Last Updated on: October 18th, 2026
Movermate Data Processing Agreement
1. Parties and how this DPA applies
This Data Processing Agreement ("DPA") sets out how Movermate processes personal data on behalf of its business customers. It forms part of the agreement under which the Customer uses the Movermate Services (the "Agreement"), and applies automatically when the Customer accepts the Agreement.
Effective date: 18 October 2026.
Parties.
- The Customer: the business that has accepted the Agreement.
- Movermate: the Movermate company that is party to the Agreement:
- Sprout Tech Pty Ltd, trading as Movermate, Ground floor, 470 St Kilda Road, Melbourne VIC 3004, Australia, for Customers in Australia and New Zealand; and
- Movermate Inc., 2810 N Church St #88983, Wilmington, DE 19802, USA, for Customers in all other countries.
Order of precedence. If there is a conflict, the following apply in this order: (a) the Standard Contractual Clauses, where they apply; (b) this DPA; (c) the Agreement. Nothing in the Agreement reduces the Customer's protections under this DPA.
Signature. This DPA needs no separate signature. A Customer that wants a countersigned copy can request one at privacy@movermate.io.
2. Definitions
Terms not defined here have the meaning given in the Agreement or in Data Protection Laws.
- "Customer Personal Data" means personal data that the Customer, its users or its customers put into the Services, or that the Services collect for the Customer, and that Movermate processes on the Customer's behalf. It includes Movermate Field location data.
- "Data Protection Laws" means all privacy and data protection laws that apply to the processing of Customer Personal Data, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the Australian Privacy Act 1988 (Cth), the New Zealand Privacy Act 2020, PIPEDA and Canadian provincial laws, and US state privacy laws such as the California Consumer Privacy Act.
- "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data held by Movermate or a Sub-processor.
- "Services" means the Movermate web application, the Movermate Field mobile app and related services provided under the Agreement.
- "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
- "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
- "Sub-processor" means any third party, including a Movermate group company, that Movermate engages to process Customer Personal Data.
- "controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the GDPR. They include equivalent terms in other Data Protection Laws, such as "business" and "service provider" under US state laws and "APP entity" under the Australian Privacy Act.
3. Roles and scope of processing
3.1 Roles. The Customer is the controller of Customer Personal Data and Movermate is its processor. Where the Customer is itself a processor for another controller, Movermate is the Customer's sub-processor, and the Customer confirms its instructions are authorised by that controller.
3.2 Group operation. For Customers in Australia and New Zealand, Sprout Tech Pty Ltd is the processor and Movermate Inc. operates the platform as its Sub-processor, under written terms at least as protective as this DPA.
3.3 Scope. This DPA covers only Customer Personal Data. It does not cover personal data Movermate processes as a controller, such as account, billing, support and marketing information about the Customer and its users. That information is handled under the Movermate Privacy Policy.
3.4 Details. The subject matter, nature, purpose and duration of the processing, and the types of personal data and data subjects, are set out in Annex 1.
3.5 No sale or other use. Movermate will not sell Customer Personal Data, use it for its own purposes or for advertising, or combine it with personal data from other customers or sources, except as needed to provide, secure and support the Services or as permitted by Data Protection Laws. Movermate may create aggregated, de-identified data that cannot reasonably identify any individual or the Customer, and will not attempt to re-identify it.
4. Customer instructions and responsibilities
4.1 Instructions. The Customer instructs Movermate to process Customer Personal Data to provide, secure and support the Services under the Agreement, as the Customer and its users direct through the Services (including the settings, features and integrations they choose), and as set out in this DPA. The Customer may give further written instructions if they are consistent with the Agreement and Data Protection Laws. An instruction that would require a change to the Services may be subject to agreement on scope and cost.
4.2 Customer's responsibilities. The Customer is responsible for:
- having a lawful basis, and giving any notices and obtaining any consents Data Protection Laws require, for the Customer Personal Data it provides or asks the Services to collect, including crew location data collected through Movermate Field and any information about children;
- the accuracy and quality of Customer Personal Data;
- its own choice to connect third-party integrations, such as accounting, payment, telephony or automation apps, and the terms of those apps (those apps are not Movermate's Sub-processors); and
- keeping its users' login details secure and managing who has access to its account.
