DRAFT – to be reviewed by a solicitor before use. Not legal advice. This is a UK GDPR Article 28 data processing agreement between WinTheMove (processor) and each customer firm (controller). It forms part of the Terms of Service and is accepted at signup. [Square brackets] are placeholders. Prepared 13 October 2026.
WinTheMove Data Processing Agreement (DPA)
Parties: (1) the business that has accepted the WinTheMove Terms of Service (the "Controller", "you"); and (2) Laszlo Dubois and Mohamed Mehdi Cherifi, trading in partnership as WinTheMove, 212 N V Buildings, 100 The Quays, Salford, M50 3BE ("WinTheMove", the "Processor").
Effective: when you accept the Terms. It continues for as long as WinTheMove processes Customer Personal Data for you.
1. Definitions
"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, each as amended (including by the Data (Use and Access) Act 2025). "Customer Personal Data" means the personal data described in Schedule 1 that WinTheMove processes for you. "Controller", "processor", "data subject", "personal data breach", "processing" and "restricted transfer" have the meanings given in Data Protection Law. "Sub-processor" means a third party WinTheMove engages to process Customer Personal Data.
2. Roles and scope
2.1 You are the controller and WinTheMove is your processor for Customer Personal Data. WinTheMove is a separate controller for your account and billing data (see the Privacy Policy). 2.2 Schedule 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects (UK GDPR Art 28(3)).
3. Your instructions and obligations
3.1 WinTheMove will process Customer Personal Data only on your documented instructions, including for transfers outside the UK, unless UK law requires otherwise. If so, WinTheMove will tell you first unless the law forbids it. Your instructions are: these Terms and this DPA, and your use and configuration of the Service (adding quotes, setting schedules and templates, marking statuses, deleting data). 3.2 WinTheMove will tell you promptly if it believes an instruction breaks Data Protection Law. 3.3 You are responsible for: having a lawful basis for the processing; giving data subjects the information required by UK GDPR Arts 13–14 (including that you use WinTheMove); complying with PECR for the follow-up messages (including consent or the "soft opt-in", and offering an opt-out when you collect details); the accuracy of the data you enter; and complying with the Acceptable Use Policy.
4. WinTheMove's obligations
4.1 Confidentiality: WinTheMove will ensure that anyone it authorises to process Customer Personal Data is bound by confidentiality. 4.2 Security: WinTheMove will implement the technical and organisational measures in Schedule 3, which are appropriate to the risk (UK GDPR Art 32). 4.3 Data subject rights: taking into account the nature of the processing, WinTheMove will help you respond to requests from data subjects, including through Service features (editing, exporting and deleting quotes, and opt-out/suppression). If WinTheMove receives a request directly, it will pass it to you without undue delay and won't respond itself except to acknowledge it and redirect it. The exception is an opt-out or unsubscribe from follow-up emails, which WinTheMove will action straight away on your behalf by suppressing that address for your account. 4.4 Other assistance: WinTheMove will provide reasonable help with your obligations under UK GDPR Arts 32–36 (security, breach notification, DPIAs and prior consultation), taking into account the information available to it. 4.5 Breaches: WinTheMove will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event within 48 hours where feasible. It will provide the information reasonably available to help you meet your Art 33–34 duties (nature of the breach, categories and approximate numbers, likely consequences, measures taken or proposed, and a contact point), in stages if necessary. WinTheMove will take reasonable steps to contain and fix the breach. 4.6 Records: WinTheMove will keep a record of processing activities as a processor (UK GDPR Art 30(2)). 4.7 Audit and information: WinTheMove will make available the information reasonably necessary to demonstrate compliance with Art 28, and will allow and contribute to audits by you or an auditor you appoint. Audits are on at least 30 days' notice, no more than once in any 12 months (unless after a breach or at a regulator's request), during business hours, at your cost, and subject to confidentiality. WinTheMove may first answer with written information, supplier certifications and reports. 4.8 No other use: WinTheMove will not sell Customer Personal Data, use it for its own marketing, or share it with other customers. It may create and use aggregated, anonymised statistics that don't identify any individual or your business, to operate and improve the Service.
5. Sub-processors
5.1 You give general authorisation for WinTheMove to use the Sub-processors listed in Schedule 2. 5.2 WinTheMove will give at least 14 days' notice (by email and/or by updating winthemove.winthemove.workers.dev/subprocessors) before adding or replacing a Sub-processor. You may object on reasonable data protection grounds within that period. If we can't resolve the objection, you may end the Terms and get a refund of any prepaid unused fees. 5.3 WinTheMove will put a written contract in place with each Sub-processor that imposes data protection obligations equivalent to this DPA. It remains liable to you for each Sub-processor's performance (UK GDPR Art 28(4)).
6. International transfers
6.1 You authorise the restricted transfers needed to provide the Service, to the countries listed in Schedule 2. 6.2 WinTheMove will make sure each restricted transfer is covered by: (a) UK adequacy regulations, including, for US organisations certified under the UK Extension to the EU-US Data Privacy Framework, the Data Protection (Adequacy) (United States of America) Regulations 2023; or (b) appropriate safeguards under UK GDPR Art 46, such as the ICO's International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where required.
