Privacy notice — Fifth Third Edition

This notice explains what personal data FifthThirdStore d.o.o. processes when you install the Fifth Third Edition workspace, what we do with it, how long we keep it and how you can exercise your rights.

1. Controller

The data controller is FifthThirdStore d.o.o., ul. Vaka Đurovića 12, 81000 Podgorica, Crna Gora. PIB 02947183. The data-protection officer is reachable at dpo@fifththirdstore.org. The supervisory authority is the Agencija za zaštitu ličnih podataka (AZLP), registration 05-030/24-2417. If your workspace is in the European Economic Area you may also contact the supervisory authority of the country of your ordinary residence.

2. What we collect

We process the following categories of personal data when you use the Fifth Third Edition:

• Workspace identity: email address, given and family name, company name (optional), VAT number (optional). Collected at checkout.
• Enrolled-device metadata: device model, Android version, package fingerprint, enrolment timestamp. Collected on first sign-in of the workspace app.
• Entitlement and audit-log data: list of Fifth Third modules provisioned to the workspace, install timestamps, SHA-256 checksums of every module version.
• Payment metadata: last four digits of the card, card scheme, billing address, IBAN prefix (for SEPA direct debit). The full card number and the CVV are handled by our payment provider and never touch our servers.
• Support correspondence: email content, attachments, timestamps, workspace reference.

We do not collect biometric data, health data, political opinions, religious beliefs, sexual orientation, or any other special category of personal data under Article 9 of the GDPR.

3. Purposes and legal bases

We process the categories above for four purposes:

• To provide the Service (Art. 6(1)(b) GDPR — performance of the contract): workspace provisioning, module install, invoicing.
• To comply with legal obligations (Art. 6(1)(c) GDPR): tax reporting, invoicing under the Zakon o računovodstvu, mandatory notice periods under consumer-protection law.
• To pursue our legitimate interests (Art. 6(1)(f) GDPR): security monitoring of the marketplace API, fraud prevention, aggregated marketplace analytics. In every case we balance the interest against your fundamental rights and document the balancing test in the workspace records.
• To send editorial newsletters (Art. 6(1)(a) GDPR — consent): the optional Fifth Third Wednesday newsletter. Consent can be withdrawn at any time by clicking the unsubscribe link in every issue.

4. Where the data lives

Workspace, entitlement and audit-log data are stored on servers physically located in Frankfurt, Germany, operated by Hetzner Online GmbH. Payment metadata is stored by Stripe Payments Europe Limited, Dublin, Ireland. Support correspondence is stored on Fastmail Pty Ltd (New York, USA — under the EU–US Data Privacy Framework). Backups of the workspace database are stored on servers physically located in Helsinki, Finland, operated by Hetzner Online GmbH.

5. Third parties

We share personal data with the following processors, under written data-processing agreements meeting the requirements of Article 28 GDPR: Hetzner Online GmbH (hosting), Stripe Payments Europe Limited (card and SEPA processing), Fastmail Pty Ltd (support mailbox), Postmark (transactional email), Sentry.io (error monitoring — with IP anonymisation enabled). A current list of subprocessors is maintained at /dpa. We do not sell personal data to advertisers, data brokers or analytics resellers.

6. Retention

Workspace identity: for the duration of the workspace, plus one year after cancellation. Enrolled-device metadata: for the duration of the enrolment, plus 90 days. Entitlement and audit-log data: for eight years from the invoice date, under the mandatory retention rule of the Zakon o računovodstvu. Payment metadata: for eight years from the invoice date, same rule. Support correspondence: for three years from the last message. Newsletter list: for the duration of the subscription, plus 30 days.

7. Transfers outside the EEA

Support correspondence stored by Fastmail is subject to a transfer to the United States. The transfer is covered by the EU–US Data Privacy Framework certification held by Fastmail Pty Ltd. No other personal data is transferred outside the European Economic Area.

8. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your personal data. You have the right to withdraw consent at any time for processing based on consent. You have the right to lodge a complaint with a supervisory authority.

To exercise a right, write to dpo@fifththirdstore.org from the workspace email or by post to the address at the top of this page. We respond within thirty days. When the request is complex we may extend the deadline by a further sixty days with prior notice on the workspace email.

9. Automated decision-making

We do not use automated decision-making producing legal effect on you. The marketplace API relies on rate-limiting rules, but a workspace hitting a rate limit is reviewed by a human before any commercial consequence is drawn.

10. Cookies and similar technologies

Cookies are covered in a separate cookie notice available at /cookies. In short: we set a first-party session cookie strictly necessary for the workspace sign-in, and a first-party analytics cookie only if you accept the cookie banner. No third-party advertising cookie is set.

11. Data breach

In the event of a personal-data breach likely to result in a risk to the rights and freedoms of the affected individuals, we notify the AZLP within 72 hours and the affected workspace administrators without undue delay, with a description of the breach, its likely consequences and the measures taken to address it.

12. Changes to this notice

We publish material changes to this notice on the workspace email at least thirty days before they take effect. Historical versions of the notice are archived at /privacy/history for consultation.

13. Contact

Data-protection officer: dpo@fifththirdstore.org. General support: support@fifththirdstore.org. Postal address: FifthThirdStore d.o.o., Attn: DPO, ul. Vaka Đurovića 12, 81000 Podgorica, Crna Gora.