Privacy Policy

Perlumetrics Time & Budget – Atlassian Jira Cloud add-on

Last updated: August 2026

1. Controller and contact

The controller responsible for the processing of personal data through the add-on is:

Perlumetrics UG (haftungsbeschränkt)
Wilhelm-Busch-Straße 7
74626 Bretzfeld
Germany

E-mail: security-contact@perlumetrics.com
Support: https://perlumetrics.atlassian.net/servicedesk

2. Scope and purpose of processing

Perlumetrics Time & Budget is an add-on for Atlassian Jira Cloud that provides time recording, budget and project management, and — in the Pro edition — invoice generation. It is built on the Atlassian Forge platform.

The Jira site owner (our customer) is the data controller for the personal data entered or generated through the add-on. Perlumetrics acts as a data processor on the customer's behalf pursuant to Art. 28 GDPR. We process this data solely to provide, operate, and improve the add-on and for no other purpose. Perlumetrics acts as an independent controller only with respect to communication data that arises from support or billing inquiries (e.g. your contact details when you write to us).

3. Legal bases (Art. 6 GDPR)

Processing of personal data on behalf of our customers is carried out as contract processing (Art. 28 GDPR in conjunction with Art. 6(1)(b) GDPR — performance of the contract between the customer and its users/employees).
Processing for our own support and billing communication is based on Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries) or Art. 6(1)(b) GDPR (pre-contractual/contractual measures).

4. Categories of personal data

The add-on processes the following categories of personal data:

Jira identifiers: Jira account IDs of users who record time, of managers, and of users who performed or reviewed actions (e.g. stored in userAccountID, changerAccountId, managerAccountID).
Display names of users, as recorded in the audit log.
Time booking data: recorded durations, free-text short and long descriptions, and the linked Jira issues — these free-text fields may, depending on user input, contain personal data.
Customer and billing master data: customer name, address, VAT identification number, and company bank details (stored in the customer's company settings), as well as invoices and generated PDF documents.

The add-on does not store user passwords or Atlassian personal access tokens. Where an e-mail address is required (e.g. for support), it is provided by the customer or user directly and used only for that purpose.

5. Storage location and data residency

All processing takes place on Atlassian Forge infrastructure (Forge SQL database and Forge Storage). No personal data is transferred to, stored by, or processed on systems operated by Perlumetrics itself or any other third party. The geographic location of the data follows the customer's Jira Cloud data-residency pinning (for example EU or US); it is not independently configurable by the vendor.

6. Retention and deletion

Customers can delete their operational data (customers, budgets, time bookings, invoices) at any time using the in-app "Wipe Data" function.
Audit-relevant data — the audit log (AuditLog), the time-booking history (TimeBookingHistory), and the user/manager and group assignments (UserHierarchy, UserGroups) — is retained for accounting and compliance purposes (including German GoBD principles) and is not deleted by "Wipe Data".
When a customer uninstalls the add-on, the remaining data is retained for a limited period in accordance with Atlassian's standard data-retention policy and is then permanently deleted.

To request deletion of your personal data, please contact us at security-contact@perlumetrics.com.

7. Third parties and sub-processors

The sole sub-processor is Atlassian (Atlassian Pty Ltd), which provides the Forge platform on which the add-on runs. No other third party receives personal data.

8. Data subject rights (Art. 15–21 GDPR)

You have the following rights with regard to your personal data:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)
Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR)

To exercise these rights, contact us at security-contact@perlumetrics.com. Where the processing is carried out on behalf of a customer (the controller), we will forward your request to the controller.

9. Supervisory authority

You have the right to lodge a complaint with a data-protection supervisory authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)
Lautenschlagerstraße 20
70173 Stuttgart
Germany

10. International transfers

Personal data remains within Atlassian infrastructure. To the extent that processing involves a transfer outside the European Economic Area, such transfer is governed by the Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR and, where applicable, Atlassian's own data-processing terms.

11. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available on this page.

Atlassian, Jira, Atlassian Marketplace and Atlassian Forge are trademarks or registered trademarks of the Atlassian Corporation. Perlumetrics is not affiliated with, endorsed by, or sponsored by Atlassian Corporation.