7. Deletion and return
7.1 Throughout the term, you can delete individual quotes and customers in the Service. You can also ask us to delete all of your firm's data (quotes, customers, follow-up history and templates) by emailing support@winthemove.co.uk; we will do this within 30 days of your request. 7.2 Retention while the account is active: WinTheMove will automatically delete each quote and its associated Customer Personal Data 12 months after the last activity on the quote. Opt-out (suppression) records are kept as the email address, the firm it relates to, the reason and the date, indefinitely, so the opt-out can be honoured. This is the minimum needed and is your documented instruction. 7.3 After cancellation: when you cancel (or the Terms otherwise end), you may export Customer Personal Data for 15 days. WinTheMove will then delete it from live systems 15 days after cancellation, unless UK law requires it to be kept. We do not currently keep routine back-ups beyond the live database, so deleted data is deleted. Suppression records (email address, firm, reason and date) are kept as set out in clause 7.2.
8. Liability
Each party's liability under this DPA is subject to the limits and exclusions in the Terms, except where Data Protection Law doesn't allow them.
9. General
If there's a conflict between this DPA and the Terms about personal data, this DPA prevails. The law of England and Wales applies, and the courts of England and Wales have exclusive jurisdiction.
Schedule 1: Description of the processing
| Item | Details |
|---|---|
| Subject matter | Providing the WinTheMove quote follow-up service |
| Duration | The term of the Terms, plus the deletion periods in clause 7 |
| Nature | Storing, organising, retrieving and displaying data; generating and sending scheduled emails from templates; detecting replies (Resend receives replies sent to our reply address and tells us the sender, recipient and subject, not the message body); applying stop rules and opt-outs; generating WhatsApp/SMS links that the Controller opens on its own device; producing statistics for the Controller's dashboard; deletion |
| Purpose | Helping the Controller follow up removal quotes it has sent to people who asked for them |
| Data subjects | The Controller's prospective customers (people who asked for a removal quote). The Controller's staff users. |
| Personal data | Name; email address; phone number (optional); move date; moving-from and moving-to addresses or areas; quote amount; date the quote was sent; lead source; status (waiting/won/lost); lost reason; reply date; follow-up send history; opt-out status; content of emails sent |
| Special category / criminal data | None intended. The Controller must not enter them |
| Frequency | Continuous |
Schedule 2: Authorised sub-processors (as at 17 October 2026)
| Sub-processor | Service | Location of processing | Transfer safeguard |
|---|---|---|---|
| Supabase Pte. Ltd. | Database hosting, authentication | Data at rest: London, UK (AWS eu-west-2). Support and onward sub-processors may access it from outside the UK | Supabase DPA incl. UK Addendum to EU SCCs |
| Resend (Plus Five Five, Inc.) | Email sending, and receiving replies sent to our reply address (Resend holds the received message) | United States | UK Extension to EU-US DPF (UK-US data bridge); SCCs + UK Addendum in Resend DPA |
| Cloudflare, Inc. | Website hosting and Worker functions (incl. the scheduled follow-up job) | Geographically distributed data centres, which may be outside the UK and EEA | UK Addendum to the EU SCCs; Cloudflare also complies with the Data Privacy Framework (including the UK Extension) |
| Stripe Payments Europe, Limited (Stripe Payments UK Ltd is an additional party in some cases) | Billing for the Controller's subscription. No Customer Personal Data is sent to Stripe | UK / EU / US | Stripe DPA (listed for completeness; Stripe processes account/billing data) |
| Functional Software, Inc. (Sentry) | Error reporting (technical error details and the page address) | Stored in Frankfurt, Germany (EU region); some account and organisation data is stored in the United States | Data Privacy Framework (including the UK Extension); EU SCCs with the UK Addendum as a fallback |
[Solicitor/Laszlo: confirm current entities and certifications before publishing; list Resend's own sub-processors by link.]
Schedule 3: Security measures (summary)
- Encryption in transit (TLS) everywhere. Encryption at rest provided by Supabase/AWS.
- Row-level security in the database, so each firm can only access its own records. Admin (service-role) keys are held only on the server.
- Email verification at signup. Passwords handled by Supabase Auth (hashed). Multi-factor authentication on all WinTheMove admin accounts (Supabase, Cloudflare, Resend, Stripe, GitHub, email).
- Least-privilege access: only the partners (Laszlo Dubois and Mohamed Mehdi Cherifi) can access production data, and only where needed for support or operations.
- Secrets kept in environment variables, never in source control. Keys rotated when staff change or a compromise is suspected.
- Logging of scheduled-job runs, billing webhooks and cancellations. Supplier security incidents are monitored.
- We do not currently keep routine back-ups beyond the live database. A documented breach response plan.
- Data minimisation: only the fields needed for follow-ups. Automatic deletion (clause 7.2: 12 months after last activity; clause 7.3: 15 days after cancellation).
- Rate limits on sending: at most one email per quote every 24 hours, 8am–7pm UK time. Opt-out/suppression.
[DRAFT ENDS]