Privacy Policy for the Nanga Jira Codebeamer Connector
Last updated: 29 October 2026
This policy explains how personal data is processed when you use the Nanga Jira Codebeamer Connector ("NJCC"): the agent, the Codebeamer plugin and the Jira Forge app. It does not cover our website, which has its own privacy policy.
§ 1 Controller and contacts
NANGA SYSTEMS GmbH
Königstraße 27
70173 Stuttgart
Germany
Managing director: Dominik Kassel
Registered at Amtsgericht Stuttgart, HRB 750 626
Email: info@nangasystems.com. Phone: +49 800 800 1007.
Data protection officer:
Rainer Deyhle
Pischekstraße 9
70184 Stuttgart
Germany
Phone: +49 176 82270097
Email: info@datenschutzbeauftragter-dsgvo-stuttgart.de
§ 2 Who is responsible for what
2.1 Your organization runs NJCC. The agent runs on servers your organization chooses and controls. Jira and Codebeamer are operated by your organization itself or by a provider on its behalf, for example Atlassian, PTC or a hosting partner. Your organization decides which projects are synced or linked and which users may use NJCC. It is the controller for all data in Jira, Codebeamer and the agent, including the personal data described in § 3. Please contact your organization to exercise your rights for this data.
2.2 Nanga does not receive this data. The agent does not send data to Nanga. The license key is checked locally on the agent. Nanga has no access to your organization's agent, Jira or Codebeamer, unless your organization grants it, for example in a support session.
2.3 The Jira Forge app runs on Atlassian's platform. Atlassian hosts the Forge app on Nanga's behalf. For the data the Forge app processes (§ 4), Nanga acts as a processor for your organization and Atlassian as Nanga's sub-processor. Your organization can request a data processing agreement under Art. 28 GDPR from us.
2.4 Nanga is the controller only for the processing in § 5 (licenses and contracts) and § 6 (support).
2.5 Atlassian is not responsible for how NJCC processes data. Atlassian's own processing in Jira Cloud and the Forge platform is governed by Atlassian's privacy policy.
§ 3 Data processed by the agent and the Codebeamer plugin
The agent and the Codebeamer plugin run in your organization's environment. None of the following data is sent to Nanga.
| Data | Purpose | Deleted |
|---|---|---|
| Content of synced Jira issues and Codebeamer items, including names, email addresses and account IDs in fields such as assignee or reporter, in comments, mentions and attachments | Syncing the items as configured | Stays in Jira and Codebeamer under your organization's rules. The agent keeps item mappings until the sync configuration is deleted. |
| Email addresses of Jira Cloud users, read with the organization API key if your organization configures one | Matching users between Jira and Codebeamer | Not stored, used only during a sync |
| Sync errors: item key, changed fields, error text, and the person who made the change: the Atlassian account ID for a Jira user (the name is read from Jira when shown, not stored), the name for a Codebeamer user | Showing failed syncs and retrying them | When the item syncs again or is retried successfully, or when the sync configuration is deleted |
| Picker sign-ins: Atlassian account ID and Codebeamer username | Showing and linking Codebeamer items as the signed-in user | When the sign-in expires (24 hours by default). Expired sign-ins are deleted daily. |
| Codebeamer access tokens for picker users | Calling Codebeamer as the signed-in user | Kept in memory only, for at most one hour |
| Jira OAuth tokens and the Codebeamer username they belong to | Reading Jira as the user, for the "Link to Jira" dialog and the Codebeamer widget | When the user unlinks the Jira account, or when your organization deletes them |
| Agent administrator accounts: username, full name, email address, password hash | Signing in to the agent's web interface | When your organization deletes the account |
| Log files: item keys, user names and error messages | Operating and troubleshooting the agent | Under your organization's log retention |
Your organization's legal basis is usually its legitimate interest in connecting the tools its teams use (Art. 6(1)(f) GDPR) or the employment relationship (Art. 88 GDPR, § 26 BDSG). The agent's web interface uses a session cookie that is strictly necessary to keep you signed in (§ 25(2) no. 2 TDDDG).
§ 4 Data processed by the Jira Forge app
4.1 Data stored in Atlassian's Forge storage:
- The agent address.
- The Jira projects for which syncing and linking are enabled.
- The Jira groups that may see sync details or retry failed syncs.
The app also sets project properties in Jira that control where its panels appear. This data contains no personal data. Atlassian deletes the app's storage under its own policies when the app is uninstalled.
