Firnity Discord for Confluence DATA PROCESSING AGREEMENT
(hereinafter: “DPA”)
1. Introduction & Definitions
1.1. DPA and its purpose
The DPA is an agreement under which an entity purchasing Application or otherwise accessing Application in accordance with Terms of Use (as defined in Section 1.2.1 below) entrusts Personal Data for Processing to Łukasz Wiatrak (described in Section 1.2.2 below), who is the creator and provider of Application.
In its relationship with Łukasz Wiatrak while using Application, the entity referred to in Section 1.2.1 below is Controller within the meaning of GDPR, and Łukasz Wiatrak is Processor within the meaning of GDPR, to the extent Łukasz Wiatrak Processes Personal Data on that entity's behalf. This DPA provides the terms required for such Processing under Article 28 GDPR.
1.2. Parties of DPA
1.2.1. Any business entity or organization that purchases, accesses, or uses Application for business purposes and determines the purposes and means of Processing entrusted Personal Data, acting as Controller within the meaning of GDPR;
1.2.2. Łukasz Wiatrak, doing business as “Łukasz Wiatrak Firnity” (the “Service Provider”), with its registered seat in Kraków (address: registered office at ul. Zamknięta 10, lok. 1.5, 30-554 Kraków, Poland), having Tax Identification Number (NIP): 5130127144 and Statistical Number (REGON): 520124248, acting as Processor within the meaning of GDPR.
Controller and Processor are collectively referred to as the “Parties” and individually as a “Party.”
1.3. Definitions
1.3.1. Application: “Firnity Discord for Confluence,” a cloud application developed by Service Provider to integrate Atlassian Confluence Cloud with Discord, as described in Section 2 of Terms of Use.
1.3.2. GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to Processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC.
1.3.3. Personal Data: any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR and Terms of Use.
1.3.4. Controller: the controller within the meaning of Article 4(7) GDPR, meaning the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of Processing Personal Data. In this DPA, Controller is the entity defined in Section 1.2.1.
1.3.5. Processor: the processor within the meaning of Article 4(8) GDPR, meaning a natural or legal person, public authority, agency, or other body that Processes Personal Data on behalf of Controller. In this DPA, Processor is Łukasz Wiatrak Firnity, described in Section 1.2.2.
1.3.6. Processing: any operation or set of operations performed on Personal Data, including collection, recording, organization, storage, retrieval, consultation, use, transmission, restriction, erasure, or destruction, as defined in Article 4(2) GDPR.
1.3.7. Sub-Processor: a third party engaged by Processor to Process Personal Data on behalf of Controller under this DPA.
1.3.8. Supervisory Authority: an independent public authority established under Article 51 GDPR.
1.3.9. Services: Application and related services provided by Processor, including support and feedback mechanisms.
1.3.10. Terms of Use: the document governing Controller's access to and use of Application, available here.
1.3.11. Privacy Policy: the document describing how Service Provider Processes and protects Personal Data in connection with Application and Services, available here.
1.4. Integration with other documents
The DPA is an integral part of the Agreement between Parties for Controller's use of Application. The other documents forming that legal relationship include Terms of Use, Privacy Policy, and documents to which they refer. If DPA conflicts with Terms of Use, DPA prevails concerning Processing on behalf of Controller. Privacy Policy provides notice and does not reduce Controller's or Processor's obligations under DPA.
Capitalized terms in DPA have the meanings given in DPA or Terms of Use. In case of inconsistency, the meaning given in DPA prevails.
2. Subject of DPA
2.1. Authorization to entrust data to Sub‑processors
Controller entrusts Processor with Personal Data concerning Confluence administrators and users, Discord administrators and members, Personnel, User's Clients, people whose content is included in configured workflows, and people contacting Processor for support or feedback to the extent that information is Processed on Controller's behalf. Controller authorizes the engagement of Sub-Processors under Section 5.
2.2. Purpose of Processing
Processor is entitled to Process entrusted Personal Data during Controller's authorized use of Application and for the purposes documented in Terms of Use, Privacy Policy, Controller's configuration, and Controller's requested actions, in particular to:
2.2.1. Provide Application functionality, including authorized notification, summary, search, sharing, link-preview, page-list, panel, linked-discussion, and Discord-to-Confluence creation or action workflows between Confluence and Discord;
2.2.2. Maintain Application and provide customer support, feedback handling, and bounded operational diagnosis to the extent performed on Controller's behalf;
2.2.3. Protect the confidentiality, integrity, availability, and authorized use of Application and assist Controller with applicable data-protection obligations.
