Privacy Policy

This Privacy Policy describes how maplee GmbH ("we", "our", "us") handles personal data in connection with the Atlassian Marketplace app DORA Register of Information (the "App"). The App lets financial entities maintain their Register of Information under Regulation (EU) 2022/2554 (DORA) and Implementing Regulation (EU) 2024/2956 directly in Jira Cloud and export it as an xBRL-CSV package. The App is built on the Atlassian Forge platform and runs entirely within your Atlassian Cloud environment. We are committed to handling data transparently and in compliance with the EU General Data Protection Regulation (GDPR) and applicable data protection law.

The controller responsible for the data processing described in this policy is:

maplee GmbH, Wolfseggerstraße 23, 93138 Lappersdorf, Germany, E-Mail: kontakt@maplee.de

For the register content you enter into the App (see section 3), your organisation is the controller; maplee GmbH has no access to this data (see section 6).

The App processes the following categories of data solely to provide its functionality:

• Register content you enter: the data of the 15 templates of the Register of Information — financial entities and branches, ICT third-party service providers and their supply chains, contractual arrangements, business functions and assessments. This may include names and identifiers of legal entities and, where you enter them, of natural persons (for example sole-trader providers or contact persons).
• Jira workflow data: Jira issues the App creates on your instruction (the annual-report epic and validation-finding issues) and an issue property that links an issue to a register record. This data lives in your own Jira project.
• App configuration: the Jira project key, issue type names, submission deadline and base currency you configure in the App settings.
• Export history: for each generated xBRL-CSV package the file name, the time of generation and a validation summary (number of errors and warnings). The App does not record which user generated a package.
• Language preference: stored only in your browser's local storage.

The App does not store Atlassian account IDs, names or e-mail addresses of your users. It does not use cookies, analytics, tracking or telemetry of any kind. Export packages are generated on demand, delivered to the user's browser and are not retained by the App.

• Performance of the contract (Art. 6 para. 1 lit. b GDPR): processing the register content and configuration is strictly necessary to provide the register, validation and export functionality your organisation has obtained the App for.
• Legal obligation of your organisation: your organisation maintains the Register of Information to fulfil its obligations under Art. 28 para. 3 DORA; the App is a tool for this purpose and does not provide legal or regulatory advice.
• Support requests (Art. 6 para. 1 lit. b and f GDPR): if you contact us at kontakt@maplee.de, we process your name, e-mail address and the content of your message to answer your request.

The App contacts exactly one external service: the public register of the Global Legal Entity Identifier Foundation (GLEIF), Basel, Switzerland, at api.gleif.org, to check whether a Legal Entity Identifier (LEI) is registered and active. Only the 20-character LEI code is transmitted when a user triggers the check; no personal data and no other register content is sent. The response is shown in the App and is not stored outside your Atlassian site. This connection is declared in the App's manifest and is approved by your site administrator when the App is installed. No other third party receives data from the App, and maplee GmbH receives no data at all.

All App data is stored in Atlassian Forge hosted storage: the register content in a relational database (Forge SQL) provisioned separately for each installation, the configuration and export history in the Forge Key-Value Store. Storage is encrypted at rest, isolated per installation and subject to Atlassian's security controls. Data is hosted in the Atlassian Cloud region of your site in line with Atlassian's data residency settings, to the extent Atlassian supports data residency for Forge hosted storage. maplee GmbH operates no servers of its own for the App and has no access to your data. The App communicates with Jira only through Atlassian's platform APIs within the permissions (scopes) shown at installation: reading and writing Jira issues and using app storage.

Your register data persists for the lifetime of the installation. You can delete all register data at any time with the function "Delete all register data" in the App settings; Jira issues created by the App remain in your Jira project under your control. When the App is uninstalled, Atlassian retains the App's hosted storage for a limited period (currently 28 days according to the Forge documentation) and then deletes it. Support e-mails are retained only as long as required to handle the request and to meet statutory retention obligations.

Subject to the GDPR, you have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority. For personal data contained in your organisation's register, please contact your organisation as the controller; the App gives your organisation the tools to rectify or delete that data directly. For requests concerning data processed by maplee GmbH, write to kontakt@maplee.de.

We may update this policy when the App or the applicable law changes. The current version is published at this URL; the date of the last update is shown at the top.

maplee GmbH · Wolfseggerstraße 23 · 93138 Lappersdorf, Germany · kontakt@maplee.de