4.2 Data sent to your organization's agent. When you open an issue, the sync errors page or the link dialog, the app sends the issue or project key and your request to the agent at the address your Jira administrator entered. Atlassian signs each request with a Forge Invocation Token, which contains your Atlassian account ID and the Jira site. The agent uses it to check that the request is genuine and to apply your permissions. The app sends data to no other address.
4.3 Forge app logs. Atlassian records the app's log output. Unless your Jira administrator turns off log sharing in Atlassian Admin, Nanga can read these logs in Atlassian's developer console. Atlassian keeps them for about 30 days. The logs can contain project keys, group names, the agent address, and error messages from Jira or the agent, which may include parts of issue content or names. Nanga reads these logs only to find and fix faults in the app, on your organization's behalf.
4.4 The Forge app does not use cookies, analytics, tracking or advertising.
§ 5 Licenses and contracts
5.1 To issue a license key we process the business contact details of your organization's contact persons (name, email address, phone number, position), the company name, the Jira and Codebeamer server addresses, and the license term. The license key contains the company name, the server addresses and the end of the term.
5.2 When your organization installs the Forge app, Atlassian shows us the installation in the developer console, with the Jira site address, the installation date and the app version. Atlassian does not give us the name or contact details of the person who installed the app.
5.3 Purpose: issuing and managing licenses, invoicing, and contacting your organization about the license, updates and security issues.
5.4 Legal basis: Art. 6(1)(b) GDPR for the contract with your organization, Art. 6(1)(f) GDPR for its contact persons, based on our interest in managing the business relationship, and Art. 6(1)(c) GDPR for statutory records.
5.5 Retention: for the term of the contract, then for up to ten years under German commercial and tax law (§ 257 HGB, § 147 AO).
§ 6 Support
6.1 When you contact our support we process your name, contact details, your messages and anything you attach, such as log files, configuration files or screenshots. These may contain personal data from Jira or Codebeamer. Please remove data that we do not need to solve the issue.
6.2 Legal basis: Art. 6(1)(b) GDPR where your organization has a contract with us, otherwise Art. 6(1)(f) GDPR, based on our interest in answering requests. If the attachments contain personal data of other people, we process it as a processor for your organization.
6.3 Retention: deleted when the request is closed, unless statutory retention periods apply.
§ 7 Recipients and transfers outside the EU
7.1 We do not sell personal data and do not share it for advertising.
7.2 Atlassian (Atlassian Pty Ltd, Australia, and its affiliates) hosts the Forge app and its storage and logs (§ 4) as our sub-processor. The app's Forge storage is kept in the data residency location of your Jira site and moves with it when your organization changes that location. Atlassian aims to run the app's functions in the same location, but may run them elsewhere. The app logs are not covered by data residency. Function execution and logs may therefore be processed outside the EU, for example in the USA. These transfers are based on the EU-U.S. Data Privacy Framework, the EU adequacy decision for the relevant country where one exists, or EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
7.3 For email and accounting we use service providers who process data on our behalf under Art. 28 GDPR. We will name them on request.
7.4 The agent sends data only to the Jira and Codebeamer systems your organization configures.
§ 8 What NJCC does not do
- No analytics, telemetry, crash reporting or usage tracking in the agent, the Codebeamer plugin or the Forge app.
- No advertising or profiling.
- No automated decision-making within the meaning of Art. 22 GDPR.
- No sale of personal data.
§ 9 Security
- Every request from the Forge app to the agent is signed by Atlassian. The agent rejects requests from other sites or with an invalid signature.
- Jira Cloud and the Forge app connect to the agent only over HTTPS with a valid certificate.
- The agent encrypts the key it uses to sign Codebeamer tokens in its database.
- Security vulnerabilities can be reported to security@nangasystems.com. We handle them under our published security policy.
Your organization is responsible for securing the agent, its database and its network (see § 6 of the NJCC Terms of Use).
§ 10 Your rights
10.1 Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).
10.2 Right to object (Art. 21 GDPR): where we process your data based on Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation.
10.3 For data in Jira, Codebeamer and the agent (§ 3), please contact your organization, which is the controller. If you contact us, we will forward your request to your organization if you agree.
10.4 You can complain to a supervisory authority. Ours is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Germany
§ 11 Changes
We update this policy when NJCC or the legal situation changes. The date at the top shows the last change. We inform our customers in advance about material changes and inform Atlassian as the Marketplace requires.