Version as of 28 January 2022
The responsible party for the platform and the controller of the personal data you share with the platform is Moveagain. If you have any data protection concerns, you can contact our data protection officer by e-mail or letter post. You can reach him as follows:
- MoveAgain Limited
- 69 High Street, London, N14 6LD
In the following, personal data means all personal data within the meaning of the UK GDPR, i.e. information about an individual from which that person can be identified. A data subject is a person about whom personal data is processed. Processing means any handling of personal data, in particular its collection, storage, retention, use, modification, disclosure and deletion.
If you provide us with personal data of other persons (e.g. family members, work colleagues), you must ensure that these persons are aware of such provision and have taken note of the contents of this data protection declaration.
1. Data that we process on the platform
We process personal data that we receive from you or collect about you in connection with the operation and use of our platform and its applications. The entry of personal or business data on our platform and its applications is voluntary.
When we make our platform available, we process personal data from various sources. On the one hand, there is certain data that we automatically process for technical reasons each time you access the platform for each visitor. On the other hand, there is some personal data that we would only receive and process if you decide to contact us or to use certain functions of the platform.
a. Data that we process automatically when you visit our platform (Usage Data)
As soon as you visit the platform, your device sends technical information to our web servers, which we store in server log files and we collect information using cookies. This happens regardless of whether you subsequently contact us (e.g. via the contact form). In any case, we collect the following usage and web access data (which we call "Usage Data" in the following):
- the date and time of the visit and the duration of use of the platform;
- Your location information (to the extent you allow access in your browser and device);
- the IP address and MAC address of your device;
- the referral URL (the website from which you may have been referred);
- websites and content accessed as well as functions used on the platform;
- further information about your device (device type, browser type and version, settings, installed plug-ins, operating system).
We process the Usage Data exclusively in a pseudonymous manner to enable you to use the platform and to ensure its functionality. At no time do we use the Usage Data to identify your name. In addition, we process the pseudonymous Usage Data to analyse the performance of the Platform, to continuously improve it and to correct errors or to personalise the content of the Platform for you. We also process the Usage Data to ensure IT security and the operation of our systems and to prevent or detect misuse, in particular fraud. These server log files are deleted after a maximum of 7 days. Our legal basis for processing this data is that it is necessary of our legitimate interest to improve the functioning of our platform, to protect our systems and to offer a personalised experience to our customers (Art. 6 (1) lit. f) UK GDPR).
b. Data that you transmit to us yourself (Submitted Form Data)
In addition to the data we process for all visitors to our platform, we also process other data when you use our website forms or otherwise provide us with your personal data. We refer to this data as "Submitted Form Data" e.g.:
- When you fill in and submit the "contact us" contact form on the platform. You can see the details in the contact form. We process this data exclusively for the purpose of processing your request and providing the service to you. We also process your data when you sign up for our newsletter. You can find the required data in the registration form for the e-mail newsletter.
- When you fill in the "damage report" form or "report complaint" forms on our website or otherwise. We process the information you provide in these to resolve complaints raised by you, handle legal complaints and disputes, issue refunds if appropriate, and improve our customer service.
The legal basis in each case is that it is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract ( Art. 6 (1) lit.(b) UK GDPR
2. Data that we process in the provision of our services on the platform
a. Data collected on the platform (Login Details and Usage Data)
In addition, we process other personal data when you use our services on the Platform. These are:
- your login details such as your username and password ("Login Data")
- Usage Data
We process this data to provide you with services via the Platform. We also process this data to detect and correct errors, to improve the platform (for example, through pseudonymous A/B tests to optimize the user interface) or, in individual cases, to prevent use that violates the contract or the law.
The legal basis for the processing of your Login Data and Usage Data within the framework of the platform is, with regard to the provision of the platform and the services mediated via it, Art. 6 (1) (b) UK GDPR (i.e. necessary for the performance of a contract to which you are party), and with regard to the other purposes Art. 6 (1) lit. (f) UK GDPR (i.e. that it is necessary for our legitimate interests of improving our platform and service to you).
