JAMEs — Data Processing Agreement

Using this DPA

This Data Processing Agreement (the “DPA”) consists of (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at commonpaper.com/standards/data-processing-agreement/1.1 (the “DPA Standard Terms”), which are incorporated by reference. If there is any inconsistency between the parts of this DPA, this Cover Page controls over the DPA Standard Terms. Capitalized words have the meanings given on this Cover Page or in the DPA Standard Terms. Where this Cover Page omits or does not define a term, its meaning is “none” or “not applicable”.

This DPA forms part of the JAMEs Terms of Service. The Customer electronically accepts this Cover Page by accepting the JAMEs Terms of Service. A countersigned copy is available on request to hello@viter.io. Provider and Customer have not changed the DPA Standard Terms except as set out on this Cover Page.

Key Terms

Agreement	This DPA supplements the JAMEs Terms of Service published at /legal.html#terms, as accepted by the Customer (the “Agreement”).
Provider	Present Training and Guidance, licensed sole proprietorship (osek murshe), owned by Ben Friedman, HaRishonim 100, Haifa, Israel.
Customer	The person or entity that accepted the Agreement, as identified in its JAMEs account.
Approved Subprocessors	Render. Country of location: Germany. Anticipated Processing task: hosting of the Service. Neon. Country of location: Germany. Anticipated Processing task: database storage. GitHub, Inc. (Microsoft). Country of location: United States. Anticipated Processing task: storage of backup copies of the Service database, each kept for 30 days. Anthropic. Country of location: United States. Anticipated Processing task: AI model processing of conversations and Customer Personal Data retrieved from the Connected Site. Inputs and outputs retained by Anthropic for up to 30 days; not used for model training. Langfuse. Country of location: European Union. Anticipated Processing task: operational telemetry of conversation content and tool inputs and outputs, including data retrieved from the Connected Site, linked to a pseudonymous account identifier; excludes API tokens; retained for 30 days. Google. Country of location: United States and other countries. Anticipated Processing task: delivery of account-related emails to Authorized Users.
Provider Security Contact	Ben Friedman, hello@viter.io
Security Policy	Provider will use commercially reasonable efforts to secure the Service from unauthorized access, alteration, or use and other unlawful tampering, including by maintaining the measures listed in Annex II. The Provider’s trust & security page at /trust.html describes these measures.

Changes to the DPA Standard Terms

Security Incident notification	In Section 4 (Security Incident Response) of the DPA Standard Terms, “no later than 72 hours after becoming aware of the Security Incident” is replaced with “no later than 96 hours after becoming aware of the Security Incident”.
Security Reports	Section 5.2 (Security Reports) of the DPA Standard Terms does not apply. The Provider is not currently audited by independent third-party auditors and no Report is available. Section 5.3 (Security Due Diligence) applies.
Service Provider Relationship	To the extent the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”) applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws.

The limitations of liability and the governing law and jurisdiction set out in the Agreement apply to this DPA, subject to Section 8 (Limitation of Liability) of the DPA Standard Terms.

Restricted Transfers

Governing Member State	EEA Transfers: Ireland UK Transfers: England and Wales

The Provider is established in Israel, which is subject to an adequacy decision of the European Commission.

Annex I

I(A) Data Exporter	Name: Customer Address and contact person: as provided in the Customer’s JAMEs account Activities relevant to transfer: see Annex I(B) Role: Controller or Processor, as applicable
I(A) Data Importer	Name: Provider (Present Training and Guidance) Address: HaRishonim 100, Haifa, Israel Contact person: Ben Friedman, Owner, hello@viter.io Activities relevant to transfer: see Annex I(B) Role: Processor
I(B) Service	JAMEs, an AI-assisted administration service for Atlassian Jira Cloud sites.
Categories of Data Subjects	Customer’s employees, contractors and other users of the Connected Site Customer’s end users or customers whose data is contained in the Connected Site, including requesters in Jira Service Management Authorized Users of the Customer’s JAMEs account
Categories of Personal Data	Name Contact information such as email address Atlassian account identifiers, group memberships and permission assignments Any Personal Data contained in issue content (including summaries, descriptions, comments and field values) retrieved to perform a task requested by an Authorized User
Special Category Data	The Service is not designed to process Special Category Data. Customer will not direct the Service to retrieve Jira content that Customer knows to contain Special Category Data.
Frequency of Transfer	Continuous, for as long as the Customer uses the Service.
Nature and Purpose of Processing	Provider will Process Customer Personal Data as instructed in Section 2.2 of the DPA Standard Terms. The nature of processing includes: Receiving data, including collection, accessing, retrieval, recording, and data entry Holding data, including storage, organization, and structuring Using data, including analysis and consultation, to generate responses and Change Plans Updating data, including alteration of the Connected Site configuration, solely in accordance with Approved Change Plans Protecting data, including restricting and encrypting Erasing data, including destruction and deletion
Duration of Processing	Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)–(d) of the DPA Standard Terms; or (ii) by Applicable Laws. Retention periods are set out in Section 4 of the Privacy Policy.
I(C) Competent Supervisory Authority	The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Annex II — Technical and Organizational Security Measures

Encryption of personal data	Stored Atlassian API tokens are encrypted at rest with AES-256-GCM using per-user derived keys. Customers may instead use session-only tokens, which are not written to the Provider’s database. Passwords are stored only as Argon2 hashes.
Protection in transit	All connections between Authorized Users’ browsers, the Service, its database and Approved Subprocessors are encrypted in transit with TLS.
Protection at rest	The Service database is encrypted at rest. Backups are stored for 30 days in a private, access-restricted repository hosted by GitHub.
User identification and authorization	Idle sessions are automatically logged out. Accounts are locked after five failed sign-in attempts. Session refresh tokens are held in httpOnly cookies.
Integrity of processing	Changes to a Connected Site are executed only after an Authorized User approves a Change Plan. Before each change, server-side code checks that the type of change and the object it affects are included in the Approved Change Plan. Deletion of objects from a Connected Site (as defined in Section 7.3 of the Terms) is available only on the Premium plan and requires, in addition to approval of the Change Plan, a separate confirmation of the deletion by an Authorized User.
Access limitation	The Service accesses a Connected Site only with the permissions of the Atlassian account whose API token the Customer supplies.
Data minimization	Issue content is retrieved only when required for a task requested by an Authorized User. Automation rules are retrieved only when the Customer uses automation features. Telemetry is linked to a pseudonymous account identifier and excludes API tokens.
Limited retention	Conversation history and automation-rule change history are retained for the periods set out in Section 4 of the Privacy Policy. Customer Data and account data are deleted within 30 days after account deletion; backup copies expire within a further 30 days.
Events logging	Changes executed by the Service on a Connected Site are recorded in a change record, which is kept for as long as the Customer's account exists and is available to the Customer on request to hello@viter.io. On the Pro and Premium plans, changes to automation rules are also shown in the Service for the retention period set out in Section 4 of the Privacy Policy.
Location	The Service and its database are hosted in Germany.

Based on the Common Paper Data Processing Agreement, available at commonpaper.com. Licensed under CC BY 4.0. Copyright Common Paper, Inc.