DATA PROCESSING AGREEMENT

Between:

(1) The Customer identified in the signature block below or in the applicable account registration flow, being the business that has registered for and uses the Movement Software to build and operate its own branded apps (the “Customer”, acting as controller); and

(2) Movement Platform Pty Ltd (ACN 670 621 897) trading as Movement, ABN 85 670 621 897, a company registered in Australia, of 2/49 Begonia Road, Gardenvale, Victoria 3185, Australia (“Movement”, acting as processor). Movement’s privacy contact is Steven Scott, hello@movement.so.

Each is a “party” and together they are the “parties”.

Background

A. Movement provides the Customer with access to the Services under the Agreement.

B. To provide the Services, Movement processes Customer Personal Data on the Customer’s behalf as described in Annex I.

C. This DPA sets out the terms required by Article 28(3) of the GDPR (and equivalent UK and Swiss provisions) for that processing. It also establishes the transfer mechanisms governing transfers of Customer Personal Data out of the EEA, the UK, and Switzerland.

1. DEFINITIONS AND INTERPRETATION

   1.1 — In this DPA, the following expressions have the following meanings:

   (a) “Agreement” means the Terms, the Customer’s selected Subscription Plan, and/or an Enterprise Agreement (as applicable).

   (b) “Customer Personal Data” means any personal data that Movement processes on behalf of the Customer in providing the Services, as described in Annex I. It includes personal data contained within “Customer Data” as defined in the Agreement.

   (c) “Data Protection Laws” means, to the extent each applies to the processing: (a) Regulation (EU) 2016/679 (“GDPR”); (b) the GDPR as it forms part of UK law under the European Union (Withdrawal) Act 2018, together with the UK Data Protection Act 2018 (“UK GDPR”); (c) the Swiss Federal Act on Data Protection of 25 September 2020 (“FADP”); (d) the Australian Privacy Act 1988 (Cth); and (e) any other data protection or privacy law applicable to the processing of Customer Personal Data under the Agreement.

   (d) “DPA” means this Data Processing Agreement.

   (e) “EEA” means the European Economic Area.

   (f) “Enterprise Agreement” means any separate master services agreement, enterprise SaaS agreement, or bespoke commercial contract executed in writing between Movement and the Customer governing access to the Services.

   (g) “European Data Protection Laws” means, to the extent applicable to the processing: (a) Regulation (EU) 2016/679 (“GDPR”); (b) the UK GDPR and the UK Data Protection Act 2018; (c) the Swiss Federal Act on Data Protection (“FADP”); and (d) any applicable national implementing legislation in force in the EEA, the UK, or Switzerland.

   (h) “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise processed by Movement or its Sub-processors.

   (i) “Restricted Transfer” means a transfer of Customer Personal Data (including onward transfers and remote access) from the EEA, the UK, or Switzerland to a country that does not have an adequacy decision or adequacy regulation for the relevant regime.

   (j) “SCCs” means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

   (k) “Services” means the provision, hosting, maintenance, and support of the Software, together with related infrastructure, payments facilitation, API integrations, data backup, and technical assistance provided by Movement to the Customer under the Agreement.

   (l) “Software” has the meaning given in the Agreement (being Movement’s proprietary no-code platform and mobile/web application building software).

   (m) “Sub-processor” means any third party engaged by Movement to process Customer Personal Data.

   (n) “Subscription Plan” means the specific subscription tier, pricing structure, usage limits, and feature entitlements selected by the Customer during account registration or within the Software dashboard.

   (o) “Terms” means the Movement Platform Terms & Conditions published at https://movement.so/legal/terms-and-conditions, as updated from time to time in accordance with their terms.

   (p) “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0), issued by the UK Information Commissioner under s119A of the UK Data Protection Act 2018 and in force from 21 March 2022, as amended or replaced from time to time.