2.3. Methods of Processing
Processing is carried out primarily through information systems. Processor may Process limited information in documentary or paper form where reasonably necessary for legal, contractual, audit, or support purposes and subject to equivalent protection.
2.4. The scope of Processing
Processing may include collection, recording, organization, structuring, storage, retrieval, consultation, use, transmission to Controller's configured platforms and recipients, restriction, correction, return, erasure, and destruction of Personal Data.
2.5. The scope of Personal Data entrusted for Processing includes
2.5.1. Confluence data
- Atlassian account IDs, display names and avatars where needed by a workflow; Confluence cloud IDs and site URLs; Forge application, environment and installation IDs; permission context; Marketplace license state; installation-scoped system tokens and expiry.
- Space IDs, keys and names; page and comment IDs, titles, URLs, labels, parent relationships, timestamps, and authors or actors.
- Notification, summary, page-list, create-command, panel, action, destination, schedule, filter, and linked-discussion metadata; event IDs and types, content and space IDs, notification-rule IDs, observation and delivery timestamps, final delivery status, Discord message IDs, and bounded failure details. Event and delivery records contain the IDs, status, and timestamps needed to process notifications. Application retrieves current Confluence content when a scheduled notification is sent.
- Page bodies, comments, event payloads, search results, create-page content, and attachments Processed for the duration of the requested workflow.
2.5.2. Discord data
- Discord user IDs, usernames and global display names; server IDs and names; role, channel, thread, message and destination IDs; source-message URLs; selected message content; command and modal values; attachments; interaction and permission context; and delivery responses needed for authorized workflows.
- Linked Discord user IDs and Atlassian account IDs, installation associations, status, and timestamps; linked-discussion, configuration, and delivery metadata. Names are retrieved when needed to display accounts and recipients. Discord OAuth access and refresh tokens are discarded after an account or server connection is verified.
2.5.3. Support and Feedback data
- Names, email addresses, organization names or tenant IDs, relevant account or resource IDs, timestamps, diagnostic descriptions, correspondence, complaint information, data-subject request information, and vulnerability-report material voluntarily provided to Processor and Processed on Controller's behalf. Service Provider's separate controller-side Processing for direct vendor administration, legal compliance, support, and vulnerability handling is described in Privacy Policy.
Application is not intended to collect special categories of Personal Data under Article 9 GDPR or criminal-conviction data under Article 10 GDPR as a distinct purpose. Controller must not instruct Processor to Process such data unless the Parties have established a lawful basis and any additional required safeguards. User-generated Confluence or Discord content may nevertheless contain such data if Controller or its users include it.
2.6. Data Processing period and further proceeding
Processor Processes Personal Data for the duration of Controller's use of Application and thereafter only as necessary to perform termination, return, erasure, security, dispute, or legal-retention obligations. At Controller's choice after Services relating to Processing end, Processor returns or deletes entrusted Personal Data unless applicable law requires retention. The applicable retention periods and request procedure are described in Privacy Policy.
3. Declarations and Obligations of Processor
3.1. Technical and organisational measures of Processor
Processor undertakes to implement technical and organizational measures appropriate to the nature, scope, context, and risks of Processing so that Processing under the Agreement meets applicable GDPR requirements and protects data-subject rights. The measures used to protect Application data are described in the Security Overview.
3.2. Controller’s instructions
Processor Processes Personal Data only on Controller's documented instructions, as expressed in this DPA, Terms of Use, Controller's Application configuration, and authorized actions. By accepting the Agreement, Controller instructs Processor to Process Personal Data for the purposes in Section 2, including providing, maintaining, securing, and supporting Application and fulfilling legal obligations applicable to Processor.