Third party data
Furthermore, we process (or our third party supplier processors process) personal data that we receive about you from third parties, in particular information from registers (e.g. commercial register) as detailed more below. The legal basis for this is, depending on the individual case, either Art. 6 (1)(b) UK GDPR or Art. 6 (1) ( ) UK GDPR (i.e. it is necessary for our legitimate interest of verifying that the parties we enter contracts with are of good financial standing).
If we make advance payments (e.g. in the case of an order on account), we obtain creditworthiness information about you in order to protect the legitimate interests of MoveAgain. For this purpose, we transmit the personal data required for a credit assessment to PowerPay a Swiss invoicing processor operated by MF Group AG of Bohl 6 CH-9004 St. Gallen Switzerland https://www.powerpay.ch/en ("PowerPay") or SCHUFA a German private credit bureau operated by Schufa Holding AG of Kormoranweg 5, 65201 Wiesbaden, Germany and https://www.schufa.de/en/ ("SCHUFA"). The information received about the probability of a payment default is used for a weighed decision on the establishment, implementation or termination of the contractual relationship. The legal basis for this is Art. 6 (1) (f) UK GDPR, (i.e. that it is necessary for our legitimate interests of ensuring debts are paid by customers and we are financially secure).
We also process data on your interests and other socio-demographic data for marketing purposes, provided you have given us your consent to do so. The legal basis for this is your consent (Art. 6 (1) lit. (a) UK GDPR).
3. The purposes for which we process your data
We process personal data in general:
- with the consent of the data subject (Art. 6 (1)(a) UK GDPR),
- for the performance of a contract with the data subject as well as for the implementation of corresponding pre-contractual measures (Art. 6 para. 1 lit. b UK GDPR),
- to fulfil a legal obligation to which we are subject (Art. 6 para. 1 lit. c UK GDPR) as well as,
- in order to safeguard the legitimate interests of us or of third parties, unless the interests or fundamental rights and freedoms of the data subject prevail (Art. 6 (1) (f) UK GDPR). Legitimate interests are in particular our business interest in being able to operate our platform and its applications, information security, and the enforcement of our own legal claims.
In addition to the purposes for the data processing listed above (see points 1. and 2.), we process personal data for the following purposes:
- Management of your customer account (Art. 6 para. 1 lit. b GDPR i.e. performance of a contract)
- Conclusion and processing of contracts for services that you order on our platform and its application (Art. 6 para. 1 lit. b GDPR i.e. performance of a contract)
- Ensuring the operation of our platform and its applications (Art. 6 para. 1 lit. f GDPR i.e. necessary for the purpose of this legitimate interest)
- Answering inquiries that you send us via contact and feedback forms on our platform and its applications (Art. 6 para. 1 lit. f GDPR i.e. necessary for the purpose of our legitimate interest of responding to your enquiries)
- Fulfilment of our legal obligations (Art. 6 para. 1 lit. c GDPR i.e. processing is necessary for compliance of a legal obligation to which we are subject)
In addition, we also process personal data, insofar as legally permissible and this appears to us to be appropriate, for the following purposes in which we have a legitimate interest corresponding to the purpose:
- Further development of our platform and its applications as well as our offers and services
- Marketing (e.g. sending newsletters), insofar as you have registered to receive our newsletter and have not objected to the use of your personal data for marketing purposes.
- Assertion of legal claims and defence in connection with legal disputes and official proceedings
4. To whom we transfer your data
Your personal data will only be passed on to third parties where we subcontract the services to our partners, or this is necessary for the provision of the platform.
a. Passing on to technical service providers
We share your information with the hosting providers, software suppliers and IT service providers listed below.