   (q) The terms “controller”, “processor”, “data subject”, “personal data”, “processing”, “special categories of personal data”, and “supervisory authority” have the meanings given in the GDPR.

   1.2 — Capitalised terms used but not defined in this DPA have the meanings given in the Agreement.

   
   

2. SCOPE, ROLES AND ORDER OF PRECEDENCE

   2.1 — Scope and Effective Date. This DPA applies whenever Movement processes Customer Personal Data that is subject to Data Protection Laws. It forms an integral part of the Agreement and comes into force on the earliest of:

   (a) the date the Customer accepts or is deemed to accept the Agreement (including by registering an account on the Software, selecting a Subscription Plan, or accepting the Terms in accordance with clause 1.2 of the Terms);

   (b) the date the Customer accesses or uses the Software to process Customer Personal Data; or

   (c) where the parties execute this DPA as a standalone document, the date of execution by the last party to sign the signature block below.

   (the “Effective Date”).

   2.2 — Jurisdictional Ringfencing: The provisions of this DPA apply generally to all Customers, provided that the specific statutory rights, notification timeframes, and transfer mechanisms set forth in clauses 7.3–7.4 (Sub-processor Notice and Objection), 8.1 (Data Subject Rights Assistance), 10.1 (Breach Notification Window), 12 (International Transfers), and 13 (Audits) shall apply solely to the extent that the Customer Personal Data is subject to European Data Protection Laws.

   2.3 — Roles: For Customer Personal Data, the Customer acts as the controller (or as a processor acting on behalf of a third-party controller), and Movement acts as the processor (or sub-processor). Movement’s authorised Sub-processors are set out in Annex III.

   2.4 — Movement’s Own Data: This DPA does not cover personal data that Movement collects and processes as an independent controller for its own business purposes, including administrative account details, billing records, direct support communications, and marketing data relating to the Customer’s account administrators. Movement’s Privacy Policy governs that data.

   2.5 — Order of Precedence

   (a) In the event of any conflict, ambiguity, or inconsistency between this DPA and the Terms, Movement’s Privacy Policy, an Enterprise Agreement, or any other commercial agreement between the parties, the provisions of this DPA shall govern and prevail in respect of the collection, use, licensing, retention, and processing of Customer Personal Data.

   (b) To the extent that any Standard Contractual Clauses (including the EU SCCs or the UK Addendum) apply under clause 12, those Standard Contractual Clauses shall govern and prevail over this DPA, the Terms, the Privacy Policy, and any Enterprise Agreement.

   (c) For the avoidance of doubt, the precedence established in this clause 2.5 shall apply notwithstanding anything to the contrary in clause 14.1 of this DPA, clause 11.4(a) of the Terms (exclusions for data loss), or clause 20.10 of the Terms (entire agreement) (and the equivalent provisions in an Enterprise Agreement).

   (d) In respect of Customer Personal Data, this DPA expressly overrides clauses 8.4 and 9 of the Terms (and any equivalent intellectual property licence or AI model-training provisions in an Enterprise Agreement) to the extent set out in clause 3.4.

   
   

3. PROCESSING ON DOCUMENTED INSTRUCTIONS

   3.1 — Movement will process Customer Personal Data solely on the Customer’s documented instructions, including with respect to transfers to a third country, unless required to do so by applicable EU, Member State, or other law to which Movement is subject. In such a case, Movement will inform the Customer of that legal requirement before processing, unless that law prohibits such notification on important grounds of public interest.

   3.2 — The Customer instructs Movement to process Customer Personal Data to:

   (a) provide, host, secure, support, and maintain the Services under the Agreement;

   (b) perform processing initiated by the Customer or its authorised users through the Software (including configuring features, sending notifications, delivering communications, enabling integrations, and executing AI features); and

   (c) comply with other reasonable written instructions provided by the Customer that are consistent with the Agreement.

   The Agreement, this DPA, and the Customer’s operational configuration of the Services constitute the Customer’s complete documented instructions at the Effective Date.

