This Data Processing Addendum ("DPA") forms part of the End User License Agreement between the customer ("Customer", "you") and weweave GmbH, Fichtenweg 8d, 65510 Idstein, Germany ("weweave", "we", "Provider") governing the use of weweave apps distributed through the Atlassian Marketplace (each an "App").

1.1 Agreement. weweave uses the Bonterms Standard End User Agreement (Version 1.0) as the end user license agreement for its Apps, together with the Provider-Specific Terms published in the relevant Marketplace listing (together, the "Agreement"). This DPA is the Data Protection Addendum referenced in Section 3.3 (DPA) of the Agreement and is an Attachment to the Agreement.

1.2 Acceptance. This DPA is entered into automatically and without further action when Customer enters into an Order for an App or installs an App. No signature is required.

1.3 Signed copy. Customers who need an signed copy for their records may request one at privacy@weweave.net. weweave will countersign this DPA in unchanged form. Requests for materially amended terms are subject to weweave's prior written agreement.

1.4 Order of precedence. In the event of a conflict, the order of precedence is: (i) the Standard Contractual Clauses or other transfer mechanism agreed under Section 13, (ii) this DPA, (iii) the Agreement.

1.5 Defined terms. Capitalised terms not defined in this DPA have the meaning given to them in the Agreement.

"Applicable Data Protection Law" means all laws and regulations applicable to the Processing of Customer Personal Data under this DPA, including Regulation (EU) 2016/679 ("GDPR"), the German Federal Data Protection Act (BDSG), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection (FADP).

"Cloud App" means an App made available for Atlassian Cloud (including Forge and Connect apps).

"Customer Personal Data" means Personal Data contained in Customer Data that weweave Processes on behalf of Customer in the course of providing an App or Support.

"Data Center App" means an App made available for installation in Customer's own Atlassian Data Center or Server environment.

"Controller", "Processor", "Data Subject", "Personal Data", "Processing" and "Supervisory Authority" have the meanings given to them in the GDPR.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data Processed by weweave. Unsuccessful attempts and events that do not compromise the security of Customer Personal Data (for example, pings, port scans, failed log-in attempts, denial-of-service attacks) are not Security Incidents.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914.

"Subprocessor" means a third party engaged by weweave to Process Customer Personal Data.

"Support Data" means Personal Data contained in information Customer submits to weweave when requesting support (for example, ticket descriptions, screenshots, log files and attachments).

3.1 Processor role. With respect to Customer Personal Data, Customer acts as Controller (or as Processor on behalf of its own Controller) and weweave acts as Processor (or Subprocessor). Where Customer acts as a Processor, Customer warrants that its own Controller has authorised the engagement of weweave and the Processing described in this DPA.

3.2 Data Center Apps. Data Center Apps run entirely within Customer's own environment. weweave has no access to data Processed by a Data Center App and does not act as Processor in respect of that data. This DPA applies to Data Center Apps only in respect of Support Data.

3.3 Data for which weweave is a Controller. weweave acts as an independent Controller, and this DPA does not apply, in respect of: (a) order, licensing and billing data received from Atlassian Pty Ltd or other resellers (such as the technical contact's name, e-mail address, company, address and order details); (b) business contact data of Customer's personnel; and (c) Usage Data as defined in Section 3.4 of the Agreement, including installation data such as the instance identifier, instance base URL, App version and license status. weweave Processes this data in accordance with its Privacy policy.

3.4 Atlassian as Customer's own provider. Where an App stores or processes data solely within Customer's Atlassian instance or within Atlassian's platform infrastructure, Atlassian Processes that data under Customer's own agreement with Atlassian and not as a Subprocessor of weweave.

4.1 Documented instructions. weweave will Process Customer Personal Data only on documented instructions from Customer. Customer's instructions consist of (a) this DPA and the Agreement, (b) Customer's and its Users' configuration and use of the App and its features, (c) Customer's use of weweave's support channels, and (d) any further written instructions agreed between the parties. Annex 1 sets out the subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects.

4.2 Additional instructions. weweave will accommodate reasonable additional written instructions that are consistent with the Agreement. weweave may charge a reasonable fee for instructions that are not required by Applicable Data Protection Law or that go beyond the App's standard functionality, and may decline instructions that are technically impracticable.

