Data Processing Agreement

1. What this is and when it applies

This Data Processing Agreement ("DPA") forms part of our Terms of Service and applies whenever you use MoverTrack to handle personal data about other people — above all your customers.

It exists because data protection law requires a written contract between a controller and a processor, and because you should be able to see exactly what we do with your customers' details.

2. Who is who

You are the controller. You decide which customers to enter, what to record about them, and who receives a tracking link. They are your customers, not ours.

We are your processor. We store and move that data to run the Service for you, and for no purpose of our own. We do not sell it, we do not market to your customers, and we do not use it to train anything. Information that has been anonymised and combined, so that it can no longer identify anyone, is no longer personal data, and we may use it to run, measure and improve the Service.

Separately, we are a controller in our own right for the data about you — your account, your login, your billing. That is covered by our Privacy Policy, not by this DPA.

3. What we process for you

Subject matter and purpose: providing the MoverTrack service — scheduling, orders, customer tracking pages, messaging, team management and, where your plan includes it, turning WhatsApp chats into suggested jobs.

Duration: for as long as your account is active, plus the retention periods in section 10.

Categories of data subject: your customers, the people they nominate as contacts, and your workers.

Categories of personal data:

• names, phone numbers and email addresses of your customers;
• the addresses of each job, and any notes you add to a job;
• order details, prices and job history;
• photographs and files you or your workers upload to a job;
• the location of the vehicle while you have tracking running, and the resulting route and estimated arrival time;
• WhatsApp messages sent or received through the Service — for each message who sent it, when, what kind it was and its delivery status (kept so that messages are sent only while WhatsApp allows it, within its 24-hour customer service window), and its content (text, photos, voice notes and files) as far as the way of working you choose keeps it;
• your workers' names, phone numbers and job assignments.

Choosing a way of working in the app is your instruction to us about what to keep of your WhatsApp chats. When you choose one that keeps less, your plan no longer includes the one you had, or you remove your number from the Service, we delete from the Service what it no longer keeps of your customers' messages; the chats themselves stay in WhatsApp.

We do not ask for and do not want special category data — health, beliefs, biometrics and the like. Please do not put it in a job note.

4. We act only on your instructions

We process this data only as needed to provide the Service, as set out in the Terms, and on any further documented instruction you give us. If we ever believe an instruction breaks data protection law, we will tell you rather than quietly follow it.

If law compels us to process or disclose data beyond your instructions, we will tell you first unless we are legally prohibited from doing so.

5. Confidentiality

Access is limited to those who need it to run or support the Service, and they are bound by confidentiality obligations. MoverTrack is operated by a very small team; access is correspondingly narrow.

6. Security (Annex II — technical and organisational measures)

We keep measures appropriate to the risk, including:

• encryption in transit (TLS) for all connections to our servers, apps and databases;
• encryption at rest for the database and backups;
• row-level access rules in the database so one account cannot read another's data, and on our own servers a check of the signed-in account, and of what it may see, on every request they answer;
• authentication on every request that reaches customer data, and administrative functions restricted to named operator accounts;
• a customer's phone number reaches the people working for you only if you allow it, and a chat only if you give them access to it;
• hosting with established infrastructure providers (see section 7);
• regular review of who and what can reach production data.

These are the technical and organisational measures referred to in Annex II of the Standard Contractual Clauses incorporated by section 11. We may change them, but not in a way that materially reduces the overall level of security.

No system is perfectly secure, and we do not claim otherwise.

7. Sub-processors

We use the following sub-processors. Each is bound by written data protection terms, as the law requires, and we remain responsible to you for what they do:

• Supabase — database, authentication and file storage (EU, Frankfurt region)
• Vultr — application servers for tracking and messaging (EU, Frankfurt)
• Vercel — hosting for our websites and customer tracking pages
• Google — maps, geocoding, routing and distance calculation; reading the text of a chat or a message to fill in a job when you ask; our email
• Meta Platforms — WhatsApp Business messaging
• Stripe — payment processing (your billing data; not your customers')
• Resend — transactional and billing email
• Telnyx — telephony and caller ID, where you use those features
• Apple and Google — push notification delivery to your devices and those of the people working for you
• Expo — passing push notifications on to Apple and Google; a notification can carry a customer's name or number and the text of their message

This list is Annex III of the Standard Contractual Clauses incorporated by section 11. You authorise these sub-processors generally, and authorise us to appoint others on the same terms.

We will give you at least 30 days' notice before adding or replacing a sub-processor. You may object within that period on reasonable, documented data protection grounds. If you do, we will try to offer a change that avoids the objection; if we cannot do so on commercially reasonable terms, either of us may terminate the affected part of the Service, and your only remedy is a refund of fees already paid for the unused remainder of the period. Objecting does not suspend the appointment while we discuss it.