   3.3 — Movement will immediately notify the Customer if, in its opinion, an instruction infringes Data Protection Laws. Movement may suspend execution of the relevant instruction until the Customer confirms or amends it in writing.

   3.4 — Customer Data Protection and Artificial Intelligence

   (a) Movement will not sell, rent, release, disclose, or commercially exploit Customer Personal Data.

   (b) Movement will not use Customer Personal Data to train, retrain, fine-tune, or improve any machine learning, large language, or artificial intelligence models (including the ‘AI Model’ referenced in clause 9 of the Terms), except upon the express, documented instructions of the Customer. The licence granted to Movement in clause 8.4 of the Terms and the rights asserted in clause 9 of the Terms (or any equivalent customer data licence or model-training rights in an Enterprise Agreement) do not extend to Customer Personal Data.

   (c) The restrictions in clause 3.4(b) shall not prevent Movement from:

   (i) routing Customer Personal Data to authorised AI Sub-processors strictly to deliver the optional in-app AI features instructed and configured by the Customer pursuant to clause 4.3; or

   (j) creating, extracting, and utilising anonymised data (being data that does not relate to an identified or identifiable natural person and from which re-identification is permanently impossible under Data Protection Laws), including abstract page styling, layout configurations, workflow design patterns, de-identified prompt structures, and aggregated operational telemetry, to operate, support, and enhance the Services.

   
   

4. CUSTOMER OBLIGATIONS

   4.1 — Lawful Basis and Transparency: The Customer is solely responsible for the lawfulness of its processing and its instructions. In particular, the Customer warrants and represents that it:

   (a) maintains a valid lawful basis under Article 6 of the GDPR for all Customer Personal Data submitted to the Services;

   (b) provides data subjects with all required transparency notices under Articles 13 and 14 of the GDPR, including disclosures regarding Movement and its Sub-processors;

   (c) secures all necessary consents required for cookies, tracking identifiers, and local storage technologies implemented in its branded apps; and

   (d) independently evaluates and authorises optional platform features and third-party integrations.

   4.2 — Special Categories of Personal Data:

   (a) The Software is a general-purpose application builder and does not require or mandate the collection of special categories of personal data. Movement strongly advises that Customers avoid collecting health data or other special categories of personal data (including injury histories, medical conditions, biometric body measurements, or physical progress photos) in forms, member properties, or custom fields.

   (b) If the Customer elects to collect or process special category data through the Software:

   (i) the Customer is solely responsible for maintaining, and warrants that it has secured, an applicable lawful condition under Article 9(2) of the GDPR (typically explicit consent). The Customer is also responsible for conducting any required Data Protection Impact Assessment (DPIA) and implementing data minimisation;

   (j) Movement will process such data solely on the Customer’s instructions in accordance with this DPA, applying the uniform technical and organisational measures set out in Annex II. Movement does not provide specialised medical-grade or clinical data controls; and

   (k) the Customer acknowledges that enabling the optional AI agent described in clause 4.3 will cause form answers and member properties to be included in context payloads transmitted to AI Sub-processors. The Customer assumes sole responsibility for authorising such transmissions and agrees to defend, indemnify, and hold harmless Movement against any third-party claims, liabilities, or regulatory fines arising from the inclusion of special category data in AI context payloads, except to the extent caused by Movement’s breach of this DPA, gross negligence, or wilful misconduct.

   4.3 — Optional In-App AI Agent: The in-app AI agent is an optional feature activated solely upon the Customer’s configuration. When enabled, the Customer instructs Movement to transmit the following payloads to the authorised AI Sub-processors listed in Annex III to generate automated responses:

   (a) the member’s conversation thread with the agent (up to the last 50 messages, decrypted, including attachments); and

   (b) operational member context, comprising: the member’s name; program, course, or challenge enrolments and completion progress; segment memberships; custom member properties; and up to 30 activity events from the preceding 14 days (including form submissions).

