Data Processing Agreement
Terms under which Moove processes personal data on behalf of customers (GDPR Article 28 and equivalent laws). Last updated: 2026-11-02.
Roles and scope
Customer is the controller; Moove is the processor and processes workspace data only to provide the service and on the customer's documented instructions, for the duration of the subscription.
Confidentiality
Personnel with access to personal data are bound by confidentiality obligations and access is granted on a need-to-know basis.
Security measures
Encryption in transit and at rest, logical isolation between organizations, role-based permissions, audit logs, backups and incident response.
Sub-processors
Moove uses hosting, email, messaging, payment and AI sub-processors bound by written obligations at least as protective as this agreement. The current list is available on request, and customers are notified of material changes with the right to object.
International transfers
Transfers outside the EEA/UK are covered by the EU Standard Contractual Clauses (processor modules), the UK Addendum or other valid mechanisms, which are incorporated by reference.
Assistance and audits
Moove assists the customer with data subject requests, impact assessments and authority inquiries, and makes available information needed to demonstrate compliance, including reasonable audits with prior notice.
Personal data breaches
Moove notifies the customer without undue delay after becoming aware of a breach affecting customer data, with the information available to support the customer's own notifications.
Return and deletion
At the end of processing, Moove will return or delete personal data at the customer’s choice under documented instructions and the applicable agreement, unless law requires retention. Backup copies remain subject to restricted access and the applicable deletion cycle. Arrange export before termination or contact us for the agreed return process.