Our platform is hosted on DigitalOcean- The developer cloud which has servers in Frankfurt Germany. All of these data recipients have entered into strict contractual agreements with us to process data exclusively within the scope of our instructions (so-called order processing agreements).
If you have registered to receive our newsletter, we will also pass on your data to the technical provider for sending the newsletter. We use MailChimp, a service of The Rocket Science Group LLC in Atlanta, USA ("MailChimp"), to send the newsletter.
In our newsletters, where permitted, we use techniques (e.g. visible and invisible image elements and/or links) to determine whether and when you have opened the newsletter and which links have been clicked, and to measure and better understand how you use our offers and tailor them to you.
By consenting to receive newsletters, you agree to the use of the techniques used in our newsletters. Most e-mail applications are preset to allow the use of these techniques. If you do not want this, then you must adjust the settings of your e-mail application (e.g. Microsoft Outlook) accordingly or subscribe from our marketing list.
Data recipients also include the other third-party providers mentioned in our overview of cookies and analytics tools. Detailed information about the third-party providers we use in this context, e.g. for processing customer requests or web analytics, can be found in the information about cookies, web analytics and other tracking technologies at the end of this document (section B.).
b. Passing on to providers of services that are introduced via the platform
If we ourselves do not offer the services introduced via the platform, we will pass on your personal data to the providers of the services that we have introduced to you via the platform in order to process the introduced contractual services.
c. Disclosure to payment service providers
Please note that we do not permanently store your credit card information (credit card number, CSV and expiration date), but only process it in order to transmit it in encrypted form to the service provider we refer through our platform. If you choose a MoveAgain service, we will use your payment data to collect the fee. We use the services of partner Stripe, 510 Townsend Street, San Francisco, CA 94103, USA ("Stripe") in part to do this. Where Stripe is involved, your credit card details are requested via an iFrame provided by the partner. Stripe collects and stores the data in order to transmit it in an encrypted form to the organizer you have selected. Your credit card details are not transmitted to us in this case. You can find more information about Stripe here: https://stripe.com/en-gb-gr/privacy. Stripe is dual headquartered in the USA and Ireland, which means your personal data is likely to be transferred to the USA where we use Stripe.
In the event of non-payment, we may pass on your data to a bank or a debt collection service provider.
5. Data processing outside the UK
Where we do transfer your personal data outside of the UK, will endeavor to ensure that an adequate level of data protection is in place at all times. We will ensure that either a so-called adequacy decision is in place, EU or UK standard contractual clauses (including any necessary additional measures) are included in our contracts with processors or that other appropriate safeguards (such as Binding Corporate Rules or approved codes of conduct) are in place to ensure security of processing and an adequate level of data protection at all times.
6. Retention period
We process and store your personal data to the extent necessary to fulfil our contractual or legal obligations. Therefore, we store the data for the duration of the contractual relationship with you and after termination only to the extent and for as long as required by law (e.g. for the purpose of storage and documentation obligations, accounting and tax purposes and for the purpose of evidence for potential legal claims). If the data is no longer required for the fulfilment of legal obligations (e.g. tax or commercial law), it will be deleted, unless further processing is necessary for the preservation of evidence or for the enforcement or defence of legal claims.
Generally we store usage data within the scope of our services for a period of 6 years from the service being complete and then delete it.
As soon as your personal data is no longer required for the above-mentioned purposes, we will delete it or make it anonymous. In the case of longer-term retention obligations, we will restrict processing.
7. Automated individual decisions and user profiles
We do not process your personal data in the context of exclusively automated processing for the purpose of making decisions that produce legal effects in relation to you or significantly affect you. We do not use customer data to create a personal user profile. Possible evaluations of usage data are carried out exclusively anonymously on the basis of aggregated data of sufficiently large comparison groups in order to be able to exclude an identification of your person.
8. Data security
We take appropriate technical and organisational security precautions to protect your personal data from unauthorised access and misuse (e.g. encryption of data carriers and data transfers, access restrictions). Access to our platform and its applications is via SSL/TLS encryption.
