This Data Processing Addendum ("DPA") forms part of the End-User Licence Agreement ("EULA") between Digital Craft Marketing Ltd ("Move Agent", "Processor", "we", "us", "our") and the Subscriber ("Controller", "you", "your").

1. Definitions

"Data Protection Laws" means the UK GDPR and the Data Protection Act 2018.

"Personal Data" means any information relating to an identified or identifiable natural person processed by Move Agent on your behalf.

"Sub-processor" means any third party engaged by Move Agent to process Personal Data.

2. Scope and Role

Roles: You are the Controller and Move Agent is the Processor, processing Personal Data only on your documented instructions.

Subject Matter: Provision of removals and storage management software services.

Duration: The term of the EULA plus the period until deletion or return of Personal Data in accordance with this DPA.

3. Obligations of the Processor

Move Agent agrees to:

Instructions: Process Personal Data only on your documented instructions, unless required by law.
Confidentiality: Ensure authorised personnel are subject to confidentiality obligations.
Security: Implement appropriate technical and organisational measures to protect Personal Data.
Assistance: Provide reasonable assistance for data subject requests and regulator enquiries where required.

4. Sub-processing

You provide general authorisation for Move Agent to engage Sub-processors.

Move Agent remains responsible for Sub-processor performance of relevant data protection obligations.

We may update Sub-processors from time to time and will make an up-to-date list available on request.

Current Sub-processors include Supabase (database and managed infrastructure), Vercel (hosting and delivery infrastructure), Brevo (email communications), Google (Gemini), and OpenAI.

5. Data Transfers

Move Agent will not transfer Personal Data outside the UK or EEA unless an appropriate transfer mechanism is in place under Data Protection Laws (for example, adequacy regulations or approved contractual clauses).

6. Breach Notification

In the event of a Personal Data breach affecting Personal Data processed under this DPA, Move Agent will notify you without undue delay after becoming aware of the breach and provide available information reasonably required to support your legal reporting obligations.

7. Deletion or Return of Data

On termination or expiry of the Services, and subject to applicable law, Move Agent will delete or return Personal Data in accordance with your written instructions and applicable retention requirements.

Annex 1: Details of Processing

Subject Matter: Removals, packing, and storage logistics management.
Duration of Processing: For the duration of the subscription and any agreed post-termination period.
Nature of Processing: Collection, storage, organisation, retrieval, analysis, and transmission of data via the SaaS platform.
Types of Personal Data: Names, UK addresses, phone numbers, email addresses, inventory lists, signatures, and other data submitted by the Subscriber.
Categories of Data Subjects: End customers, employees, and contractors of the Subscriber.

Annex 2: Technical and Organisational Measures

Shared Security Model: Move Agent applies application-level controls and oversight, while selected infrastructure Sub-processors provide underlying platform security controls.
Encryption: Encryption in transit (TLS) and encryption at rest where supported by infrastructure providers, including Supabase and Vercel.
Backups and Recovery: Backup and recovery controls are provided through managed infrastructure services, including Supabase, together with internal recovery procedures.
Access Controls: Role-based and least-privilege access controls are used to restrict access to authorised personnel and systems.
Security Monitoring: Ongoing monitoring and operational controls are maintained to support confidentiality, integrity, and availability of Personal Data.

Contact

Digital Craft Marketing Ltd

Registered in England and Wales. Company number: 08816740

Website: https://moveagent.co.uk

Contact: https://moveagent.co.uk/contact

Data Processing Addendum (DPA)