Data processing agreement

This DPA forms part of the agreement between the community owner ("Controller") and FiveApply ("Processor").

1. Subject matter

Processing of applicant personal data to provide application collection, review, interview scheduling and Discord role management.

2. Categories of data subjects and data

Applicants (who may include minors) and community staff. Data: Discord identifiers and profile basics, application answers, age (not date of birth), server membership dates, game identifiers (optional).

3. Processor obligations

• Process only on documented instructions from the Controller (the community's configuration).
• Ensure personnel confidentiality; implement appropriate technical and organisational measures, including tenant isolation, encryption of OAuth tokens at rest, hashed API keys and access controls.
• Assist with data subject requests (export and deletion are self-service for applicants).
• Delete data at the end of the retention period configured by the Controller, and on termination.
• Notify the Controller without undue delay of a personal data breach.

4. Sub-processors

Discord, Stripe, Cloudflare (optional), hosting provider, Sentry (optional). The Controller will be notified of changes.