5dive Enterprise Data Processing Agreement (DPA)

Between TD The Market Publishers Ltd. (HE186602, Chrysanthou Mylona 1, 3030 Limassol, Cyprus), trading as 5dive ("5dive", "we"), and the organisation that buys 5dive Enterprise ("you"). Words defined in the 5dive Enterprise Terms mean the same here. "GDPR" means Regulation (EU) 2016/679, and includes the UK GDPR where it applies.

1. The short version

The Software runs on your systems. The personal data it handles there, such as your clients' files and your people's chats, is never sent to us, and we have no access to it. That processing is yours alone and is outside this DPA.

This DPA covers the little we do receive: the Support Data your people choose to send, and, only if you connect the 5dive app to the Software, the chat messages that pass through our relay.

2. Roles

• For Support Data and relay data, you are the controller and we are your processor. If you act for your own clients as their processor, we are your sub-processor, and you pass on their instructions.
• For your account and billing details, we are the controller, under our privacy policy.

3. What we do as your processor

We will:

1. process the data only on your documented instructions, which are these terms, the DPA and your use of support, unless the law requires otherwise, in which case we tell you first unless the law forbids it;
2. make sure anyone who can access the data is bound by confidentiality;
3. protect the data with the measures in Annex 2;
4. use sub-processors only as section 4 allows;
5. help you, as far as we reasonably can, to answer requests from people exercising their GDPR rights;
6. help you with security, breach notification, impact assessments and consultations with a regulator, taking into account what we process and the information we have;
7. delete the data at the end, as section 9 says;
8. give you the information you need to show that we meet GDPR Article 28, and allow audits as section 8 says.

We will tell you if we believe an instruction breaks data-protection law.

4. Sub-processors

You authorise the sub-processors listed in Annex 3. Before we add or replace one, we email you at least 30 days ahead. If you object on reasonable data-protection grounds and we cannot resolve it, you may end the Subscription, and we refund the unused part of the fees you paid. Each sub-processor is bound by written terms that protect the data at least as well as this DPA. We remain responsible to you for them.

5. Personal data breaches

We tell you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting your data. We give you what GDPR Article 33(3) requires as soon as we have it: what happened, the data and people affected, the likely effects and the steps taken. We take reasonable steps to contain it.

6. Transfers outside the EEA

We are in the EU (Cyprus). Some sub-processors are outside the European Economic Area (Annex 3). Where one of them receives your data in a country without an EU adequacy decision, we transfer it only under a lawful mechanism: the sub-processor's certification under the EU-US Data Privacy Framework, or the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914, Module 3) signed with that sub-processor, with the UK Addendum where UK law applies. On request, we tell you which mechanism covers each sub-processor.

7. Your instructions and your side

You are responsible for having a lawful basis to send us Support Data, and for keeping out of it what support does not need: client files, health data and other special-category data.

8. Audits

We answer your reasonable written questions about our data protection within 30 days. If the answers are not enough, or a regulator requires it, you or an independent auditor bound by confidentiality may audit our processing of your data once a year, with 30 days' written notice, at your own cost, without access to other customers' data. A regulator's requirement or a breach affecting your data allows an extra audit.

9. Deletion

When the Subscription ends, we delete your Support Data and relay data within 30 days, unless the law requires us to keep some of it. In that case we keep only that part, only for as long as required, and protect it under this DPA. Before the end, you can ask us for a copy of your support chat.

10. Liability and precedence

Liability under this DPA is subject to the limits in the 5dive Enterprise Terms, unless the law does not allow them. On personal data, this DPA prevails over the Terms. The Standard Contractual Clauses prevail over both.

---

Annex 1: Details of the processing

Annex 2: Security measures

• No access to your systems. We do not host, install or log into the Software on your side, and we do not ask for remote access.
• Less data by design. A support report or support file carries technical details, and is built to leave personal content out before it leaves your server.
• Encryption in transit for everything sent to us.
• Access control. Only our support systems, and the people who run them, can read Support Data.
• Logging and monitoring of our support systems.
• Encrypted chat option. With encrypted chat on, our relay carries only scrambled text it cannot read.
• Security contact: security@5dive.com.

Annex 3: Sub-processors

Stripe takes payments. It handles billing details for us as controller and never receives Support Data.