Data processing

This page sets out how movd handles personal data when we move for a business customer. If your organisation needs these terms signed as a formal data processing agreement, email hello@movd.world and we will send a copy for signature.

Where you book a move for your own staff or clients, you are the controller of that personal data and movd is the processor. Where an individual books directly with us, movd is the controller and our privacy notice applies.

Names, email addresses, phone numbers, collection and delivery addresses, access notes, capture video and photos of the items being moved, booking times and payment status. We process these only to quote for, schedule and carry out the move, to take payment, and to keep records we are legally required to keep.

We process personal data only on your documented instructions, which includes the bookings you place through movd. We will tell you if we believe an instruction breaks data protection law.

Everyone at movd with access to personal data is bound by confidentiality and only sees what their job needs. Crew see the job sheet, which excludes prices, contact details and video. Access is reviewed when someone joins or leaves.

Encryption in transit, private storage that is not publicly reachable, short-lived links for viewing video, two-step sign in for staff accounts, automatic session timeouts, rate limiting on public endpoints, a permanent audit trail of who accessed what, and alerting on suspicious activity.

We use the companies listed on our subprocessors page. Each is bound by terms no less protective than these. We will give you notice before adding or replacing one, and you may object on reasonable data protection grounds.

Our hosting and database are in the EU. Where a subprocessor processes data outside the UK or EEA, the transfer relies on the UK addendum to the standard contractual clauses or an adequacy decision.

We will help you respond to requests from individuals to access, correct, delete or export their data, and with data protection impact assessments, at no extra charge for reasonable requests.

We will notify you without undue delay, and in any case within 48 hours of becoming aware, of any breach affecting your personal data, with the facts known at that point and the steps we are taking.

Capture video and photos are deleted 90 days after the job completes, or sooner on request. Booking and invoice records are kept for six years to meet tax and accounting duties, then deleted. On termination we will delete or return personal data at your choice, except where we must keep it by law.

On reasonable notice, and no more than once a year unless a regulator requires otherwise, we will provide the information you need to demonstrate our compliance with these terms.

Data protection questions go to hello@movd.world.