Pristine Bytes Logo

Privacy Policy

1. Overview

Protecting your data and your privacy is a high priority and is very important to us. Pristine Bytes is pursuant to German law (“We”, “us” or “our”) adhere to a strict policy for ensuring the security and privacy of your data, in particular, your personally identifiable information (such as name, address, email address, and/or other identifiable information, collectively such personally identifiable information “Personal Data”).

We provide hosted services (“Cloud Apps”) for Atlassian Cloud Products (“Atlassian Cloud Product”) via the Atlassian Marketplace (https://marketplace.atlassian.com/). The apps are built on and delivered through the Atlassian Forge platform and run on Atlassian’s infrastructure. Cloud Apps can be identified by the “Cloud” category in the corresponding Atlassian Marketplace listing.

This Privacy Policy provides you with an overview of the collection and processing of your data.

In the following, all data processed by you via an Atlassian Cloud Product and one of our Apps are defined as “Customer Data”.

2. Name and Address of the Controller pursuant to Art. 4 No. 7 GDPR

Pristine Bytes
Daniel Kleinert
Sternbergstr. 15
76131 Karlsruhe
Germany

Phone: +49 721 90 981 444
Email: support@pristinebytes.com

3. General Information regarding the Data Processing

a) Scope of the data processing

We only collect and use personal data of our users insofar as this is necessary to provide our services. The collection and use of personal data of our users regularly takes place only with the user’s consent. An exception applies in those cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

b) Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para.1 s.1 lit.a GDPR serves as the legal basis.

If the processing of personal data is required for the performance of a contract to which the data subject is a party, Art. 6 para.1 s.1 lit.b GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

Insofar as the processing of personal data is required to fulfil a legal obligation to which our company is subject, Art. 6 para.1 s.1 lit.c GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para.1 s.1 lit.f GDPR serves as the legal basis for processing.

c) Data deletion and storage period

Your personal data will be deleted or blocked as soon as the purpose of storage ceases to apply. Data may be stored beyond that time if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which we are subject.

The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.

Where data is processed by the service providers named in section 7, the following retention periods apply in addition:

  • Data stored by our Cloud Apps on the Atlassian Forge platform is retained for the duration of the installation. After the app is uninstalled, Atlassian deletes this data after 28 days.
  • Error and access reports stored with Sentry are deleted after 30 days.
  • Usage analytics stored with Mixpanel are deleted after 2 years.
4. Your Rights as Data Subject

You have the following rights towards us regarding your personal data:

  • Right to information,
  • Right to correction or deletion,
  • Right to restrict processing,
  • Right to object to the processing,
  • Right to data transferability.

Please send an email to support@pristinebytes.com in order to exercise one or more of the aforementioned rights. If you believe that the processing of personal data concerning you violates the GDPR, you have the right of appeal to a supervisory authority, without prejudice to any other remedies.

If you have given your consent to the processing of your data, you can revoke this at any time. Such revocation affects the permissibility of processing your personal data after you have given it to us.

If we base the processing of your personal data on the balancing of interests, you may object to the processing. This is the case if processing is not necessary, in particular, to fulfil a contract with you, which is described by us in the following description of the functions. When exercising such objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will examine the situation and either stop or adjust data processing or point out to you our compelling reasons for protection, on the basis of which we will continue processing.

Of course, you can object to the processing of your personal data for purposes of advertising and data analysis at any time. You can inform us about your advertising contradiction under the following contact data: support@pristinebytes.com.

5. General Information regarding Data Processing with our Cloud Apps

Our Cloud Apps run on the Atlassian Forge platform. Unless otherwise stated below our Cloud Apps do not store Customer Data on infrastructure operated by us, but store Customer Data in the corresponding Atlassian Cloud Product and in the storage provided by Atlassian Forge. This section describes the processing carried out by our Cloud Apps; processing in connection with our website is described in section 9.

Exceptions:

Account Data: The installation of our Cloud Apps and the validation of licences are handled by Atlassian. We receive from Atlassian the data required for licence validation, contract administration and communication with you as our customer. This includes your customer ID, the URL of the Atlassian Cloud Product instance and the installation and licence status. We do not store any access keys or other credentials for your instance; authentication is handled entirely by the Atlassian Forge platform.

Operation Data: Our Cloud Apps temporarily process Customer Data which is required for the operation of the service. Such data for example includes macros, issue and page content or attachments accessible by the app. This data is processed for the duration of the respective operation only and is not stored by us beyond it.

Customer Uploaded Data: Configuration data which you create in our Cloud Apps using the user interface is stored within your own Atlassian Cloud Product instance and in the storage provided by Atlassian Forge. We do not store this data on infrastructure operated by us.

Session Data: Our Cloud Apps transmit data resulting from your use of the service to us, in order to detect and correct faults and to understand how the apps are used. This is limited to:

Error and access reports:

  • stack traces of the error that occurred
  • the version of the app
  • browser
  • operating system
  • the URL of your Atlassian Cloud Product instance.

Usage analytics:

  • an anonymous session identifier
  • names of the events triggered (for example, that a download was started)
  • counts and sizes (for example, the number and total size of processed attachments)
  • a one-way hash of the app configuration used.

