Atlassian sub-processors questions

[#1]

Atlassian has published a list of sub-processors here: https://www.atlassian.com/legal/sub-processors .

However this list of sub-processors seems not complete.  When you use Conflucence, Jira, and other Atlassian sites, data gets transferred to (among others):

• Google (Google fonts, Analytics, Ads)
• Launchdarkly
• Linkedin
• Facebook
• Clicktale
• Vimeo
• Optimizely
• Marketo
• Reddit
• Doubleclick
• Bing

Actually the site listing the sub-processors uses all of the above as of today (Monday, November 21, 2022).

[Nic Brough -Adaptavist-]

I would point out that a lot of those are probably being called by apps, not the core Atlassian systems.

[Dave Meyer]

Our cloud infrastructure and architecture for our products is distinct from www.atlassian.com. The presence of references to these services on a www.atlassian.com page does not mean that they are present in Jira, Confluence, or our other products.

Additionally, the definition of a sub-processor in the GDPR specifically refers to access to data. The presence of a cookie or 3rd-party library does not imply that a vendor is a sub-processor.

[marc -Collabello--Phase Locked-]

@Nic Brough -Adaptavist- These services are on the atlassian.com domain, and are not caused by apps.

@Dave Meyer Atlassian.com is required for e.g. login, documentation and the marketplace.  So in effect I would say it is "part of" the Jira and Confluence offer.

Once you install cookies or 3rd party libraries on a website, the vendors (or providers) are sub-processors in terms of GDPR.  See for example the explanation at https://www.simpleanalytics.com/blog/denmark-declares-google-analytics-unlawful which references the original letter of the Danish DPA.

[marc -Collabello--Phase Locked-]

@Dave Meyer , @Nic Brough -Adaptavist- ,

I have found a link where Atlassian says it is using specific external services: https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/

Among these are:

• Pubnub
• Wordpress/Gravatar Content Delivery Network
• Google Hosted Libraries Content Delivery Network
• Optimizely Digital Experience delivery
• LaunchDarkly Digital Experience delivery
• Twilio Segment
• Sentry.io Content Delivery Network

These external services must be declared as subprocessors, if Atlassian uses them in their applications.