4.3 Unlawful instructions. weweave will inform Customer without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected Processing until the instruction is confirmed, amended or withdrawn.

4.4 Processing required by law. weweave may Process Customer Personal Data where required to do so by Union or Member State law to which it is subject. In that case weweave will inform Customer of that legal requirement before Processing, unless the law prohibits such information on important grounds of public interest.

4.5 No other use. weweave will not sell Customer Personal Data, will not use it for its own purposes, will not use it for profiling or advertising, and will not use it to train machine learning or artificial intelligence models.

4.6 Customer responsibilities. Customer is responsible for (a) the lawfulness of the Processing and of its instructions, including having a valid legal basis and providing any required notices to Data Subjects, (b) the accuracy and content of Customer Data, (c) configuring the App and managing User access appropriately, and (d) complying with Section 7.2 (High-Risk Activities and Sensitive Data) of the Agreement. Customer will not submit special categories of Personal Data (Art. 9 GDPR), data relating to criminal convictions and offences (Art. 10 GDPR), or other Sensitive Data to weweave.

weweave will ensure that persons authorised to Process Customer Personal Data are bound by an appropriate obligation of confidentiality that survives the end of their engagement, receive appropriate data protection and security training, and are granted access only to the extent necessary for their role.

6.1 weweave will implement and maintain the technical and organisational measures set out in Annex 2 and in its Security policy, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of Processing and the risks to Data Subjects, as required by Art. 32 GDPR.

6.2 weweave may update these measures from time to time, provided that the updates do not materially decrease the overall level of security during a Subscription Term.

6.3 Customer is responsible for assessing whether the measures meet its own requirements and for the security of its Atlassian instance, its User accounts and any systems under its control.

7.1 General authorisation. Customer grants weweave general written authorisation to engage Subprocessors. The Subprocessors engaged at the effective date of this DPA are listed in Annex 3 and are kept up to date in the weweave subprocessor list.

7.2 Notice of changes. weweave will inform Customers who have subscribed to notifications at mail@weweave.net of any intended addition or replacement of a Subprocessor at least thirty (30) days before that Subprocessor begins Processing Customer Personal Data.

7.3 Objection. Customer may object to an intended change on reasonable grounds relating to data protection by giving written notice within thirty (30) days of the notification. The parties will discuss the objection in good faith. If weweave is unable to make the App available without the Subprocessor and the objection is not resolved, Customer may terminate the affected Subscription by written notice and weweave will refund any prepaid, unused fees for the terminated portion of the Subscription Term. This is Customer's sole remedy in respect of an objection.

7.4 Subprocessor obligations. weweave will impose on each Subprocessor data protection obligations that are no less protective than those in this DPA and remains fully liable to Customer for the performance of each Subprocessor's obligations.

8.1 Taking into account the nature of the Processing, weweave will assist Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling Customer's obligation to respond to requests from Data Subjects exercising their rights under Chapter III GDPR.

8.2 Customer can access, correct, export, restrict and delete Customer Personal Data directly through the App and through its Atlassian instance. Where Customer cannot do so through this functionality, weweave will provide reasonable assistance on written request.

8.3 If weweave receives a request from a Data Subject relating to Customer Personal Data, it will not respond to that request other than to refer the Data Subject to Customer, unless legally required to do so, and will forward the request to Customer without undue delay.

Taking into account the nature of the Processing and the information available to it, weweave will provide Customer with reasonable assistance in ensuring compliance with the obligations under Art. 32 to 36 GDPR, including security of Processing, notification of Security Incidents, data protection impact assessments and prior consultation with a Supervisory Authority. weweave may charge a reasonable fee for assistance that goes beyond providing the information and documentation it makes generally available.

10.1 weweave will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data.

10.2 The notification will describe, to the extent known at the time, the nature of the Security Incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. weweave will provide further information as it becomes available.

10.3 weweave will take reasonable steps to contain, investigate and mitigate the Security Incident. Notification is not an acknowledgement of fault or liability.