8. Helping you with your customers' rights

If one of your customers asks you for a copy of their data, asks you to correct it, or asks you to delete it, that request is yours to answer — but we will help.

Most of it you can do yourself inside the Service. Where you cannot, email info@movertrack.com and we will assist within a timescale that lets you meet your own deadline. If a customer contacts us directly, we will not answer on your behalf; we will pass it to you.

9. If something goes wrong

If we become aware of a breach affecting personal data we process for you, we will tell you without undue delay, with what we know: what happened, who and what is affected as far as we can tell, what we are doing about it, and what we suggest you do.

We will also give you reasonable help with any assessment or regulator notification you have to make, and with a data protection impact assessment if you need one.

10. Deletion and return

You can export your data at any time while your account is active. Deleting the account yourself in the app is your choice to delete: everything is erased at once, so export what you need first. If the account ends any other way, you can still export for 30 days after it ends.

At the end of the Service, you choose whether we return your data or delete it. Tell us within those 30 days. If you tell us nothing, we delete it.

After that we delete or anonymise the personal data we hold for you, except where law requires us to keep something — for example transaction records kept for tax. Backups roll off on their own cycle and are deleted within 90 days.

11. International transfers and the Standard Contractual Clauses

Our database and application servers for European customers are in the EU (Frankfurt). Some sub-processors in section 7 are established in the United States, and MoverTrack, LLC is itself a United States company, so some personal data is transferred there.

For those transfers the parties enter into the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914, which are incorporated into this DPA by reference and completed as follows:

• Module Two (controller to processor) applies. You are the data exporter; MoverTrack, LLC is the data importer.
• Clause 7 (docking clause) applies.
• Clause 9 — option 2, general written authorisation, with the 30 days' notice set out in section 7.
• Clause 11 — the optional independent dispute resolution language does not apply.
• Clause 17 — the Clauses are governed by the law of Ireland.
• Clause 18 — disputes are resolved before the courts of Ireland.
• Annex I.A (parties) — you, as identified by your account; MoverTrack, LLC, 1111B S Governors Ave STE 42337, Dover, DE 19904, United States, info@movertrack.com.
• Annex I.B (description of transfer) — the data subjects, categories of data, purposes, frequency (continuous) and duration set out in section 3 of this DPA.
• Annex I.C (competent supervisory authority) — the authority of the EEA member state in which you are established, or in which your representative is established.
• Annex II (security measures) — section 6 of this DPA.
• Annex III (sub-processors) — section 7 of this DPA.

For transfers of personal data subject to UK data protection law, the parties also enter into the UK International Data Transfer Addendum issued under section 119A of the Data Protection Act 2018, with the above as the Approved SCCs, Tables 1–3 completed by reference to Annex I above and Table 4 set to neither party. For transfers subject to Swiss law, references to the GDPR are read as references to the Swiss FADP and the competent authority is the FDPIC.

Where a sub-processor is certified under the EU–US Data Privacy Framework we may rely on that certification instead for transfers to it.

If the Clauses and this DPA conflict, the Clauses prevail.

12. Audit and information

We will give you the information you reasonably need to show that we are meeting our obligations here, and will contribute to audits mandated by data protection law.

Because we are a very small team, that means written answers and documentation rather than on-site inspection. Where an audit is genuinely required, it may be carried out once in any twelve-month period (more often only if a supervisory authority requires it or after a confirmed breach affecting your data), on 30 days' written notice, during business hours, without disrupting the Service, by someone who is not our competitor, subject to confidentiality, and at your cost.

13. Responsibility between us

You warrant that you have a lawful basis for every piece of personal data you put into the Service, that you have given your customers the information their law requires, that your instructions to us are lawful, and that you will not send us special category data.

You will indemnify us against claims, fines and reasonable costs arising from a breach of that warranty, from your instructions, or from a claim by one of your customers that relates to your own acts or omissions rather than ours.

Each party's liability under this DPA is subject to the limits and exclusions in section 18 of the Terms of Service, and those limits apply to all claims under this DPA in aggregate with all claims under the Terms. Nothing here limits a data subject's rights against either of us under the Standard Contractual Clauses or applicable law.

If a supervisory authority or a court holds us jointly liable for something caused by your instructions or your breach, you will reimburse us for the share attributable to you.

14. Precedence and contact

If this DPA and the Terms of Service conflict on the handling of personal data, this DPA wins.

MoverTrack, LLC
1111B S Governors Ave STE 42337, Dover, DE 19904, United States
Email: info@movertrack.com