   Requests are routed via Movement’s AI service (hosted on Cloudflare) through Cloudflare AI Gateway or OpenRouter to Anthropic, OpenAI, or Google model endpoints, as selected in the Customer’s configuration. Movement warrants that it engages such model providers under commercial terms prohibiting the use of customer prompt payloads to train public or foundation models. The Customer is responsible for disclosing the AI agent in its privacy notices and may deactivate the feature at any time.

   4.4 — Processing Children’s Data: If the Customer’s branded application is directed to or used by individuals under 16 years of age, the Customer is solely responsible for:

   (a) obtaining and verifying parental or guardian consent where required by Article 8 of the GDPR (or national lower thresholds between ages 13 and 16) and applicable domestic child privacy laws;

   (b) delivering age-appropriate privacy disclosures; and

   (c) enforcing strict data minimisation.

   Movement processes children’s personal data solely on the Customer’s documented instructions, applying the uniform security safeguards set out in Annex II.

   
   

5. CONFIDENTIALITY OF PERSONNEL

   5.1 — Movement will ensure that all personnel authorised to process Customer Personal Data (including employees, contractors, and agents) are bound by appropriate contractual or statutory confidentiality commitments.

   5.2 — Movement will limit access to Customer Personal Data to personnel who require such access to deliver, support, maintain, or secure the Services. Movement will maintain role-based access controls ensuring administrative access to production infrastructure and customer environments is restricted to a strict need-to-know basis, logged, and audited.

   
   

6. SECURITY OF PROCESSING (ARTICLE 32 GDPR)

   6.1 — Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Movement will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures include the specific safeguards set forth in Annex II.

   6.2 — Movement may update or modify the technical and organisational measures in Annex II from time to time, provided that such modifications do not materially reduce the overall security of the Services.

   
   

7. SUB-PROCESSORS

   7.1 — General Written Authorisation: The Customer grants Movement general written authorisation to engage Sub-processors. The Sub-processors approved at the Effective Date are listed in Annex III.

   7.2 — Published List: Movement will maintain an up-to-date register of Sub-processors at https://movement.so/legal/subprocessors and within its technical documentation, and will make the list available to the Customer upon request.

   7.3 — Notice of Intended Changes: Movement will provide at least 14 days’ prior written notice of any intended appointment of a new or replacement Sub-processor by updating the published list at https://movement.so/legal/subprocessors and dispatching an electronic notification to the Customer’s primary administrative email address (or via an automated email notification mechanism on the sub-processor directory page). Each notice will identify the Sub-processor, the nature of its processing, and its geographical location. The parties agree that this mechanism satisfies Movement’s notification obligations under Article 28(2) of the GDPR and Clause 9(a) of the SCCs.

   7.4 — Right to Object and Exclusive Remedy: The Customer may object to a proposed new or replacement Sub-processor solely on reasonable, documented grounds relating to Data Protection Laws by submitting written notice to hello@movement.so within the 14-day notice period. If no objection is received within that period, the Sub-processor is deemed accepted. If Movement is unable or declines to accommodate a timely objection within 14 days of receipt, the Customer may terminate the Agreement with immediate effect upon written notice (the standard notice period in clause 15.3 of the Terms and any minimum enterprise commitment under an Enterprise Agreement shall not apply), and Movement will issue a pro-rata refund of any prepaid, unearned Fees covering the post-termination period. Such termination and refund shall constitute the Customer’s sole and exclusive remedy in respect of the Sub-processor appointment.

   7.5 — Sub-processor Agreements and Liability: Movement will enter into a written agreement with each Sub-processor imposing data protection obligations that are substantially similar to, and no less protective than, those set out in this DPA. Movement remains liable to the Customer for the performance of each Sub-processor’s obligations to the extent required by Article 28(4) of the GDPR.