10.4 Notifications will be sent to the technical contact associated with the Order or to the contact Customer has provided to weweave for this purpose. It is Customer's responsibility to keep this contact information current.

10.5 Where the Security Incident concerns an App running on Atlassian's infrastructure, weweave will additionally report the incident through Atlassian's security incident reporting process for Marketplace Partners.

11.1 During the Subscription Term, Customer may export or delete Customer Personal Data through the App and its Atlassian instance as described in the Documentation.

11.2 Following termination or expiry of the Agreement, weweave will delete Customer Personal Data within sixty (60) days of Customer's request, in accordance with Section 12.4 of the Agreement. Absent a request, weweave will delete Customer Personal Data in accordance with its standard retention practices once it is no longer required to provide the App.

11.3 weweave may retain Customer Personal Data to the extent required by Union or Member State law, and copies contained in encrypted backups will be deleted in the ordinary course of the backup retention cycle. Data retained under this Section remains subject to Sections 5, 6 and 7 of this DPA.

11.4 On written request, weweave will confirm the deletion in writing.

12.1 weweave will make available to Customer the information reasonably necessary to demonstrate compliance with Art. 28 GDPR, including its Security policy, its Security self assessment questionnaire (CAIQ-Lite) and responses to reasonable written security questionnaires.

12.2 Where the information provided under Section 12.1 is not sufficient, Customer may conduct an audit, including an inspection, subject to the following parameters: (a) at least thirty (30) days' prior written notice, (b) not more than once in any twelve (12) month period, except where required by a Supervisory Authority or following a Security Incident, (c) during weweave's regular business hours and without unreasonably disrupting its operations, (d) conducted by Customer or an independent auditor that is not a competitor of weweave and that is bound by confidentiality obligations, (e) limited to weweave's own facilities, systems and documentation and to matters relevant to Customer Personal Data, and (f) without access to any data of other customers or to weweave's confidential commercial information beyond what is necessary.

12.3 Audit results are the Confidential Information of both parties. Customer bears its own audit costs and will reimburse weweave's reasonable costs for audits beyond the first audit in any twelve (12) month period.

13.1 weweave Processes Customer Personal Data on servers located in Germany. Support Data is Processed in the systems described in the Privacy policy and the subprocessor list.

13.2 Where weweave or a Subprocessor Processes Customer Personal Data outside the European Economic Area (EEA), weweave will ensure that an appropriate transfer mechanism under Chapter V GDPR is in place, such as an adequacy decision, the Standard Contractual Clauses or binding corporate rules.

13.3 EU SCCs. Where a transfer of Customer Personal Data from the EEA to a country without an adequacy decision requires the Standard Contractual Clauses, the parties are deemed to have entered into the SCCs, which are incorporated into this DPA by reference, as follows:

• Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor;

• Clause 7 (docking clause) applies;

• in Clause 9(a), Option 2 (general written authorisation) applies, with a notice period of thirty (30) days as set out in Section 7.2;

• in Clause 11(a), the optional independent dispute resolution provision does not apply;

• in Clause 17, Option 1 applies and the governing law is the law of the Federal Republic of Germany;

• in Clause 18(b), the courts of the Federal Republic of Germany are chosen;

• Annex I, Annex II and Annex III of the SCCs are populated by Annex 1, Annex 2 and Annex 3 of this DPA respectively, and the contact details in Section 16.

13.4 UK transfers. Where Customer Personal Data is protected by the UK GDPR and transferred to a country without UK adequacy regulations, the SCCs apply as modified by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (Version B1.0), which the parties are deemed to have entered into. Tables 1 to 3 are populated by this DPA and its Annexes; in Table 4, neither party may end the Addendum as set out in Section 19 of the Mandatory Clauses.

13.5 Swiss transfers. Where Customer Personal Data is protected by the Swiss FADP, references in the SCCs to the GDPR are to be understood as references to the FADP, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and the term "Member State" must not be interpreted to exclude Data Subjects in Switzerland from suing for their rights in their place of habitual residence.

13.6 If a transfer mechanism relied on under this Section ceases to be valid, the parties will cooperate in good faith to implement a valid alternative.

