Data processing agreement

This agreement applies between the organisation that orders Movena Suite (Customer) and Movena GmbH, Fassbindstrasse 10, 4310 Rheinfelden, Switzerland, UID CHE-398.291.006 (Movena).

The Customer is the controller for the personal data that it and its users process in Movena Suite. Movena processes this data as processor (FADP: Auftragsbearbeiterin; GDPR: Auftragsverarbeiter). For its own purposes, such as the customer account, billing and sign-in, Movena itself is the controller. The privacy policy applies to this, not this agreement.

This agreement supplements the terms and conditions and the subscription contract (together the Main Agreement). In the event of contradictions, it takes precedence in matters of data protection.

Movena provides the Customer with Movena Suite as a workspace at the location chosen when ordering. This includes the operation, maintenance and updating of the applications, storage, backup and restore, support and deletion at the end.

This agreement applies for the term of the Main Agreement, that is, in the free trial, until the trial ends. Its obligations continue to apply until Movena has deleted all of the Customer’s data in accordance with clause 14.

Movena processes the data exclusively to operate the Suite for the Customer:

• storing, hosting, backing up and restoring,
• displaying, processing and transmitting in the modules that the Customer uses, for example ERPNext, OpenProject, Frappe Drive, Paperless, HRMS, CRM and Helpdesk, messages, video and telephony,
• AI features under clause 10, insofar as the Customer uses them,
• transmissions that the Customer triggers itself, for example e-mails, letters, payment files or submissions to authorities,
• troubleshooting and support at the Customer’s request,
• deletion.

Movena does not use the content for its own purposes, in particular not for advertising and not for training AI models.

Movena processes the data only on documented instructions from the Customer. Instructions are this agreement, the Main Agreement, the Customer’s settings and actions in the Suite, and instructions in text form, including by e-mail or support request.

If Movena is required by law to carry out processing, it informs the Customer beforehand, unless the law prohibits this. If Movena considers an instruction to be unlawful, it informs the Customer without delay and may suspend its execution until the matter has been clarified.

Movena grants access only to persons who need it for their tasks and obliges them to maintain confidentiality, unless they are already subject to a statutory duty of secrecy. This obligation continues after the end of their activity.

Movena takes the technical and organisational measures set out in Annex 1 to ensure data security appropriate to the risk (Art. 8 FADP, Art. 1 to 4 DPO (DSV), Art. 32 GDPR). Movena may further develop the measures as long as the level of protection does not decrease, and documents significant changes.

The Customer approves the sub-processors listed in Annex 2 (Art. 9 para. 3 FADP, Art. 7 DPO, Art. 28 para. 2 GDPR).

If Movena wishes to add or replace a sub-processor, it informs the Customer at least 30 days in advance by e-mail to the address stored in the customer account. The Customer may object within this period on data protection grounds. If the parties do not find a solution, the Customer may terminate the affected service or the Main Agreement with effect from the date of the change.

Movena imposes on each sub-processor data protection obligations equivalent to those in this agreement and satisfies itself that the sub-processor is able to ensure data security (Art. 9 para. 2 FADP, Art. 28 para. 4 GDPR). Movena is liable to the Customer for their compliance as for its own conduct.

The following are not sub-processors: third parties to which the Customer itself transmits data (for example its bank, authorities or the recipients of its e-mails), and services that the Customer integrates under its own contract (for example its e-mail mailbox). Stripe is not covered either: the payment service only processes billing data for which Movena itself is the controller.

The Customer’s business data, files and backups are located at the chosen location, Switzerland or EU (Germany), and are not copied to the other region. Central services run in Germany for both locations: sign-in with the user accounts, the customer account and the AI gateway.

Movena only discloses data to states without adequate data protection insofar as Annex 2 provides for this and a safeguard under Art. 16 FADP or Chapter V GDPR is in place, or on the Customer’s instructions.

The Suite offers AI features via the Movena AI Gateway. The following applies to the Customer’s data:

• The gateway classifies each request according to its data source. Classes 0 and 1 (public, internal) may go to cloud models. Class 2 (for example CRM, contracts, accounting, documents, communication) only goes to cloud models for expressly approved features and reduced to what is necessary. Class 3 (personnel, payroll, bank, health, credentials) and detected credentials never go to cloud models.
• Cloud requests only run via providers listed in Annex 2, with Zero Data Retention and without use for training. If no provider meets these conditions, the request does not go to the cloud.
• Models make suggestions. The Suite only saves changes in the business applications after confirmation by an authorised user; the gateway checks the workspace and permissions again at that point.
• Conversations are stored per user and workspace, can be deleted, are no longer retrievable after 30 days without activity and are deleted afterwards. Logs contain metadata, not the content of the requests.

Before Movena uses further cloud providers for the Customer’s data or approves class 2 for further features, it informs the Customer in accordance with clause 8.

Movena assists the Customer by appropriate means in responding to requests from data subjects, in particular requests for access, handover of data, rectification, erasure, restriction and objection. The business applications provide export and deletion functions for this purpose. If a data subject addresses their request to Movena, Movena forwards it to the Customer without delay and only responds to it on the Customer’s instructions.

Movena assists the Customer with the information available to it in data protection impact assessments (Art. 22 FADP, Art. 35 GDPR), in consultations with the supervisory authority (Art. 23 FADP, Art. 36 GDPR) and in notifications under clause 13.

Movena notifies the Customer of any data security breach affecting its data without delay, and no later than 48 hours after becoming aware of it (Art. 24 para. 3 FADP, Art. 33 para. 2 GDPR).

The notification contains, as far as known: the nature of the breach, the categories of data concerned and the approximate number of persons and records concerned, the possible consequences, the measures taken and proposed, and a point of contact (Art. 15 DPO, Art. 33 para. 3 GDPR). Movena provides any missing information as soon as it becomes available.

The Customer decides whether a notification to the FDPIC (EDÖB), to a supervisory authority in the EU or to data subjects is required. Movena assists the Customer with this.

On request, Movena provides the Customer with the information necessary to demonstrate compliance with this agreement. If written information is not sufficient, the Customer, or an auditor appointed by the Customer and bound by confidentiality, may audit compliance after giving reasonable advance notice. Audits must not impair operations or the confidentiality of other customers. For the data centres, the audit relies on the evidence provided by the hosting providers.

Liability is governed by the Main Agreement. Mandatory statutory liability rules, in particular Art. 82 GDPR, are reserved.

Amendments to this agreement require text form. Movena may amend it with advance notice if the law or the services require this; the level of protection must not decrease as a result. If a provision is invalid, the remainder remains valid.

Swiss law applies, excluding its conflict-of-laws rules. The place of jurisdiction is Rheinfelden AG. Mandatory places of jurisdiction and mandatory provisions of the GDPR are reserved.