Error reports are transmitted by all of our Cloud Apps. Usage analytics are transmitted by “Bulk Attachment Download” only; “Mind Maps for Confluence” does not transmit usage analytics.

The contents of JQL queries and of attachment filters are excluded from both error reports and usage analytics. Section 7 states which service providers receive this data.

The session identifier is generated when you open one of our Cloud Apps and exists only for the duration of that use. It is not stored on your device and is discarded when you navigate away.

The legal basis for this processing is Art. 6 para.1 s.1 lit.f GDPR; our legitimate interest lies in detecting and correcting faults in our Cloud Apps and in improving them.

You can stop this data from being transmitted at any time. In Atlassian Administration under “Connected apps”, your administrator can disable analytics access and log access for our Cloud Apps; the Atlassian Forge platform then blocks the transmission of this data to the service providers named in section 7. Independently of this, you can object to the processing of your personal data in accordance with section 4. Please note, however, that the data described above contains no information which would enable us to identify you or to assign this data to you. We are therefore not able to locate individual records, to delete them or to stop their transmission for individual users; the transmission can only be switched off for the entire Atlassian Cloud Product instance using the setting described above.

6. Specific Information regarding particular Cloud Apps
  • Bulk Attachment Download: Each bulk download writes an entry to the logs of your own Atlassian Cloud Product instance. This entry contains the account ID of the user performing the download, the JQL query and attachment filter used (these may contain content from your instance) and the number and total size of the resulting attachments. These logs are held by Atlassian within your own instance. Atlassian grants us access to this log data by default; we do not retrieve or store this log data. You can withdraw this access at any time in Atlassian Administration under “Connected apps” by disabling log access. Beyond this, no additional data is stored.
  • Mind Maps for Confluence: No additional data is stored. This app transmits error reports only and does not transmit usage analytics.
7. Data Location

Our Cloud Apps run on the Atlassian Forge platform and are hosted by Atlassian. Customer Data processed and stored by our Cloud Apps therefore remains within the Atlassian Cloud Product and is processed in the region in which your own Atlassian Cloud Product instance is operated. The Atlassian privacy policy can be found at https://www.atlassian.com/legal/privacy-policy.

In addition, we use the following service providers for the Session Data described in section 5:

  • Sentry (Functional Software, Inc.) receives the error and access reports and stores them for us, so that we can detect and correct faults in our Cloud Apps. This data is processed in the USA. The Sentry privacy statement can be found at https://sentry.io/privacy/.
  • Mixpanel (Mixpanel, Inc.) receives the usage analytics and stores them for us, so that we can understand how our Cloud Apps are used and improve them. This data is processed in the USA. The Mixpanel privacy statement can be found at https://mixpanel.com/legal/privacy-policy/.

Our website is hosted separately from our Cloud Apps; see section 9.

8. Access to Customer Data

To some extent, we use external service providers to process your data (e.g. Atlassian, Sentry, Mixpanel, Netlify). These have been carefully selected and commissioned by us, are bound by our instructions and are checked regularly. Our external service providers process your personal data on the basis of a data protection agreement that complies with legal requirements.

These service providers belong to the following categories:

  • hosting service providers,
  • billing service providers,
  • communication service provider,
  • fault and malfunction analysis service providers,
  • analytics service providers.

Some of the external service providers named above are located in the United States and therefore in a third country outside the European Union. In order to guarantee an adequate level of data protection for these transfers, we rely on the following safeguards:

(i) On 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to organisations certified under the EU-U.S. Data Privacy Framework (Commission Implementing Decision C(2023) 4745). Sentry (Functional Software, Inc.), Mixpanel, Inc. and Netlify, Inc. are certified under the EU-U.S. Data Privacy Framework. Transfers to these service providers are therefore made on the basis of Art. 45 para.1 GDPR. The current certification status of these providers can be checked at https://www.dataprivacyframework.gov/list.

(ii) In addition, we have concluded standard data protection clauses with these service providers pursuant to Art. 46 para.2 lit.c GDPR in the version of Commission Implementing Decision (EU) 2021/914 of 4 June 2021. These continue to apply should the certification of a service provider under the EU-U.S. Data Privacy Framework cease to be valid.

The inclusion of the service providers is based on Art. 6 para.1 s.1 lit.f GDPR. It is necessary in order to be able to provide the services.

9. Our Website

This section applies to our website at https://www.pristinebytes.com and not to our Cloud Apps.

Our website is a static website hosted by Netlify (Netlify, Inc.). The Netlify privacy statement can be found at https://www.netlify.com/privacy/. When you access our website, our hosting provider processes the following data in server log files on our behalf, which is technically necessary in order to deliver the website and to ensure its stability and security:

  • IP-address
  • date and time of the request
  • time zone difference to Greenwich Mean Time (GMT)
  • content of the request (specific page)
  • access status/HTTP status code
  • the amount of data transferred in each case
  • website from which the request comes
  • browser
  • operating system and its surface
  • language and version of the browser software.

The legal basis for this processing is Art. 6 para.1 s.1 lit.f GDPR; our legitimate interest lies in the secure and reliable provision of our website. This data is deleted as soon as it is no longer required to achieve the purpose for which it was collected; in the case of the server log files, this is the case after no more than 30 days. This data is not merged with other data sources.

We do not use analytics services, tracking services or advertising cookies on our website.