DATA PROCESSING AGREEMENT

1. Definitions and interpretation

“Customer Personal Data” means Personal Data in Jira fields accessed through SprintIQ or in SprintIQ-generated analytics, reports, and related operational records processed on behalf of Customer. “Personal Data,” “Processing,” “Controller,” “Processor,” “Data Subject,” and “Personal Data Breach” have the meanings in applicable privacy laws. “Applicable Data Protection Laws” means the GDPR, UK GDPR, and relevant U.S. privacy laws, in each case only to the extent applicable. “Subprocessor” means a third party engaged to Process Customer Personal Data on EduQuencher’s behalf. Capitalized terms not defined here have the meanings in the Agreement.

2. Scope, roles and instructions

Customer determines the purposes and means of Processing Customer Personal Data and is generally the Controller (or a processor acting for another controller). EduQuencher acts as Processor for that data. Customer instructs EduQuencher to Process Customer Personal Data only as needed to provide the contracted SprintIQ functions, maintain security, provide authorized support, comply with the Agreement, and follow other documented lawful instructions. EduQuencher will promptly inform Customer if an instruction appears unlawful where required by law, unless prohibited from doing so.

EduQuencher will not sell Customer Personal Data, use it for targeted advertising, or use it to train its own models. General service improvement must not authorize unrelated secondary use of identifiable Customer Personal Data.

3. Processing description and permitted use

Annex A identifies the subject matter, duration, categories, purposes and affected individuals. SprintIQ accesses authorized Jira ticket-related fields, including descriptions (optional), comments, status/history, sprint data and relevant user identifiers. It does not access attachments or Jira Service Management customer requests according to the technical team’s stated configuration. It stores reporting data and analytics rather than complete Jira ticket copies. This description must be kept consistent with actual permissions and data flows.

AI insights use AWS Bedrock with Claude Sonnet 4.5 or later when enabled. Selected Jira ticket-related fields may be transmitted for inference; the precise field mapping and routing remain subject to technical verification.

4. Customer obligations

• Ensure lawful grounds, notices and permissions for data in Jira and for its authorized processing through SprintIQ.
• Manage Jira user authorization, permissions, accuracy and access to reports.
• Avoid including unnecessary special-category or sensitive information in fields accessible to SprintIQ; notify EduQuencher if special processing terms are needed.
• Respond to requests from Data Subjects concerning original Jira records, with EduQuencher’s reasonable assistance for data held by SprintIQ.

5. EduQuencher obligations

• Process Customer Personal Data only on documented instructions unless applicable law requires otherwise; give prior notice where legally permitted.
• Ensure authorized personnel are bound by confidentiality obligations and have need-to-know access.
• Implement appropriate technical and organizational safeguards and maintain written security procedures.
• Assist Customer, considering the nature of processing and information available, with Data Subject requests, security obligations, impact assessments and regulator consultations where legally required.
• On termination, delete or return data as described in Section 10 and Annex A.

6. Security and access

EduQuencher has confirmed TLS 1.2 for data in transit, encryption at rest for stored AWS S3 data, encrypted credentials, logical customer isolation and use of Atlassian Forge/Jira authentication. These safeguards do not replace separate privileged-access controls for AWS and EduQuencher systems. Annex B sets out the measures and explicitly identifies controls requiring implementation or verification. EduQuencher shall periodically review and update controls appropriate to the risk and notify Customer of material reductions where required.

7. AI services and safeguards

AI processing is provided through AWS Bedrock using the Anthropic Claude Sonnet 4.5 or later model. EduQuencher has stated that it does not store AI prompts or responses on its own systems; this statement does not establish the retention practices of AWS or underlying model providers. EduQuencher must verify provider-side handling and disclose material exceptions before finalizing this DPA. No Customer Personal Data may be used for model training by EduQuencher without a separate lawful authorization.

AI outputs can be inaccurate and require human review. The AI feature is not intended to make solely automated employment, compensation, disciplinary, or similarly consequential decisions.

8. Subprocessors

Customer authorizes the subprocessors identified in Annex C, subject to EduQuencher imposing appropriate written privacy and security obligations, remaining responsible for their performance as required by law, and maintaining an up-to-date list. EduQuencher will give reasonable advance notice of material new subprocessors and a mechanism for Customer to raise substantiated privacy objections; if an objection cannot be resolved, the parties will address affected services under the Agreement.

Marketplace Billing. For customers acquiring SprintIQ through the Atlassian Marketplace, payment processing, subscription management, invoicing, and related billing activities may be performed by Atlassian or its designated payment providers pursuant to the customer's agreement with Atlassian. EduQuencher does not directly process payment card information for Marketplace transactions and does not receive or store customers' full payment card details. Any personal data exchanged between the customer and Atlassian for billing, taxation, invoicing, or payment processing purposes is governed by the applicable Atlassian terms, privacy documentation, and data processing commitments. EduQuencher processes only the customer account, licensing, contact, and operational data necessary to provide, support, secure, and administer the SprintIQ application.

9. International transfers

EduQuencher reports AWS S3 hosting in US East (Northern Virginia), with backups and logs in the United States. The technical team also reports U.S.-only Bedrock inference; the actual inference profile and cross-region routing remain unverified. No unconditional promise of U.S.-only processing is made until that configuration is validated.

