Data-processing agreement — Fifth Third Edition
If your workspace acts as controller for personal data processed on the Fifth Third Edition — for example a company enrolling employee devices — this agreement covers the Article 28 GDPR requirements between the workspace (controller) and FifthThirdStore d.o.o. (processor).
1. Parties
Controller: the workspace administrator identified at the /install-workspace page, acting on behalf of the workspace organisation. Processor: FifthThirdStore d.o.o., ul. Vaka Đurovića 12, 81000 Podgorica, Crna Gora. PIB 02947183. Contact for the DPA: dpo@fifththirdstore.org.
2. Subject matter and duration
The Processor processes the personal data listed in Annex A on behalf of the Controller for the duration of the workspace, for the sole purpose of providing the Fifth Third Edition marketplace service. Processing ends at the moment the workspace is terminated, subject to the retention rules in Annex B.
3. Nature and purpose
Nature of processing: hosting of workspace metadata, provisioning of Fifth Third modules to enrolled devices, invoicing, security monitoring, backup, incident response, support correspondence. Purpose: performance of the marketplace contract concluded between the Processor and the Controller.
4. Type of personal data
Workspace identity (email, name, company name, VAT number), enrolled-device metadata, entitlement and audit-log data, payment metadata, support correspondence. The full inventory with retention periods is in Annex A.
5. Categories of data subjects
Workspace administrators, workspace collaborators, enrolled-device users. Where the Controller enrols third-party devices (contractor devices, seasonal worker devices), the categories extend to those individuals.
6. Obligations of the Processor
The Processor processes personal data only on documented instructions of the Controller, including with regard to transfers of personal data to a third country. The Processor informs the Controller if it considers an instruction to infringe the GDPR or another applicable data-protection law.
The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
The Processor takes the technical and organisational measures listed in Annex C. The measures are reviewed on the first Wednesday of every quarter by the Fifth Third editorial team and updated as needed. Material updates are published on this page thirty days before they take effect.
7. Subprocessors
The Controller authorises the Processor to engage the subprocessors listed in Annex D. The Processor informs the Controller of any intended addition or replacement of a subprocessor at least thirty days in advance, on the workspace email. The Controller may object to a change; if the change is material and no reasonable alternative is available, either party may terminate the workspace without penalty.
8. Rights of data subjects
The Processor assists the Controller by appropriate technical and organisational measures for the fulfilment of the Controller’s obligation to respond to requests for exercising the data subject’s rights. The workspace API exposes access, rectification, erasure and portability endpoints under /v1/fifth-third/subject-rights.
9. Assistance
The Processor assists the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to the Processor.
10. Data breach notification
The Processor notifies the Controller of a personal-data breach affecting personal data processed under this DPA without undue delay, and in any event within 48 hours of becoming aware of it. The notification contains the categories of data subjects affected, the approximate number of records, the likely consequences and the measures taken to address the breach.
11. Return or deletion
On termination of the workspace the Processor returns the personal data to the Controller in a machine-readable format within thirty days, then deletes the working copies within a further thirty days. Backup copies are deleted at the end of the standard 90-day backup rotation window. Retention periods mandated by Montenegrin accounting law (eight years for invoicing data) prevail over the deletion obligation.
12. Audit
The Controller may audit the Processor’s compliance with this DPA once per calendar year, at the Controller’s expense, with a thirty-day written notice, during business hours, and without disrupting the Processor’s ability to serve other workspaces. The Processor makes available all information necessary to demonstrate compliance and provides a SOC 2 Type II report or an equivalent independent attestation on request.
13. Transfers outside the EEA
The subprocessors located outside the European Economic Area (see Annex D) transfer personal data under the Standard Contractual Clauses adopted by the European Commission on 4 June 2021 or, where applicable, under the EU–US Data Privacy Framework certification held by the subprocessor.
14. Liability
The Processor’s liability under this DPA is subject to the liability cap in the main terms of use. The cap does not limit any liability arising from the mandatory rules of Article 82 GDPR.
15. Annexes
Annex A — Data inventory: as detailed in the privacy notice at /privacy §2.
Annex B — Retention: as detailed in the privacy notice at /privacy §6.
Annex C — TOMs: encryption at rest (LUKS on Hetzner volumes), TLS 1.3 in transit, hardware security keys required for administrative access, quarterly penetration tests, structured logging with 90-day retention, incident-response runbook.
Annex D — Subprocessors: Hetzner Online GmbH (Frankfurt & Helsinki hosting, EEA), Stripe Payments Europe Limited (Dublin, EEA), Fastmail Pty Ltd (New York, USA — under EU–US DPF), Postmark (Chicago, USA — under EU–US DPF), Sentry.io (San Francisco, USA — under EU–US DPF, with IP anonymisation).
16. Signature
By provisioning a workspace and accepting the terms of use, the Controller is deemed to have accepted this DPA. A wet-signed copy on FifthThirdStore letterhead is available on request from dpo@fifththirdstore.org.