4.3 Prohibited data. The Customer will not upload health or biometric information, government identification numbers, payment card numbers or similar sensitive information, unless the Services provide a feature designed for it.
5. Movermate's obligations as processor
Movermate will:
- process Customer Personal Data only on the Customer's documented instructions in Section 4.1, including for transfers to other countries, unless the law requires otherwise. In that case Movermate will tell the Customer before processing, unless the law prohibits it;
- tell the Customer promptly if, in its opinion, an instruction breaches Data Protection Laws. Movermate may suspend that instruction until the Customer confirms or changes it;
- ensure that everyone it authorises to process Customer Personal Data is bound by confidentiality obligations, receives privacy and security training, and has access only as needed for their role;
- comply with the Data Protection Laws that apply to it as a processor, and tell the Customer if it can no longer meet its obligations under this DPA or those laws;
- not disclose Customer Personal Data to any third party except to Sub-processors under Section 7, as the Customer instructs, or as the law requires; and
- where an authority requests Customer Personal Data, redirect the authority to the Customer where lawful, notify the Customer promptly unless the law prohibits it, challenge requests it reasonably considers unlawful, and disclose only the minimum required.
6. Security
6.1 Measures. Movermate will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, and the nature, scope, context, purposes and risks of the processing. The measures in place at the effective date are set out in Annex 2.
6.2 Updates. Movermate may update its measures over time, but will not materially reduce the overall level of protection for Customer Personal Data during the term of the Agreement.
6.3 Customer's part. The Customer is responsible for its own use of the Services, including setting user permissions, using multi-factor authentication where offered, and protecting data it exports from the Services.
7. Sub-processors
7.1 General authorisation. The Customer authorises Movermate to engage the Sub-processors listed in Annex 3, and further Sub-processors under this Section 7.
7.2 Sub-processor terms. Before a Sub-processor processes Customer Personal Data, Movermate will put in place a written contract that imposes data protection obligations no less protective than this DPA, to the extent they apply to the Sub-processor's service. Movermate remains fully responsible to the Customer for each Sub-processor's performance.
7.3 Notice of changes. At least 30 days before a new or replacement Sub-processor starts processing Customer Personal Data, Movermate will notify the Customer by email to the account's administrator or privacy contact, and update the list in Annex 3. The notice will name the Sub-processor, its location and the processing it will do.
7.4 Right to object. The Customer may object on reasonable data protection grounds by writing to privacy@movermate.io within the notice period. The parties will discuss the objection in good faith. If Movermate cannot offer a reasonable alternative, such as not using that Sub-processor for the Customer's data, the Customer may terminate the affected Services by written notice before the change takes effect. Movermate will then refund any prepaid fees for the period after termination, with no termination charge.
7.5 Urgent replacement. If Movermate must replace a Sub-processor urgently to protect the security or continuity of the Services, it may do so with shorter notice. It will notify the Customer as soon as possible, and the Customer's right to object under Section 7.4 still applies.
7.6 Integrations chosen by the Customer. Third-party apps the Customer connects to the Services, such as accounting, payment, telephony, messaging or automation apps, are not Movermate's Sub-processors. Data the Customer sends to them is governed by the Customer's own terms with those providers.
8. Hosting and international transfers
8.1 Hosting region. Customer Personal Data in Movermate's primary application databases, uploaded files and their backups is hosted in the region set for the Customer's account: Australia (Sydney, the default), the European Union or the United States. Movermate will not move that data to another region without the Customer's written agreement.
8.2 Other locations. Customer Personal Data may also be accessed or processed outside the hosting region:
- by Movermate's authorised support staff in Australia and India, and development staff in the United States, Australia and India, only as needed for support, troubleshooting, maintenance, development and security; and
- by the Sub-processors in Annex 3, in the locations listed there.
8.3 EU and EEA. Where Customer Personal Data subject to the EU GDPR is transferred to a country without an adequacy decision, the SCCs are incorporated into this DPA as set out in Annex 4: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor.
