Trace Gap Data Processing Agreement
Trace Gap: Requirements Traceability & Coverage for Jira · Bobook Limited
This Data Processing Agreement ("DPA") forms part of the agreement between Bobook Limited, Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland ("Processor") and the customer organisation that installs Trace Gap ("Controller"), and governs processing of personal data under Article 28 of the EU General Data Protection Regulation (GDPR).
Version 1.0 · 1 September 2026
1. Roles
The Controller determines the purposes and means of processing personal data in its Jira site. Bobook Limited acts solely as a Processor and processes personal data only on the Controller's documented instructions, which for this app are given by installing and configuring it.
2. Subject matter, duration, nature and purpose
Subject matter. Providing the Trace Gap app.
Duration. For as long as the app is installed on the Controller's site.
Nature and purpose. Reading work item data already present in the Controller's Jira site in order to produce a report identifying requirements that have no linked verification, and to return that report to the user who requested it.
3. Types of personal data
Work item content read transiently to build the report: work item key, summary, issue type, status, and issue links.
Bobook Limited does not store this data. It is read when a report is run, held in memory for the duration of that request, returned to the requesting user's browser, and discarded.
The only data the app stores is configuration: the project key, and the names of the issue types and link types the administrator selected.
4. Categories of data subjects
Users of the Controller's Jira site whose names or other personal data may appear within work item content.
5. Where processing happens
Entirely within Atlassian's cloud, on the Atlassian Forge platform. The app declares no egress permissions and makes no network calls outside Atlassian. No personal data is transmitted to Bobook Limited or to any third party.
6. Sub-processors
Atlassian Pty Ltd, which hosts both the Controller's Jira site and the app.
There are no other sub-processors. Bobook Limited will inform the Controller before adding or replacing a sub-processor, and the Controller may object.
7. Security measures
- The app requests read-only scopes (
read:jira-work) and cannot create, edit or delete anything in Jira. This is enforced by the Atlassian platform. - All reads are performed as the signed-in user, so the app cannot expose data that user could not already access.
- No egress. The app cannot transmit data outside Atlassian.
- No work item data is persisted; only configuration is stored, in Atlassian's Forge storage.
- Access to the app's source and deployment is limited to Bobook Limited personnel using multi-factor authentication.
Bobook Limited holds no security certifications, and none is claimed.
8. Confidentiality
Personnel authorised to process personal data are bound by confidentiality.
9. Assisting the Controller
Because the app stores no personal data, requests from data subjects for access, rectification, erasure, restriction, portability or objection are satisfied by the Controller within Jira itself. Bobook Limited will assist on request as far as the nature of the processing allows.
10. Personal data breach
Bobook Limited will notify the Controller without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting the Controller's personal data, at the administrative contact on record.
11. Deletion
Uninstalling the app removes its stored configuration. No work item data is retained at any point, so no further deletion is required.
12. Audit
Bobook Limited will make available the information necessary to demonstrate compliance with Article 28 and will contribute to audits conducted by the Controller or its auditor, on reasonable notice and no more than once a year unless required by a supervisory authority.
13. International transfers
Processing takes place within Atlassian's infrastructure under Atlassian's own data residency and transfer arrangements. Bobook Limited itself is established in Ireland and does not transfer personal data outside the EEA.
14. Contact
support@bobook.club — Bobook Limited, Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland.
Requests to sign a counterpart DPA on the Controller's own paper are welcome at the same address.