   7.6 — Emergency Replacement: Where Movement must urgently replace or appoint a Sub-processor to maintain platform security or service continuity, Movement will provide notice as soon as reasonably practicable (which may occur concurrently with or promptly following the replacement). The replacement Sub-processor may commence processing immediately. Clause 7.4 applies from the date of notice, and if the Customer objects within 14 days, it may terminate the Agreement with immediate effect under clause 7.4.

   
   

8. DATA SUBJECT RIGHTS

   8.1 — Assistance with Requests: Taking into account the nature of the processing, Movement will assist the Customer through appropriate technical and organisational measures, insofar as possible, to fulfil the Customer’s statutory obligations to respond to data subjects exercising their rights under Chapter III of the GDPR (including rights of access, rectification, erasure, restriction, portability, and objection).

   8.2 — Self-Service Management and Erasure Workflows: The Software provides self-service administrative tools enabling the Customer to view, update, and remove member records directly. App members may also request account erasure directly within their app profile via the “Request Data Deletion” feature. The Customer instructs Movement to action deletion requests submitted through this automated mechanism. Movement will permanently expunge or irreversibly anonymise the relevant Customer Personal Data from its production systems and direct its Sub-processors to do so within 30 days of receiving a verified deletion request. Database backup copies are overwritten in accordance with the seven-day snapshot cycle described in clause 11.3.

   8.3 — Direct Requests Received by Movement: If Movement receives a request directly from a data subject regarding Customer Personal Data, Movement will promptly forward the communication to the Customer without undue delay, provided the Customer can be identified from the request. Movement will not respond directly to the data subject, other than to confirm receipt and refer them to the Customer, unless expressly instructed in writing by the Customer or required by applicable law.

   
   

9. ASSISTANCE WITH SECURITY, DPIAS AND CONSULTATIONS

   9.1 — Taking into account the nature of the processing and the information available to Movement, Movement will provide reasonable assistance to the Customer in meeting its statutory obligations under Articles 32 to 36 of the GDPR (security, breach notifications, data protection impact assessments, and prior consultations with supervisory authorities). Movement provides this assistance primarily through this DPA, Annex II, Annex III, and its compliance documentation. Where requested assistance requires technical or operational effort exceeding standard platform documentation, Movement may charge reasonable, documented administrative costs upon prior agreement with the Customer.

   
   

10. PERSONAL DATA BREACH NOTIFICATION

    10.1 — Notification Window: Movement will notify the Customer of a Personal Data Breach without undue delay, and in any event within 48 hours of becoming aware of the breach, where the affected Customer Personal Data is subject to European Data Protection Laws.

    10.2 — Content of Notification: The breach notice will be sent to the Customer’s primary administrative email address and will include, to the extent then known:

    (a) a description of the nature of the breach, including the categories and estimated number of data subjects and records concerned;

    (b) the name and contact details of Movement’s privacy contact point (Steven Scott, hello@movement.so);

    (c) the likely consequences of the breach; and

    (d) the containment, mitigation, and remediation measures implemented or proposed.

    10.3 — Phased Reporting: Where all required information cannot be provided concurrently, Movement will deliver information in phases without further undue delay as investigations proceed.

    10.4 — Remediation and Regulatory Filings: Movement will take prompt, reasonable steps to contain, investigate, and remediate the Personal Data Breach. Movement will cooperate with the Customer to enable the Customer to discharge its notification obligations under Articles 33 and 34 of the GDPR. Movement will not issue public statements or notify supervisory authorities on the Customer’s behalf regarding a breach affecting Customer Personal Data unless expressly instructed by the Customer or required by applicable law.

    10.5 — No Admission of Fault: Notification of a Personal Data Breach under this clause 10 shall not be construed as an admission of fault or liability by Movement.