8.4 United Kingdom. For Customer Personal Data subject to the UK GDPR, the SCCs apply as amended by the UK Addendum, as set out in Annex 4.
8.5 Switzerland. For Customer Personal Data subject to the Swiss Federal Act on Data Protection, the SCCs apply with the adjustments set out in Annex 4.
8.6 Australia, New Zealand and Canada. Movermate will ensure overseas recipients are bound to protect Customer Personal Data in a way consistent with Australian Privacy Principle 8, New Zealand Information Privacy Principle 12 and Canadian Data Protection Laws, including through the Sub-processor contracts in Section 7.2.
8.7 Transfer assessments. Movermate will give the Customer the information it reasonably needs to carry out any transfer impact assessment, and will apply supplementary measures where they are needed.
9. Data subject requests and other assistance
9.1 Self-service. The Services let the Customer access, correct, export and delete Customer Personal Data, which allows the Customer to respond to most requests itself.
9.2 Requests sent to Movermate. If Movermate receives a request from a data subject about Customer Personal Data, including through its EU and UK representative's portal, it will forward the request to the Customer within 5 business days and will not respond to it directly, except to confirm that the request has been passed to the Customer.
9.3 Assistance. Where the Customer cannot handle a request through the Services, Movermate will provide reasonable assistance, taking into account the nature of the processing.
9.4 Impact assessments and consultations. Movermate will provide reasonable information and assistance for the Customer's data protection impact assessments and any prior consultation with a supervisory authority that relate to the Services.
9.5 Cost. Assistance through the Services' self-service features, and assistance needed because of Movermate's breach of this DPA, is free. Other assistance that takes significant time may be charged at reasonable rates agreed in advance.
10. Personal Data Breach
10.1 Notice. Movermate will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. Notice goes by email to the account's administrator and privacy contact.
10.2 Content. The notice will describe, as far as then known: the nature of the breach, including the categories and approximate number of data subjects and records affected; the likely consequences; the measures taken or proposed to address it and reduce its effects; and a contact for more information. Where information is not yet available, Movermate will provide it in stages as it becomes available.
10.3 Response. Movermate will promptly take reasonable steps to contain, investigate and remedy the breach, and will cooperate with the Customer so it can meet its own notification obligations to regulators and individuals, including under the Australian Notifiable Data Breaches scheme, the New Zealand Privacy Act 2020, the EU and UK GDPR, Canadian law and US state breach laws.
10.4 Customer notifications. The Customer decides whether to notify regulators and individuals about breaches of Customer Personal Data. Movermate will not notify them on the Customer's behalf without the Customer's agreement, unless the law requires it.
10.5 No admission. Notifying or responding to a breach is not an admission of fault or liability.
11. Audits and information
11.1 Information. On request, Movermate will make available the information reasonably needed to show it complies with this DPA, including a summary of its security measures, its current Sub-processor list, and the results of its independent Cloud Application Security Assessment (CASA Tier 3), subject to confidentiality.
11.2 Questionnaires. Movermate will complete one reasonable security or privacy questionnaire per year, and further questionnaires after a Personal Data Breach or where a supervisory authority requires it.
11.3 Audits. If the information under Sections 11.1 and 11.2 does not reasonably show compliance, or a supervisory authority requires it, the Customer may audit Movermate's compliance with this DPA, either itself or through an independent auditor bound by confidentiality, subject to these conditions:
- at most once in any 12-month period, unless after a Personal Data Breach or at a supervisory authority's request;
- with at least 30 days' written notice and an agreed scope;
- during business hours, without unreasonably disrupting Movermate's operations or accessing other customers' data; and
- at the Customer's cost, unless the audit shows that Movermate has materially breached this DPA, in which case Movermate bears its own costs and fixes the breach promptly.
11.4 Sub-processors. Audits of Sub-processors take place through the information and certifications Sub-processors make available, which Movermate will share where it is permitted to.
11.5 SCCs. Where the SCCs apply, this Section 11 sets out how the audit rights in the SCCs are exercised, and does not limit them.
