Privacy notice for the Marketplace candidate of SLA Credit Lab · updated 18 October 2026.
Controller for this notice: 2J LAMBRE, a French simplified joint-stock company (SASU), SIREN 837 878 925, 10 rue de Penthièvre, 75008 Paris, France. Postal contact is available at that address. Trade name: SLA Credit Lab.
SLA Credit Lab prepares an SLA-credit calculation and its internal review. The app processes contract and customer references, rules and amounts, ticket keys, SLA cycles, the owner's Atlassian account ID, the label entered by an approver, and the approval date.
Free-text fields may contain personal data. Use references instead of names where possible. Never enter passwords, bank details, or sensitive personal data.
Entries, proposals, and receipts are stored in Forge hosted storage (KVS). A server-side secret key checks their integrity. Contract text stays inside the Forge app and is not sent to any external language service. The app does not issue an accounting credit, payment, or Jira change.
Access to a case is limited to its owner account and installation. This control has been tested between two sites under the same account; a test with a separate real account remains required before customer data is processed.
The app uses Atlassian Forge and Jira, including the Personal Data Reporting API to report retained account IDs. The reviewed candidate declares no external server, remote service, web trigger, advertising tool, or marketing analytics tool.
App access expires thirty minutes after calculation and a corresponding TTL is requested for Forge storage. This does not guarantee physical deletion at an exact second and does not describe Atlassian backups.
A minimal privacy index — account ID, reference, and dates — has a maximum eight-day TTL to support periodic reporting. Users remain responsible for any exports they copy or download.
The customer organisation determines the purposes, access, notices to individuals, and legal basis for data relating to its teams and customers. The contractual qualification of 2J LAMBRE as processor for this flow must be formalised in a data-processing agreement.
To request access, rectification, erasure, restriction, or objection, contact contact@2jagency.com or write to the registered office above. We may ask only for information necessary to link the request to the relevant Atlassian account and installation. You may also contact the competent supervisory authority (in France: CNIL, www.cnil.fr).
Server-side controls cover ownership, licence, integrity, and expiry. The privacy worker logs its status and aggregate counters only; it does not log an account ID or case reference.
The app makes no certification or EU-only data-residency claim. Sub-processors, transfers, effective regions, and support access must be checked against the applicable Atlassian contracts and settings.
This notice describes the observed processing in the Marketplace candidate. It is not a general compliance certification.