    
    

11. DELETION OR RETURN OF DATA

    11.1 — Deletion on Request: Upon receipt of a verified written request from the Customer, Movement will permanently delete or irreversibly anonymise all Customer Personal Data from its production systems and instruct its Sub-processors to do so within 30 days of verification. Logical deactivation flags (soft-deletes) shall not satisfy Movement’s obligations under this clause unless all personal data within the relevant production records (including direct and indirect identifiers, uploaded media, and profile data) is permanently overwritten, expunged, or irreversibly anonymised within such 30-day period. Movement may retain Customer Personal Data solely to the extent required by applicable law, or within restricted-access system audit logs retained strictly for security, fraud prevention, and regulatory compliance, which shall remain securely isolated and overwritten in accordance with standard retention cycles. Upon deletion under this clause or termination of the Agreement, any licence granted to Movement under clause 8.4 of the Terms (or equivalent data licence provisions in an Enterprise Agreement) shall, in respect of Customer Personal Data, terminate immediately, subject only to routine backup overwriting under clause 11.3.

    11.2 — End of Service and Free Tier Distinction: For the purposes of Article 28(3)(g) of the GDPR, the provision of processing services concludes when the Customer requests the full deletion of its apps and account. Movement will expunge all Customer Personal Data within 30 days of verification, unless applicable law requires retention. If a paid subscription lapses or is cancelled, the account transitions to Movement’s free tier (pursuant to clause 16.1 of the Terms or the applicable provisions in an Enterprise Agreement). Transition to the free tier does not constitute a deletion request or termination of processing; Movement continues to process data under this DPA until the Customer formally requests deletion or the account is expunged under the dormant account policy in clause 15.6 of the Terms (or the applicable provisions in an Enterprise Agreement). Prior to requesting account deletion, the Customer may ask Movement for a copy of its Customer Personal Data in a commonly used machine-readable format.

    11.3 — Database Backups and Object Storage Lifecycle: Movement’s production database is hosted on DigitalOcean Managed Databases, which execute daily automated cluster backups and maintain write-ahead logs enabling point-in-time restore within a rolling seven-day window. Backup data is encrypted at rest and in transit. Data deleted from production remains within these backup snapshots until it ages out and is automatically overwritten across the seven-day cycle. Backups are not subject to active processing and are accessed solely for emergency disaster recovery. Any database restored from a backup snapshot will have prior deletion requests reapplied. Unstructured files stored in object storage (AWS S3 and cached assets in Cloudflare R2) are outside database snapshots; these assets are purged within 30 days of a verified request and are not subject to secondary long-term versioning.

    11.4 — Sub-processor Deletion Certification: Movement will flow down deletion instructions to its Sub-processors within the 30-day timeline and will provide written confirmation of deletion upon written request from the Customer.

    11.5 — Scope of Deletion: Deletion under this clause 11 and clause 8.2 applies to Customer Personal Data processed on behalf of the Customer. It does not extend to personal data that Movement processes on behalf of its other customers, even where that data relates to the same individual.

    
    

12. INTERNATIONAL TRANSFERS

    12.1 — Transfer Context: Movement is established in Australia, a jurisdiction that has not received an adequacy decision from the European Commission. Movement’s production databases and core application servers are hosted by DigitalOcean in Singapore. Uploaded media files are stored with AWS in Sydney (Australia), published web applications are served via AWS (Singapore) and Cloudflare’s global edge network, and certain Sub-processors operate in the United States. Accordingly, transfers of Customer Personal Data from the EEA, the UK, or Switzerland to Movement constitute Restricted Transfers governed by the statutory transfer mechanisms in this clause 12.