Where GDPR or UK GDPR transfer restrictions apply, the parties will execute and incorporate appropriate transfer terms, such as the EU Standard Contractual Clauses and UK Addendum/IDTA as applicable, with completed annexes and transfer assessments. This DPA alone is not a substitute for those instruments.

10. Retention, return and deletion

EduQuencher has represented that SprintIQ-held Customer Data, including reporting data and backups, is deleted within three (3) days after uninstallation or an authenticated deletion request, subject to specific legal retention obligations. Operational/security logs are also reported to have a 3-day retention period. EduQuencher will document and test these deletion processes and provide reasonable confirmation upon request. Deletion of data held in the original Jira instance remains Customer’s responsibility.

Where law requires retention, EduQuencher will limit the retained data to the required purpose, protect it and delete it once the obligation ends. If any data category cannot meet the stated period, the parties must amend the applicable retention schedule before execution.

11. Data Subject rights and cooperation

Customer is the primary contact for Data Subject requests regarding its Jira environment. EduQuencher will, on authenticated request, reasonably assist Customer in locating, accessing, exporting, correcting, restricting or deleting Customer Personal Data within SprintIQ, to the extent technically available and legally required. EduQuencher will promptly refer requests received directly from Data Subjects to Customer where appropriate and permitted.

12. Security incidents

EduQuencher shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, provide information reasonably available regarding its nature, scope, likely consequences and mitigation, and supplement the notice as the investigation progresses. Notification does not constitute an admission of liability. The parties will cooperate on required regulatory and Data Subject notices.

EduQuencher will separately meet any notification deadlines owed to Atlassian under its applicable Marketplace agreement. The operational incident-response procedure must designate a named owner and backup, escalation contacts, evidence preservation and notification tracking before launch.

13. Compliance information and audits

EduQuencher will make information reasonably necessary to demonstrate compliance available to Customer and permit and contribute to audits or inspections where mandated by applicable law. The parties will ordinarily use recent independent reports, questionnaires and documentation first. On-site inspections will be coordinated with reasonable notice, confidentiality safeguards and controls to protect other customers; these conditions do not limit mandatory statutory audit rights.

14. Liability, priority and governing law

Liability is governed by the Agreement except to the extent a limitation is unenforceable under applicable law or mandatory transfer clauses. If this DPA conflicts with the Agreement regarding Customer Personal Data processing, this DPA controls; applicable mandatory transfer clauses take precedence over inconsistent provisions. New Jersey law applies only insofar as not displaced by mandatory privacy or transfer law.

15. Term and contacts

This DPA begins on its Effective Date and remains in force while EduQuencher Processes Customer Personal Data under the Agreement, including applicable deletion and confidentiality periods. Notices: privacy@sprintiq.eduquencher.com; operational support: support@sprintiq.eduquencher.com. Company website: https://sprintiq.eduquencher.com.

ANNEX A — Processing details

Subject matter

SprintIQ for Jira analytics, reporting and customer-enabled AI insights.

Duration

Term of services plus documented 3-day deletion/retention period, except mandatory legal retention.

Nature and purposes

Authorized API access, analysis, aggregation, reporting, optional Bedrock inference, troubleshooting, security and deletion.

Data subjects

Jira users, team members, assignees, reporters and individuals named in ticket text.

Data categories

Ticket descriptions/comments and metadata, workflow/sprint information, account identifiers, names and derived analytics, operational logs.

Storage

Data will be in the database and backups will be stored in AWS S3, Northern Virginia; no complete ticket repository.

Exclusions

Attachments and Jira Service Management customer requests.

AI

AWS Bedrock / Claude Sonnet 4.5 or later; enabled or disabled by customer in future. Exact field mapping and inference profile require verification.

Deletion

3 days after uninstall/authenticated request for SprintIQ-held data and backups; logs retained 15 days.

ANNEX B — Security measures and verification

Confirmed by technical team

TLS 1.2; encryption at rest in S3; encrypted credentials; tenant isolation; Jira/Forge user authentication; AWS administrator MFA reported enabled; HSTS reported enabled.

Required operating controls

Least privilege and access reviews; security incident escalation and documented notification; vulnerability and patch management; secure backups; deletion testing; change management.

Logging remediation

Technical team reported names and possibly emails in logs. Remove or mask personal data and prohibit credentials, secrets and ticket text in logs; verify against Atlassian requirements.

Evidence before execution

Document encryption/key configuration, access review cadence, deletion tests, log masking, AWS Bedrock profile and provider data-handling settings.

ANNEX C — Subprocessor and transfer register

Amazon Web Services (AWS)

AWS S3 hosting and AWS Bedrock inference; reported U.S. infrastructure; specific inference profile pending.

Anthropic / Claude model

Model supplied through AWS Bedrock. Confirm whether Anthropic receives Customer Personal Data or is a separate subprocessor under the actual service architecture.

Atlassian Marketplace Billing

Customer billing contact information, including billing name, email address, billing address, tax information, subscription, licensing, invoicing, and payment-related records processed in connection with Atlassian Marketplace transactions. Atlassian acts as the marketplace operator and billing provider pursuant to the customer's agreement with Atlassian. No Jira issue, sprint, or project content is processed for billing purposes.

Additional subprocessors

None reported for Customer Personal Data; verify actual support, monitoring, telemetry and cloud services before execution.