Version 1 · Last updated: 24 October 2026 · English courtesy translation; the Swedish version prevails.
This agreement is part of the MoveIQ license and user agreement and is accepted when the moving company ("the Customer") accepts the license terms. It is a data processing agreement under Article 28 of the General Data Protection Regulation (GDPR) between the Customer as controller and Mono IQ AB, reg. no. 559589-8338 ("the Provider", MoveIQ) as processor.
The Provider supplies the MoveIQ software. When the Customer and its users enter personal data into the service, the Provider processes it on the Customer's behalf. Annex 1 describes the data, the people and the purposes. The agreement applies for as long as the Provider processes personal data on the Customer's behalf: the term of the license agreement plus the deletion period in clause 10. On personal data matters this agreement prevails over the license agreement.
The Provider may process the personal data only on the Customer's documented instructions. The instructions are this agreement, the license agreement, and the Customer's use of the service's features and settings. If the Provider believes an instruction breaches data protection law, it will inform the Customer without delay. The Provider may process data otherwise only where required by Union or national law, and will then inform the Customer beforehand if permitted. The Provider does not process the Customer's personal data for its own purposes, does not sell it, and does not use it for advertising or to develop services for others.
The Provider ensures that persons with access to the personal data are bound by confidentiality or a statutory duty of confidentiality, and that access is limited to those who need it for their work.
The Provider implements appropriate technical and organisational measures under Article 32 GDPR, taking the risks of the processing into account. The measures in place when the agreement is made are described in Annex 2. The Provider may improve them but will not lower the level of protection.
The Provider processes personal data within the EU/EEA wherever possible. A transfer to a country outside the EU/EEA happens only if the requirements of Chapter V GDPR are met, for example an adequacy decision (such as the EU–US Data Privacy Framework for certified recipients) or the European Commission's standard contractual clauses with supplementary measures. Any such transfers are shown on the sub-processor list.
Taking the nature of the processing into account, the Provider will, through appropriate technical and organisational measures, help the Customer respond to requests from data subjects for access, rectification, erasure, restriction, portability and objection. The service has export, correction, anonymisation and erasure functions the Customer can use itself. The Provider will also assist with Articles 32–36 GDPR (security, breaches, impact assessments and prior consultation) as far as it follows from the Provider's role. If a data subject contacts the Provider directly, the Provider will refer the person to the Customer. Assistance beyond what the service and reasonable support cover may be charged at cost by agreement.
The Provider will notify the Customer without undue delay and, where possible, within 48 hours after becoming aware of a personal data breach affecting the Customer's data. The notice will, as far as the information is available, describe the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken or proposed. The Provider documents breaches and helps the Customer meet its duty to notify the Swedish Authority for Privacy Protection (IMY) within 72 hours and to inform affected people. The Customer decides whether the breach must be reported.
On request the Provider will supply the information needed to show compliance with Article 28. The Customer, or an auditor engaged by the Customer and bound by confidentiality, may audit the Provider's compliance no more than once in any twelve-month period, on at least 30 days' notice, during office hours and without unreasonably disturbing operations. The Customer bears the cost. The Provider may meet the requirement primarily through written answers and documentation.
When the license agreement ends, the Customer may for 30 days request an export of its data in a common format. After that the Provider will delete or anonymise the personal data no later than 90 days after the agreement ends, unless the law requires it to be kept (for example accounting records). Backups are overwritten in the normal cycle and within the same period. During the agreement the retention periods the Customer sets in the service apply (default 36 months after a completed booking).
As controller, the Customer is responsible for having a legal basis for the processing, giving data subjects the information they are entitled to, keeping the data correct, and not entering more or more sensitive data than needed. Personal identity numbers should be entered only when needed for the RUT deduction. Sensitive personal data (for example health data) must not be entered in free-text fields. The Customer is specifically responsible for ensuring that positioning, time reporting and other monitoring of employees is necessary, proportionate and clearly communicated to the employees, and that any duty to negotiate or consult employee organisations is met. The Customer must keep user accounts and credentials secure and close the accounts of people who leave.
The limitation of liability in the license agreement also applies to this agreement, unless mandatory data protection law requires otherwise. The agreement applies from the day the Customer accepts the license agreement and for as long as the Provider processes personal data for the Customer. It is governed by Swedish law, and disputes are decided under the license agreement by the Swedish courts with the Stockholm District Court as the first instance. If the Provider materially changes this agreement, the Customer will be notified in advance as set out in the license agreement.
Questions about this agreement: support@moveiq.se.
| Subject matter and nature | Storing, displaying, changing, transferring and deleting data in the MoveIQ cloud service (bookings, quotes, invoices, time reports, scheduling, vehicles, customer communication, signing). |
|---|---|
| Purpose | Enabling the Customer to plan, carry out and invoice moving jobs and to administer its employees. |
| Data subjects | The Customer's customers (consumers and contact persons at business customers); the Customer's employees, drivers and workers; other people named in bookings. |
| Categories of personal data | Name, email, phone; pickup and delivery addresses; booking details and notes; personal identity number (when the RUT deduction is applied); price, invoice and payment data; working hours, time reports and availability; GPS position data when the add-on is used; photos and damage documentation; drawn signatures and signing evidence; login data (email, password hash, two-factor data), IP address and browser details; chat messages; vehicle data. |
| Sensitive data | The service is not intended for sensitive personal data. Personal identity numbers are treated as especially protected and stored encrypted. |
| Duration | The term of the license agreement and the deletion period in clause 10. |
The current list of sub-processors, their purposes, data categories, data locations and safeguards is at moveiq.se/underbitraden and forms part of this Annex. Data in Microsoft 365 (Exchange Online) is stored in Sweden. Sub-processor changes are notified as set out in clause 5.