3.3. General declarations and obligations
Processor agrees to Process Personal Data entrusted to it in accordance with DPA, Terms of Use, Controller's lawful documented instructions, and applicable law. In particular, Processor:
3.3.1. Processes Personal Data only on documented instructions from Controller, including concerning transfers to a third country or international organization, unless Union or Member State law applicable to Processor requires otherwise; in that case, Processor informs Controller before Processing unless the law prohibits notice on important grounds of public interest;
3.3.2. Ensures that persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory duty of confidentiality and receive appropriate data-protection instruction;
3.3.3. Takes measures required under Article 32 GDPR, considering the state of the art, implementation costs, nature, scope, context, purposes, and risks of Processing;
3.3.4. Does not transfer Personal Data outside the European Economic Area except on Controller's documented instruction, where necessary to use Controller's selected Atlassian or Discord environment, or under a lawful transfer mechanism such as an adequacy decision or applicable standard contractual clauses;
3.3.5. Reviews and evaluates the effectiveness of implemented measures at intervals proportionate to the risks and after a material change or incident;
3.3.6. Taking into account the nature of Processing, assists Controller through appropriate technical and organizational measures, insofar as possible, to fulfill Controller's obligation to respond to requests for exercise of data-subject rights under Chapter III GDPR;
3.3.7. Taking into account the nature of Processing and information available to Processor, assists Controller in ensuring compliance with Articles 32 to 36 GDPR;
3.3.8. After Services relating to Processing end, at Controller's choice, deletes or returns all Personal Data and deletes existing copies unless applicable Union or Member State law requires storage. Controller may send a return or erasure instruction to contact@firnity.com. Processor verifies the request before acting;
3.3.9. Makes available to Controller information reasonably necessary to demonstrate compliance with obligations under Article 28 GDPR and allows for and contributes to audits, including inspections, by Controller or an auditor mandated by Controller, subject to reasonable notice, confidentiality, security, non-disruption, and allocation of reasonable costs;
3.3.10. Documents Personal Data breaches known to Processor, including available facts, effects, and remedial action, and makes relevant documentation available to Controller where required;
3.3.11. Cooperates reasonably with Controller concerning proper Processing and communications with Supervisory Authorities;
3.3.12. Protects confidential provisions and Personal Data from disclosure except where disclosure is authorized by Controller or required by applicable law or an authorized Supervisory Authority;
3.3.13. Informs Controller of a legal requirement to retain Personal Data after Services relating to Processing end, unless prohibited by law.
3.4. Notification of Personal Data breach
Processor notifies Controller without undue delay after becoming aware of a Personal Data breach affecting Personal Data Processed under this DPA. Notification will include information available to Processor that Controller reasonably requires under Article 33(3) GDPR and may be provided in phases as information becomes available.
Processor reasonably cooperates with Controller and assists in investigating, mitigating, and remedying a Personal Data breach, proportionate to the nature of the breach and information available. This includes information reasonably necessary for Controller to assess required notices to Supervisory Authorities or affected data subjects.
4. Declarations and Obligations of Controller
4.1. Lawfulness of Processing
Controller ensures that Personal Data and instructions provided to Processor comply with GDPR and other applicable data-protection laws. This includes:
4.1.1. Establishing a Lawful Basis: obtaining any consent required by law or establishing another lawful basis, including for sensitive content and data sent to Discord;
4.1.2. Providing Information to Data Subjects: giving required notices about how Personal Data is used, shared with configured platforms and destinations, retained, and subject to data-subject rights, and determining the purposes and means of Processing within Controller's use of Application.
4.2. Instructions to Processor
Controller is responsible for clear, documented, lawful instructions to Processor as specified in DPA, Terms of Use, Application configuration, and authorized actions. Controller promptly informs Processor if instructions change or if Controller believes an instruction infringes GDPR or another applicable data-protection provision.
If Controller provides no additional instruction, Processor follows this DPA, Privacy Policy, Terms of Use, Controller's current Application configuration, and applicable law. Processor informs Controller if, in its opinion, an instruction infringes GDPR or another applicable Union or Member State data-protection provision.
4.3. Accuracy and Data Minimization
Controller is responsible for the accuracy and relevance of Personal Data it provides or makes available. Controller will configure and use Application to Process only Personal Data necessary for the intended workflow, select appropriate Discord destinations, prefer bounded content where possible, and avoid unrelated or excessive data.
