Movermate Sub-processor List

Movermate uses the 22 sub-processors listed below to provide the Movermate Services. Customer data is hosted in the region set for each Customer's account: Australia (Sydney, the default), the European Union or the United States.

A sub-processor is a third party, including a Movermate group company, that processes personal data on Movermate's behalf when Movermate acts as a processor for its business Customers. This list forms Annex 3 of the Movermate Data Processing Agreement ("DPA") and is kept consistent with the Movermate Privacy Policy.

Effective date: 18 October 2026.

Movermate means Sprout Tech Pty Ltd, trading as Movermate, for Customers in Australia and New Zealand, and Movermate Inc. for Customers in all other countries.

How we choose and bind sub-processors

Before a sub-processor handles Customer data, Movermate:

1. reviews its security and privacy practices, including its certifications and audit reports where available;
2. signs a written agreement that requires it to protect the data to a standard no lower than the DPA, to process it only to provide its service to Movermate, and to keep it confidential;
3. puts in place a lawful transfer mechanism where data leaves the EEA, UK, Switzerland, Australia, New Zealand or Canada, such as the EU Standard Contractual Clauses and the UK Addendum, or the EU-US Data Privacy Framework where the provider is certified; and
4. limits what it receives to the data its service needs.

Movermate remains fully responsible to its Customers for each sub-processor's performance. Movermate reviews this list at least once a year.

Advance notice. At least 30 days before a new or replacement sub-processor starts processing Customer data, Movermate will email each Customer's account administrator and privacy contact and update this list. The notice names the sub-processor, its location and the processing it will do.

Subscribe to updates. Anyone else, such as a Customer's legal or procurement team, can receive the same notices by emailing privacy@movermate.io with the subject "Subscribe to sub-processor updates".

Right to object. A Customer may object on reasonable data protection grounds by writing to privacy@movermate.io within the 30-day notice period. Movermate will discuss the objection in good faith. If it cannot offer a reasonable alternative, the Customer may terminate the affected Services before the change takes effect, with no termination charge and a refund of prepaid fees for the remaining period, as set out in Section 7.4 of the DPA.

Urgent replacement. If Movermate must replace a sub-processor urgently to protect security or keep the Services running, it may give shorter notice. It will tell Customers as soon as possible, and the right to object still applies.

Movermate staff in Australia, India and the United States access Customer data only when needed for support, troubleshooting, maintenance, development and security, under confidentiality obligations and role-based access controls.

Customer data at rest stays in the Customer's hosting region with these providers. The location shown is where the provider is headquartered.

These providers deliver the emails and SMS that Customers send to their own customers and crews through the Services, and handle support communications.

AI providers receive only the information a feature needs, and process it under API terms and settings that do not allow them to use it to train their models. Requests routed through OpenRouter go only to model providers that meet the same condition. Movermate does not use Customer data to train AI models.

These apps are not Movermate sub-processors. They receive data only if a Customer connects them to its Movermate account, and the Customer decides what is shared. The Customer's own agreement with each provider, and that provider's privacy policy, govern the data once it is sent. Movermate lists them here so Customers know where data can go if they enable them.

These providers are not sub-processors for Customer data. Movermate uses them for its own business, such as billing Customers for their subscriptions and running its website, under the Movermate Privacy Policy. They do not receive the records Customers keep in the Services.

Contact. Questions about this list, objections and subscription requests go to privacy@movermate.io. Customers in the EU, EEA and UK can also contact Movermate's representative, Euverify, at gdpr@euverify.com.