Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Digital Inventory Group LLC ("Processor", "FifthFirm") and the organization subscribing to the FifthFirm platform ("Controller", "you").

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person processed through the Service.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and deletion.
• "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
• "Data Breach" means any unauthorized access to, acquisition of, or disclosure of Personal Data.

2. Roles and Responsibilities

Controller: You determine the purposes and means of processing Personal Data. You are responsible for ensuring that your use of FifthFirm complies with applicable data protection laws and that you have obtained necessary consents from data subjects.

Processor: FifthFirm processes Personal Data only on your documented instructions and solely for the purpose of providing the Services described in our Terms of Service.

3. Processing Instructions

FifthFirm will:

• Process Personal Data only in accordance with your documented instructions, unless required by law
• Not process Personal Data for any purpose other than providing the Services
• Not sell Personal Data or use it for advertising, marketing, or profiling purposes
• Not use Personal Data to train AI models or for any purpose beyond the scope of the Services

4. Security Measures

FifthFirm implements and maintains the following technical and organizational security measures:

• Encryption in transit (TLS 1.2+)
• Encryption at rest (AES-256)
• OAuth 2.0 for third-party integrations (no credential storage)
• Role-based access controls (RBAC) with Owner, Admin, Staff, and Viewer roles
• Multi-tenant data isolation between organizations
• Audit logging of all data access and modifications
• Regular security assessments and vulnerability scanning
• Employee access limited to need-to-know basis

5. Sub-processors

FifthFirm uses the following sub-processors to provide the Services:

We will notify you at least 30 days before adding a new sub-processor. If you object to a new sub-processor, you may terminate the affected Services without penalty within 30 days of notification.

6. Data Breach Notification

FifthFirm will notify you of any Data Breach without undue delay and no later than 72 hours after becoming aware of it. Notification will include:

• Nature of the breach and categories of data affected
• Approximate number of data subjects affected
• Likely consequences and measures taken to mitigate the breach
• Contact point for further information

7. Audit Rights

You have the right to audit FifthFirm's compliance with this DPA. Upon reasonable written notice (at least 30 days), FifthFirm will make available all information necessary to demonstrate compliance and allow for audits, including inspections, conducted by you or an independent auditor. Audits shall be conducted during normal business hours and shall not unreasonably interfere with FifthFirm's operations.

8. Data Subject Rights

FifthFirm will assist you in responding to data subject requests (access, correction, deletion, portability) by providing the technical capabilities within the platform (data export, account deletion) and by responding to your instructions within 10 business days.

9. Data Return and Deletion

Upon termination of the Services or upon your written request:

• FifthFirm will make your data available for export in a standard machine-readable format (CSV or JSON) for 30 days
• After 30 days, FifthFirm will delete all Personal Data from active systems, except where retention is required by law (e.g., financial records — 7 years, audit logs — 7 years)
• FifthFirm will provide written confirmation of deletion upon request

10. International Data Transfers

FifthFirm's primary infrastructure is hosted by Hetzner Online GmbH in Germany (EU). If Personal Data is transferred outside the European Economic Area, FifthFirm will ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as adopted by the European Commission.

11. Term and Governing Law

This DPA remains in effect for the duration of your use of the Services and survives termination to the extent necessary for FifthFirm to fulfill its obligations regarding data return, deletion, and retention. This DPA is governed by the laws of the State of South Carolina.

12. Contact

For DPA-related inquiries or to request an executed copy:
Digital Inventory Group LLC
Email: legal@fifthfirm.com