    12.2 — Incorporation of the EU Standard Contractual Clauses (SCCs): For Restricted Transfers from the EEA, the parties agree that Module Two (Controller-to-Processor) or Module Three (Processor-to-Processor, where the Customer acts on behalf of a third-party controller) of the EU SCCs are incorporated into this DPA by reference, populated as follows:

    (a) the Customer acts as the data exporter and Movement acts as the data importer;

    (b) SCC Clause 7 (Docking Clause) applies;

    (c) SCC Clause 9(a) (Use of Sub-processors): Option 2 (General written authorisation) applies, with a notice period of 14 days in accordance with clause 7 of this DPA;

    (d) SCC Clause 11(a) (Redress): The optional independent dispute resolution mechanism is omitted;

    (e) SCC Clause 13 (Supervision): The competent supervisory authority is determined pursuant to Clause 13(a) and Annex I.C of this DPA;

    (f) SCC Clause 17 (Governing Law): Option 1 applies; the SCCs are governed by the laws of Ireland;

    (g) SCC Clause 18(b) (Forum): Disputes arising under the SCCs shall be resolved by the courts of Ireland; and

    (h) Annexes I, II, and III of the SCCs are completed by Annexes I, II, and III of this DPA.

    12.3 — Onward Transfers by Movement: Where Movement executes an onward transfer of Customer Personal Data to a Sub-processor in a third country, Movement will ensure the transfer is safeguarded by a valid statutory transfer mechanism, comprising: (a) an applicable European Commission adequacy decision; (b) certification under the EU–U.S. Data Privacy Framework (including the UK Extension and Swiss–U.S. DPF); or (c) Module Three (Processor-to-Processor) Standard Contractual Clauses entered into with the Sub-processor, supplemented by any necessary technical safeguards.

    12.4 — UK Transfers (UK Addendum): For Restricted Transfers from the United Kingdom, the UK Addendum is incorporated by reference:

    (a) Table 1 is completed using the parties’ details in Annex I;

    (b) Table 2 incorporates the SCC modules and selections in clause 12.2;

    (c) Table 3 incorporates Annexes I, II, and III of this DPA;

    (d) Table 4: Either party may terminate the UK Addendum pursuant to Section 19 thereof; and

    (e) References in the SCCs to the GDPR shall be read as references to the UK GDPR.

    12.5 — Swiss Transfers: For Restricted Transfers from Switzerland, the SCCs apply with the following adjustments:

    (a) references to the GDPR are construed as references to the Swiss FADP;

    (b) the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner;

    (c) “Member State” in SCC Clause 18(c) includes Switzerland, enabling Swiss data subjects to bring claims in Switzerland; and

    (d) the governing law under SCC Clause 17 is Irish law, or Swiss law where required by the FADP.

    12.6 — Transfer Impact Assessment Assistance: Movement will provide reasonable information to assist the Customer in assessing the data protection laws and government surveillance practices of destination jurisdictions (including Australia, Singapore, and the United States) and evaluating supplementary safeguards.

    12.7 — Government Access Requests: If Movement receives a legally binding request from a law enforcement or public authority seeking disclosure of Customer Personal Data, Movement will handle the request in accordance with Clause 15 of the SCCs, whether or not the SCCs are formally triggered.

    12.8 — Regulatory Representation (Article 27 GDPR / UK GDPR): To the extent required by Article 27 of the GDPR or Article 27 of the UK GDPR, Movement’s designated privacy contact point is identified in Annex I.A. Where Movement relies on the statutory exemption under Article 27(2) of the GDPR or UK GDPR, the parties agree that all regulatory communications regarding processing under this DPA shall be directed to Movement’s primary privacy contact at hello@movement.so.

    
    

13. AUDIT AND INFORMATION RIGHTS

    13.1 — Compliance Demonstration: Movement will make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and this DPA. This obligation is satisfied by completing reasonable security questionnaires, at most once per 12-month period, unless a confirmed Personal Data Breach has occurred or an audit is instructed by a competent supervisory authority.

    13.2 — On-Site Audits and Inspections: If the documentation provided under clause 13.1 is insufficient to demonstrate compliance, Movement will permit the Customer (or an independent auditor mandated by the Customer, who must be bound by strict confidentiality and not be a commercial competitor of Movement) to conduct an audit or inspection. Audits must be scheduled on at least 30 days’ prior written notice, conducted during normal business hours, and executed so as to prevent disruption to Movement’s operational infrastructure. The Customer bears its own audit costs. Movement may charge reasonable, documented administrative costs for staff time dedicated to on-site inspections upon prior agreement. Audits of third-party cloud Sub-processors are satisfied by reviewing their current SOC 2, ISO 27001, or equivalent third-party audit reports.

