Data processing (DPA)
When your organisation uses AgileHub for its teams, AgileHub processes personal data on its behalf. This page explains what that means. As of: [Missing: Date of the legal review].
This is a template. Details of the operator are missing or the review is still pending. Until then the page is not released to search engines.
Still missing:
- Date of the legal review
- Name of the company or provider
- Hosting provider
- Place of data processing
- Email service
- Address of the data processing agreement
Who is responsible for what
- Your organisation (the workspace) decides which sessions take place and what content is created in them. For that content it is the controller under the GDPR.
- [Missing: Name of the company or provider] operates AgileHub and processes that content as processor, on the organisation's instructions.
- For account and billing data of account holders, the operator is itself the controller; see the privacy policy.
What the agreement must regulate
A data processing agreement under Art. 28 GDPR regulates at least:
- subject matter, duration, nature and purpose of the processing,
- the type of data and the categories of data subjects,
- being bound by instructions and the duty of confidentiality,
- technical and organisational measures,
- the use of further processors (sub-processors),
- support with requests from data subjects and with personal data breaches,
- deletion or return of the data at the end of the contract,
- evidence and audits.
Which data AgileHub processes for organisations
| Category | Data subjects | Examples |
|---|---|---|
| Identification | Workspace members, participants | Name, email address (members), self-chosen display name |
| Session content | Members, participants | Stories, estimates, notes, comments, votes, actions |
| Organisation | Members | Roles, teams, invitations, change log |
| Usage data | Members, participants | Session data, times of participation |
Special categories of personal data (Art. 9 GDPR) are not intended. Retro notes are free text; what participants write is up to them – for sensitive topics, anonymous notes help.
Technical and organisational measures
What the software does for this is described on the security page: encrypted transfer, roles and concealment enforced on the server, validated input, limits against abuse, encrypted credentials for connections, change log, automatic deletion after the retention period, and export and deletion on request. Organisational measures of the operator are added in the agreement.
Sub-processors
| Service | Purpose | Data | Location |
|---|---|---|---|
| [Missing: Hosting provider] | Hosting of the application and database | All data of the application | [Missing: Place of data processing] |
| Google (Firebase Authentication) | Sign-in of accounts | Email address, name, sign-in provider | Google; see the privacy policy |
| Stripe | Payment processing | Billing details of the account holder; no session content | Stripe; see the privacy policy |
| [Missing: Email service] | Sending sign-in links, invitations and contact requests | Email address, name, message text | [Missing: Place of data processing] |
Slack, Microsoft Teams, Jira, Linear, Trello, Confluence and GitHub are not sub-processors of AgileHub: the workspace or the individual connects them itself – for Jira, Confluence and GitHub also by signing in with their own account at that service – and decides what goes there or is fetched from there. The access tokens stored for this belong to the account of the connecting person and are stored encrypted (see the privacy policy). Google AdSense is not loaded for organisations on paid plans.
Concluding the agreement
Whether your plan includes the data processing agreement is shown by the row "Data processing agreement" in the plan overview. You find the agreement here: [Missing: Address of the data processing agreement]. Questions about it are answered through the contact form.