12. Return and deletion of Customer Personal Data
12.1 During the term. The Customer can export and delete Customer Personal Data through the Services at any time.
12.2 After the Agreement ends. For 30 days after the Agreement ends, the Customer can export its Customer Personal Data, or ask Movermate to provide an export in a commonly used format. Movermate will then delete Customer Personal Data from its live systems within a further 30 days.
12.3 Backups. Backups expire within 35 days, so deleted Customer Personal Data is removed from backups within 35 days of its deletion from live systems. Until then, backups stay protected under this DPA and are not used for any other purpose.
12.4 Retention required by law. Movermate may keep Customer Personal Data only where the law requires it. Any such data stays protected under this DPA, is used only for the purpose the law requires, and is deleted when that requirement ends.
12.5 Confirmation. On request, Movermate will confirm in writing that deletion is complete.
13. Movermate Field location data and AI features
Movermate Field location data
13.1 When it is collected. Movermate Field collects precise location only while a crew member has an active job they have started and marked as departed, including in the background. Collection stops when the job is finished or the return is recorded.
13.2 Crew choice. The app explains the collection and asks the crew member to accept or decline before any device permission is requested. Declining leaves the app usable without location sharing, and the crew member can withdraw permission at any time in their device settings.
13.3 Use and access. Location data is visible only within the Customer's own account, is used only to show job progress and arrival times to the Customer, and is never used for advertising, sold, or used by Movermate for its own purposes.
13.4 Retention. Location positions are deleted automatically 12 months after they are recorded. The Customer can delete them sooner.
13.5 Customer's part. The Customer is responsible for telling its crew about location tracking and for meeting any workplace surveillance, employment or consent requirements that apply to it, such as state workplace surveillance laws in Australia.
AI features
13.6 Providers. AI features use the Sub-processors listed as AI providers in Annex 3, only to provide the feature the Customer's user asked for, such as drafting a message or building an inventory from photos.
13.7 No training. Movermate will not use Customer Personal Data to train AI models, and will engage AI providers only on terms and settings that do not allow them to use it to train their models. Requests routed through OpenRouter go only to model providers that meet this condition.
13.8 Human review. AI-drafted messages are shown to a user for review before they are sent. The Customer is responsible for any automated workflow it sets up that sends messages without review.
13.9 Opting out. The Customer can choose not to use AI features.
14. Regional terms
United States
14.1 Service provider. Under the California Consumer Privacy Act and similar state laws, Movermate is the Customer's service provider or processor. Movermate will not:
- sell or share Customer Personal Data, including for cross-context behavioural advertising;
- retain, use or disclose it for any purpose other than the business purposes in this DPA, or outside the direct business relationship with the Customer; or
- combine it with personal data it receives from other sources, except as those laws permit.
Movermate will give the same level of privacy protection the law requires of the Customer, will tell the Customer if it can no longer meet these obligations, and allows the Customer to take reasonable steps to stop and remedy unauthorised use. Movermate certifies that it understands and will comply with these restrictions.
Australia
14.2 Movermate will handle Customer Personal Data in a way that allows the Customer to comply with the Australian Privacy Principles, will not do anything that would breach them if done by the Customer, and will cooperate with the Customer on any eligible data breach under the Notifiable Data Breaches scheme.
New Zealand
14.3 Movermate holds Customer Personal Data as the Customer's agent for the purposes of section 11 of the Privacy Act 2020, and will not use or disclose it for its own purposes.
United Kingdom and European Union
14.4 Movermate's EU representative is Euverify Limited (Ireland) and its UK representative is Euverify Ltd (UK), both contactable at gdpr@euverify.com, for matters where Movermate acts in its own right. Movermate will keep the records of processing required by Article 30(2) of the EU and UK GDPR.
Canada
14.5 Movermate will protect Customer Personal Data with safeguards comparable to those the Customer must provide under Canadian Data Protection Laws. For Quebec personal information, Movermate will support the Customer's privacy impact assessment for transfers outside Quebec, and will report confidentiality incidents to the Customer under Section 10.
15. Liability, term and general
15.1 Liability. Each party is liable for its own breaches of this DPA. Liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the SCCs do not allow liability to be limited, including liability to data subjects under the SCCs.