    13.3 — Preservation of Supervisory Authority Rights: Nothing in this clause 13 restricts the statutory audit or inspection powers of the Customer or a competent supervisory authority under SCC Clause 8.9.

    
    

14. LIABILITY

    14.1 — Liability Cap Alignment: Each party’s liability arising out of or in connection with this DPA or Data Protection Laws is subject to the exclusions and limitations of liability set out in the Agreement, except that the aggregate liability of each party under this DPA shall be limited to:

    (a) for paying Customers, the total Fees paid or payable by the Customer in the six (6) months immediately preceding the event giving rise to the claim; or

    (b) for Customers on a free Subscription Plan, an aggregate maximum amount of AUD $100.

    14.2 — Carve-Out from Data Loss Exclusion: Notwithstanding clause 11.4(a) of the Terms (or equivalent terms in an Enterprise Agreement), the general contractual exclusion of liability for loss, corruption, or alteration of data shall not apply to claims arising from a Personal Data Breach or Movement’s material breach of this DPA.

    14.3 — Statutory and Uncapped Liabilities: Nothing in this DPA or the Agreement limits or excludes either party’s liability:

    (a) to data subjects under Article 82 of the GDPR or SCC Clause 12;

    (b) for administrative fines levied by a supervisory authority; or

    (c) in respect of any liability that cannot be lawfully limited under applicable law.

    14.4 — Reciprocal Fault-Based Indemnity Carve-Out: The indemnity in clause 12.1(d) of the Terms (or equivalent indemnity provisions in an Enterprise Agreement) shall not apply to the extent that any claim, liability, loss, damage, or fine was caused by Movement’s breach of this DPA, gross negligence, or wilful misconduct.

    
    

15. TERM, GOVERNING LAW AND GENERAL PROVISIONS

    15.1 — Term and Survival: This DPA remains in full force and effect for as long as Movement processes Customer Personal Data. Clauses 10 (Breach Notification), 11 (Deletion), 13 (Audits), and 14 (Liability) survive termination of the Agreement for as long as necessary to give them operational effect.

    15.2 — Governing Law and Jurisdiction: This DPA is governed by the laws of Victoria, Australia, consistent with clause 20.8 of the Terms (or equivalent provisions in an Enterprise Agreement), and the parties submit to the non-exclusive jurisdiction of the courts of Victoria. However:

    (a) the SCCs, where triggered, are governed by the law and jurisdiction selected in clause 12.2; and

    (b) neither party’s statutory obligations under Data Protection Laws are affected by this governing law clause.

    15.3 — Regulatory and Legislative Amendments: If Data Protection Laws change or a transfer mechanism is invalidated, the parties will negotiate in good faith any necessary amendments to maintain legal compliance. If the European Commission issues updated Standard Contractual Clauses, Movement will propose and the parties will adopt the replacement clauses with equivalent module selections.

    15.4 — Formal Amendments: This DPA may be amended only by a written instrument signed by authorised representatives of both parties, except that Annex III is updated via the notice mechanism in clause 7. Movement cannot unilaterally amend this DPA via website updates.

    15.5 — Severability: If any provision of this DPA is held invalid or unenforceable, the remaining provisions will continue in full force and effect.

    15.6 — Electronic Execution and Counterparts: This DPA may be executed electronically and in counterparts, each of which shall be deemed an original.

    
    

This DPA forms part of, and is incorporated into, Movement’s Terms and Conditions. It applies automatically when the Customer accepts the Terms, and no signature is required. If you need a countersigned copy, contact us at hello@movement.so and we’ll provide one.

SIGNATURES