14.1 The limitations and exclusions of liability set out in Section 14 of the Agreement apply to claims under this DPA to the fullest extent permitted by Applicable Data Protection Law. A breach of this DPA constitutes an Enhanced Claim within the meaning of Section 14.5 of the Agreement.

14.2 Nothing in this DPA limits the rights of Data Subjects under Applicable Data Protection Law, including under Art. 82 GDPR, or the liability of either party towards Data Subjects or Supervisory Authorities.

15.1 This DPA takes effect on the date the Agreement takes effect and remains in force for as long as weweave Processes Customer Personal Data. Provisions that by their nature are intended to survive will survive the end of the Agreement.

15.2 weweave may update this DPA to reflect changes in Applicable Data Protection Law, in its Subprocessors or in the Apps, provided the update does not materially reduce the protection afforded to Customer Personal Data. Material changes will be announced on this page at least thirty (30) days before they take effect. Each version is retained in the page history.

Provider / data importer: weweave GmbH, Fichtenweg 8d, 65510 Idstein, Germany (Privacy contact: privacy@weweave.net Security contact: security@weweave.net Support: weweave support center)

Customer / data exporter: the entity that entered into the Order, using the contact details provided in the Order or in Customer's Atlassian account.

A. List of parties

B. Description of the Processing

C. Competent Supervisory Authority (SCC Annex I.C)

Where the SCCs apply, the competent Supervisory Authority is the Supervisory Authority of the EEA Member State in which the data exporter is established or, where the data exporter is not established in the EEA, the Supervisory Authority of the Member State in which the data exporter's Art. 27 GDPR representative is established.

The following summarises the measures weweave maintains under Art. 32 GDPR. Further detail is set out in the Security policy.

Pseudonymisation and encryption

• All data in transit is encrypted using current industry-standard TLS.

• Backups are encrypted before they are stored off-site.

• Data is stored outside the customer's Atlassian instance only where technically necessary to provide a feature, and is not retained longer than the feature requires.

Confidentiality (access control)

• Role-based access control; access to production systems is limited to the personnel who require it.

• Strong, unique credentials managed in a password manager; multi-factor authentication is used wherever supported.

• Each App runs in its own container and has no access to other Apps' data.

• Physical security of the data centres is provided by the hosting providers listed in Annex 3, all located in Germany.

• Personnel are bound by confidentiality obligations.

Integrity (change and code management)

• All source code changes are reviewed by a second developer (four-eyes principle).

• Automated unit and integration tests plus manual testing before each production deployment.

• Infrastructure is managed as code, allowing unauthorised or unintended configuration changes to be detected.

• Releases can be rolled back or forward within 60 minutes.

Availability and resilience

• Automated daily backups; maximum theoretical data loss for data stored outside the customer's Atlassian instance is less than 24 hours.

• Restore tests are performed as part of regular infrastructure maintenance.

• Documented procedures for redeploying business-critical systems in a different data centre.

• Continuous monitoring of uptime and infrastructure metrics; public status page at status.weweave.net.

Regular testing, assessment and evaluation

• Third-party dependencies are checked and updated regularly; security updates are applied automatically.

• Participation in the Atlassian Marketplace Security Bug Bounty Program.

• Participation in the Atlassian Cloud Fortified Apps Program (except for Apps that are new to the Marketplace and still undergoing Atlassian's approval processes).

• Security policies are reviewed regularly.

Incident management

• Real-time alerting from monitoring systems and support channels; incidents are tracked in an internal ticket system.

• Security incidents affecting Apps are reported through Atlassian's Marketplace security incident reporting process.

Data minimisation and deletion

• Processing is kept as close to the Atlassian platform as possible; data is transmitted to weweave systems only where technically necessary.

• Data that is no longer needed is permanently deleted.

Measures for Subprocessors

• Subprocessors are engaged under written data processing agreements with obligations no less protective than this DPA.

The current list is maintained at weweave subprocessor list. At the effective date of this DPA:

Atlassian is listed as a Subprocessor only in respect of support requests handled through weweave's Jira Service Management instance. Where an App stores or processes data within Customer's own Atlassian instance, Atlassian acts under Customer's own agreement with Atlassian (see Section 3.4).