4.4. Responding to Data Subject Requests
Controller is responsible for receiving and responding to requests from data subjects concerning Personal Data for which Controller determines the purposes and means. Processor assists Controller as required under Section 3 and the DPA, taking into account the nature of Processing and available functionality.
4.5. Compliance with Third‑Party Policies and Data Transfers
Controller acknowledges that Application functionality involves transferring Personal Data between Controller's Atlassian Confluence Cloud environment and Controller-selected Discord servers, channels, threads, or users. Controller is responsible for its accounts, notices, permissions, destination choices, lawful basis, and compliance with applicable Atlassian and Discord agreements.
After data is received by Controller's selected Atlassian or Discord service, that provider Processes it under the applicable relationship, instructions, and provider terms. Processor remains responsible for its own Processing and cannot disclaim duties imposed on Processor by GDPR or this DPA.
4.6. Indemnification
To the extent permitted by applicable law and Terms of Use, Controller shall indemnify Processor against third-party claims, damages, losses, liabilities, costs, and expenses arising from Controller's unlawful instructions, data, destination choices, or breach of its obligations under DPA or applicable data-protection law. This provision does not limit liability that cannot lawfully be excluded or Processor's responsibility for its own breach.
5. Sub‑Processing
5.1. Authorization to entrust data to Sub‑processors
Controller gives Processor general written authorization to engage Sub-Processors for Processing Personal Data under this DPA, subject to the requirements of this Section 5.
5.2. The scope of Processing by Sub‑processors
Sub-Processors may Process Personal Data only to the extent necessary to provide and support Application, including hosting, database, backup, infrastructure, app-platform, monitoring, and support-communication services identified on the Sub-Processors page. Customer-directed transmission to Atlassian and Discord is described in Section 4.5.
5.3. List of Sub‑processors
Processor may engage only Sub-Processors identified on the Sub-Processors page. The list describes their services, processing locations, and applicable transfer safeguards.
5.4. Declarations and Obligations of Processor
Processor:
5.4.1. Informs Controller of an intended addition or replacement of a Sub-Processor before the change takes effect, using the Trust Center, Marketplace, or an available direct customer contact, and gives Controller an opportunity to object;
5.4.2. Enters into written data-protection terms with each Sub-Processor that impose obligations no less protective than those required by Article 28 GDPR for the relevant Processing and selects providers offering sufficient guarantees;
5.4.3. Entrusts a Sub-Processor only with Personal Data necessary and justified for the purposes in Section 2.
5.5. Objection to changes of Sub‑processors
Controller may object on reasonable data-protection grounds by contacting Processor within 14 days after notice of a new or replacement Sub-Processor. The Parties will seek a reasonable solution. If none is available, Controller may discontinue affected Services and terminate the Agreement in accordance with Terms of Use. Continued use after the objection period, without an objection, constitutes authorization of the notified change to the extent permitted by law.
5.6. Liability
Processor remains liable to Controller for a Sub-Processor's performance of the data-protection obligations assigned to it, as required by Article 28(4) GDPR. This does not make Processor responsible for Controller's independently selected third-party accounts, instructions, or actions outside Processor's control.
6. Final Provisions
6.1. Complete agreement
This DPA, together with Terms of Use, Privacy Policy, the Sub-Processors page, and applicable Order, constitutes the agreement between Controller and Processor concerning the Processing covered by DPA and supersedes prior terms concerning the same subject matter.
6.2. Governing law
DPA is governed by the laws of Poland, without limiting mandatory rights or remedies under GDPR or other applicable data-protection law.
6.3. Dispute resolution, general court jurisdiction and territorial jurisdiction of the court
The Parties will seek to settle disputes concerning DPA amicably.
If a dispute cannot be resolved, it will be submitted to the competent courts in Poland having territorial jurisdiction under applicable law, without limiting the powers of a competent Supervisory Authority or mandatory data-subject rights.
6.4. Change of DPA
Processor may update DPA by publishing the revised version and providing notice through the Trust Center, Marketplace, or an available direct customer contact. A material change that requires Controller's agreement will not take effect merely through continued use where applicable law requires express agreement. Controller may object or terminate affected Services under Terms of Use.
Effective date: [publication date].
6.5. Application of law
To the extent not regulated by DPA, applicable Polish law, GDPR, and other applicable Union or international data-protection rules apply.