Data Privacy Policy for the Use of Jira and Jira Cards

Last Updated: May 2025

Controller according to GDPR

Qvest Digital AG
Am Dickobskreuz 10
53121 Bonn, Germany
Email: info@qvest-digital.com

Data Protection Officer

Email: datenschutzbeauftragter@qvest-digital.com

1. Purpose of Data Processing

Qvest Digital AG uses the project management software Jira (self-hosted on-premises instance) for the organization and documentation of projects, tasks, tickets, and performance data. Additionally, the "Jira Cards" app is used to visually represent tasks and improve internal team collaboration (e.g., via digital boards or printouts). Data processing serves structured project management, resource allocation, time tracking, as well as improving transparency and efficiency in teamwork.

2. Categories of Data Subjects

The processing concerns the following groups of individuals:

• Employees of Qvest Digital AG
• External partners (e.g., service providers, freelancers)
• Customers (e.g., for support tickets or project involvement)

3. Categories of Data Processed

In particular, the following personal data are processed:

• Identification data: Name, username, email address
• Communication content: Task descriptions, comments, attachments
• Work and performance data:
  • Recorded working hours
  • Processing histories and status changes
  • Task distributions, assignments, activity data
• Representations by Jira Cards:
  • Visualized tasks including personal assignment (name, avatar)
  • Printouts or digital previews with personal content
• Technical access data (e.g., in logs): IP address, device, timestamp
• Cookies: Jira uses necessary cookies such as JSESSIONID, atlassian.xsrf.token, as well as potentially app-related cookies (e.g., Jira Cards for UI optimization)

4. Legal Basis for Processing

• Art. 6(1)(b) GDPR – for the fulfillment of (employment) contractual obligations
• Art. 6(1)(f) GDPR – legitimate interest in efficient project and teamwork, documentation, and quality assurance

Note: Jira Cards is only used to display existing task content. No independent analysis or performance evaluation is carried out by this app.

5. Recipients of the Data

Recipients of the data are:

• Within Qvest Digital AG: Project teams, team leaders, support
• External project participants and customers (where necessary)
• The "Jira Cards" app is integrated directly into the local Jira instance as an extension. No data is transferred to third parties through it.

6. Storage Period

Jira content (including Jira Cards) is stored permanently as long as it is required for documentation, billing, or project work. There is currently no automated deletion concept. Logs may be overwritten by system updates.

7. Rights of Data Subjects

Data subjects have the following rights according to GDPR:

• Right to access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to object to processing
• Right to data portability

Contact via: datenschutzbeauftragter@qvest-digital.com

8. Obligation to Provide Data

The provision of data is necessary to use Jira and Jira Cards within the scope of operational project work. Without this data, participation is not possible.

9. Information on Cookies

Jira uses technically necessary cookies (e.g., JSESSIONID, atlassian.xsrf.token) for authentication and security. Jira Cards may also use functional cookies (e.g., for display settings). Cookies requiring consent are not used in this on-premises instance, the legal notice and this privacy policy.