15.2 Term. This DPA lasts for as long as Movermate processes Customer Personal Data, including after the Agreement ends until deletion under Section 12 is complete.
15.3 Changes. Movermate may update this DPA to reflect changes in law, regulator guidance or the Services, with at least 30 days' written notice. An update will not reduce the overall protection of Customer Personal Data unless the law requires it. If an update materially and adversely affects the Customer, the Customer may terminate the affected Services before the update takes effect and receive a refund of prepaid fees for the period after termination.
15.4 Governing law. This DPA is governed by the law that governs the Agreement, except that the SCCs are governed by the law set out in Annex 4.
15.5 Severability. If any part of this DPA is invalid or unenforceable, the rest remains in effect, and the invalid part is replaced with a valid provision that comes closest to the parties' intent.
15.6 Contacts. Privacy matters about this DPA go to privacy@movermate.io. The Customer should keep its administrator and privacy contact details up to date in its account, so that notices under this DPA reach it.
Annex 1: Description of the processing
| Item | Details |
|---|---|
| Subject matter | Providing the Movermate customer relationship management, quoting, scheduling, dispatch, invoicing and communication Services to the Customer under the Agreement |
| Nature of processing | Collection, recording, storage, organisation, retrieval, use, transmission to the Customer's chosen recipients (such as its customers by email or SMS), AI-assisted drafting, backup and deletion |
| Purpose | To provide, secure and support the Services as the Customer directs, as set out in Section 4.1 |
| Duration | The term of the Agreement plus the return and deletion periods in Section 12 |
| Frequency | Continuous, while the Customer uses the Services |
| Data subjects | The Customer's end customers (people moving); the Customer's staff, users, drivers, subcontractors and moving crews; the Customer's contacts, partners and suppliers; and people who comment on or react to the Customer's connected social media posts |
| Categories of personal data | Names and contact details (email, phone, address); move details (origin and destination addresses, dates, inventories, photos and videos of items); quotes, bookings, invoices and payment status; communications and notes; staff and crew details, job assignments and job photos; precise location of crew devices during active jobs (Movermate Field); IP address and device data; and public social media engagement data |
| Sensitive data | None intended (see Section 4.3). Precise geolocation is treated as sensitive personal information under some US state laws and is protected under Section 13 |
| Retention | As set by the Customer in the Services; Movermate Field location positions are deleted after 12 months; all data is deleted under Section 12 when the Agreement ends |
| Sub-processors | As listed in Annex 3 |
Annex 2: Technical and organisational measures
| Area | Measures |
|---|---|
| Encryption | Customer Personal Data is encrypted in transit and at rest. Passwords are stored only as secure hashes; access and connected-account tokens are stored encrypted |
| Access control | Multi-factor authentication for staff access to production systems; role-based access limited to job need; periodic access reviews; access removed promptly when staff leave |
| Tenant isolation | Each Customer's data is logically separated from other customers' data |
| Network and application security | Firewalls, intrusion detection, web application firewall and DDoS protection (Cloudflare); API security and authentication controls |
| Secure development | Secure software development lifecycle; application security testing against OWASP standards; secrets and credential management |
| Independent assessment | Cloud Application Security Assessment (CASA Tier 3) of the Movermate web application |
| Resilience | Regular backups, which expire within 35 days; disaster recovery procedures |
| Incident response | Documented incident response plan, with Customer notification under Section 10 |
| Personnel | Confidentiality obligations for staff and contractors; privacy and security training |
| Sub-processors | Written data protection terms with each Sub-processor under Section 7.2 |
| Data minimisation | Location collected only during active, departed jobs; AI providers receive only the information a feature needs |
Annex 3: Authorised sub-processors
These Sub-processors may process Customer Personal Data. Location is where the Sub-processor is based; hosted data stays in the Customer's hosting region under Section 8.1. Providers Movermate uses only for its own controller data, such as website cookie consent, subscription billing and advertising, are not listed because they do not process Customer Personal Data.
