When you use Atlassian products through an employer or organization, that organization is typically the data controller and Atlassian acts as a processor, meaning your employer's privacy policies and the terms negotiated between Atlassian and your employer govern how your data is handled, not solely this policy.
This analysis describes what Atlassian's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that employees and contractors using Atlassian tools through an enterprise account may need to direct data subject rights requests to their employer rather than directly to Atlassian, and their employer's data governance practices apply to content within the account.
For users accessing Atlassian services through an employer or organization, the employer administrator controls data processing decisions including retention, deletion, and access to content. Atlassian's direct data subject rights procedures may be limited in this context, as the employer is designated as the controller under the policy.
How other platforms handle this
Where ZipRecruiter processes your Personal Data in the capacity of a service provider (data processor), and you seek access, or want to correct, amend, or delete your Personal Data...we will provide you with the data controller's contact information, so you can contact them directly.
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
"Atlassian is the controller of personal information covered by this Privacy Policy. In some instances, the customer (the 'administrator') decides how and why personal information is processed. In those instances, Atlassian is the processor of that information. The rights and obligations of customers who act as controllers are described in the agreements between Atlassian and those customers, including the Data Processing Addendum.Excerpt from Atlassian's Privacy Policy
(1) REGULATORY LANDSCAPE: The GDPR's controller/processor framework under Articles 4, 24, and 28 requires a written Data Processing Agreement between Atlassian and enterprise customers acting as controllers.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that employees and contractors using Atlassian tools through an enterprise account may need to direct data subject rights requests to their employer rather than directly to Atlassian, and their employer's data governance practices apply to content within the account.
For users accessing Atlassian services through an employer or organization, the employer administrator controls data processing decisions including retention, deletion, and access to content. Atlassian's direct data subject rights procedures may be limited in this context, as the employer is designated as the controller under the policy.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Atlassian.