pursuant to the Agreement (including this DPA).
3.2. To the extent Customer discloses or otherwise makes available DeidenGﬁed Data to Atlassian, Atlassian will:

6
Atlassian Data Processing Addendum
October 2024 Version

4.

(a)

maintain and use such DeidenGﬁed Data in a de-idenGﬁed form and not aVempt to re-idenGfy the DeidenGﬁed
Data; and(b)

before sharing DeidenGﬁed Data with any other party, including Sub-processors, contractors, or any other persons(“Recipients”), contractually obligate any such Recipients to comply with all requirements of this SecGon 3.2(including imposing this requirement on any further Recipients).

Deﬁni@ons.
4.1. Where Personal Data is subject to the laws of one the following regions, the deﬁniGon of “Applicable Data Protec@on Law”
includes:(a)Australia: the Australian Privacy Act;(b)

Brazil: the Brazilian Lei Geral de Proteção de Dados (General Personal Data ProtecGon Act);

(c)
(d)

Canada: the Canadian Personal InformaGon ProtecGon and Electronic Documents Act;
Europe: (i) the RegulaGon 2016/679 of the European Parliament and of the Council on the protecGon of natural
persons with regard to the Processing of Personal Data and on the free movement of such data (General Data
ProtecGon RegulaGon, or GDPR) and (ii) the EU e-Privacy DirecGve (DirecGve 2002/58/EC) as amended,superseded or replaced from Gme to Gme (“EU Data Protec@on Law”);

(e)
(f)

Japan: the Japanese Act on the ProtecGon of Personal InformaGon;
Singapore: the Singapore Personal Data ProtecGon Act;(g)

South Korea: the South Korean Personal InformaGon ProtecGon Act (“PIPA”) and the Enforcement Decrees of
PIPA;

(h)

Switzerland: the Swiss Federal Act on Data ProtecGon and its implemenGng regulaGons as amended, superseded,or replaced from Gme to Gme (“Swiss FADP”);(i)

The United Kingdom: the Data ProtecGon Act 2018 and the GDPR as saved into United Kingdom law by virtue of
SecGon 3 of the United Kingdom's European Union (Withdrawal) Act 2018 as amended, superseded or replaced
from Gme to Gme (“UK Data Protec@on Law”); and(j)

The United States: all state laws relaGng to the protecGon and Processing of Personal Data in eﬀect in the UnitedStates of America, which may include, without limitaGon, the California Consumer Privacy Act, as amended by the
California Privacy Rights Act, and its implemenGng regulaGons (“CCPA”), the Colorado Privacy Act, the ConnecGcut
Data Privacy Act, the Utah Consumer Privacy Act and the Virginia Consumer Data ProtecGon Act (“US State Privacy
Laws”).

4.2. “Deiden@ﬁed Data” means data that cannot reasonably be used to infer informaGon about, or otherwise be linked to, a data
subject.
4.3. “Data Privacy Framework” means the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy
Framework, and the Swiss-U.S. Data Privacy Framework self-cerGﬁcaGon program operated by the US Department ofCommerce.
4.4. “Europe” includes, for the purposes of this DPA, the Member States of the European Union and European Economic Area.
4.5. “EU SCCs” means the contractual clauses annexed to the European Commission's ImplemenGng Decision 2021/914 of 4 June
2021 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to RegulaGon (EU) 2016/679
of the European Parliament and of the Council, as amended, superseded, or replaced from Gme to Gme.
4.6. “Service Provider” has the same meaning as given in the CCPA.
4.7. “UK Addendum” means the InternaGonal Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued
by the UK InformaGon Commissioner, Version B1.0, in force 21 March 2022, as amended, superseded or replaced from Gme
to Gme.

7
Atlassian Data Processing Addendum
October 2024 Version