| Sub-processor | Processing | Location |
|---|---|---|
| Movermate Inc. | Operating the platform for Customers of Sprout Tech Pty Ltd (Australia and New Zealand) | United States |
| Sprout Tech Pty Ltd | Customer support for Customers of Movermate Inc. | Australia |
| Amazon Web Services (AWS) | Cloud hosting, storage, backups, monitoring and infrastructure security | United States (data hosted in the Customer's region) |
| MongoDB Atlas | Managed database hosting and backups | United States (data hosted in the Customer's region) |
| Redis Cloud | Caching, session management and background job processing | United States |
| Cloudflare | Security, DNS, content delivery, DDoS protection and web application firewall | United States |
| Amazon SES (AWS) | Transactional email | United States |
| SendGrid (Twilio) | Transactional email and delivery tracking | United States |
| Postmark (ActiveCampaign) | Transactional and inbound email | United States |
| Twilio | SMS delivery and notifications | United States |
| Sinch MessageMedia | Transactional SMS and booking confirmations | United States |
| Mobile Message | SMS delivery and booking reminders | Australia |
| TNZ | SMS delivery and operational notifications | New Zealand |
| Google Maps | Geocoding, routes, travel estimates and job planning | United States |
| Google (Workspace) | Support email and documents containing Customer Personal Data | United States |
| Microsoft (Microsoft 365) | Support email and calendar | United States |
| OpenAI | AI-assisted drafting of emails and SMS | United States |
| Google Gemini | AI-assisted drafting of emails and SMS | United States |
| Anthropic | AI-assisted drafting of customer communications | United States |
| OpenRouter | Routing AI requests to selected model providers | United States |
| Lexos | Building moving inventories from photos and videos | United States |
| LiveSwitch | Virtual surveys, video walkthroughs and inventory processing | United States |
The current list is also published with the Movermate Privacy Policy. Changes follow Section 7.3.
Annex 4: Standard Contractual Clauses and UK Addendum selections
EU Standard Contractual Clauses
Where Section 8.3 applies, the SCCs are incorporated by reference, completed as follows:
| SCC clause | Selection |
|---|---|
| Modules | Module 2 (controller to processor) where the Customer is a controller; Module 3 (processor to processor) where the Customer is a processor |
| Data exporter | The Customer, with the contact details in its account |
| Data importer | The Movermate company that is party to the Agreement (Section 1), contact privacy@movermate.io |
| Clause 7 (docking clause) | Applies |
| Clause 9(a) (sub-processors) | Option 2, general written authorisation, with at least 30 days' notice of changes under Section 7.3 |
| Clause 11(a) (independent dispute resolution body) | The optional wording does not apply |
| Clause 13 (supervision) | The supervisory authority of the EU member state where the Customer is established. If the Customer is not established in the EU but has appointed a representative under Article 27 GDPR, the supervisory authority where that representative is established. Otherwise, the Irish Data Protection Commission |
| Clause 17 (governing law) | Option 1, the law of Ireland |
| Clause 18 (courts) | The courts of Ireland |
| Annex I.A (parties) | As above |
| Annex I.B (description of transfer) | Annex 1 of this DPA |
| Annex I.C (competent supervisory authority) | As set out for Clause 13 |
| Annex II (security measures) | Annex 2 of this DPA |
| Annex III (sub-processors) | Annex 3 of this DPA |
UK Addendum
Where Section 8.4 applies, the UK Addendum (version B1.0, in force from 21 March 2022) is incorporated by reference, completed as follows:
| Table | Selection |
|---|---|
| Table 1 (parties) | The Customer as exporter and the Movermate company that is party to the Agreement as importer, with the details above |
| Table 2 (selected SCCs) | The SCCs as completed above, including the modules and clause selections |
| Table 3 (appendix information) | Annexes 1, 2 and 3 of this DPA |
| Table 4 (ending the Addendum when the Approved Addendum changes) | Neither party |
Switzerland
Where Section 8.5 applies, the SCCs apply with these adjustments: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the Swiss Federal Act on Data Protection; references to "member state" include Switzerland, so data subjects in Switzerland can bring claims where they habitually reside; and references to the GDPR are read as references to the Swiss Federal Act on Data Protection.