9. Your legal rights according to the GDPR
Under the UK GDPR, you can assert the following rights against us:
- Your right to access information and disclosure of it according to Art. 15 UK GDPR,
- Your right to rectification of inaccurate personal data in accordance with Art. 16 UK GDPR,
- Your right to erasure (right to be forgotten) in accordance with Art. 17 UK GDPR,
- Your right to restrict processing of your personal data pursuant to Art. 18 UK GDPR and
- Your right to data portability according to Art. 20 UK GDPR.
You also have the right to lodge a complaint with the competent data protection supervisory authority which in the UK is the Information Commissioner's Office ("ICO") (Art. 77 UK GDPR).
In addition, you can also revoke your consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdrew your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent. If you wish to exercise your rights as a data subject, you can also do so by contacting: firstname.lastname@example.org
Please be aware that the above rights are not available to everyone all the time. Some are subject to exemptions, and so we may not always be able, or required, to comply with your request to exercise these rights. You can read more about the rights that you have on the ICO website: https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/
We usually respond to data protection requests within one month, but it can take longer if your request is particularly complex or if you have made a number of requests. You will not usually have to pay a fee to exercise the rights above, but we reserve the right to charge a fee if your request is clearly unfounded, repetitive or excessive; alternatively, we may refuse to comply with your request.
Please note we may need to process your personal data in order for us to respond to your request.
B. COOKIE AND ANALYSIS TOOLS POLICY
We will only place non-essential cookies on your device if you consent to this by actively opting into our consent tool on our website. You have the option to restrict the use of certain cookies and tracking techniques via the cookie control panel on our platform.
Adjusting the browser settings
Third party providers of tracking techniques and analysis tools
Google Analytics, Google Web Fonts and Google TAG
Google Ads and Google Conversion Tracking:
Google Maps, Google Invisible reCAPTCHA and YouTube:
Google Dynamic Remarketing
On our platform, we use the dynamic remarketing function of Google AdWords. The technology allows us to display automatically created, targeted advertisements after your visit to our platform. The ads are based on the products and services that you clicked on the last time you visited our platform. The provider of Google Dynamic Remarketing is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").
You can object to the collection or analysis of your data by this tool by following these application instructions from Google: https://support.google.com/ads/answer/7395996 .
Facebook Pixel, Facebook Custom Audiences and Facebook Conversion:
We use so-called social plugins from social networks such as Facebook, Twitter and Pinterest on our platform. You can usually recognize the social plugins by the logos/symbols of the respective social networks. The social plugins allow you, among other things, to share certain content of our platform (e.g. a blog post). When you access our platform, your browser establishes a connection to the servers of the respective social network and transmits certain usage data (including the information that you are on our platform) to its operators.
We have no influence on the type and scope of the data collected in the process and its subsequent processing by the operators of the respective social networks. The processing of the data is the responsibility of these operators in accordance with their data protection provisions. You can find these under the following links:
We use the CRM system of the provider salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, in order to be able to process user enquiries more quickly and efficiently (legitimate interest pursuant to Art. 6 Para. 1 lit. f. GDPR).
Salesforce uses the data of the users only for the technical processing of the requests and does not pass them on to third parties. To use Salesforce, at least the specification of a correct e-mail address is necessary. Pseudonymous use is possible. In the course of processing service requests, it may be necessary to collect further data (name, address, telephone number, etc.).
If users do not consent to data collection via and storage in Salesforce's external system, we provide them with alternative means of contacting us to submit service requests via email, telephone, fax, or postal mail.
When you visit our Platform or use our products and services, this information is further processed in a business intelligence system operated by Tableau Software, LLC, The Oval, Shelbourne Road, Dublin 4, Ireland ("Tableau").
The categories of information collected on Tableau depend on your interactions with MoveAgain: Contact information, such as name, title, email address, physical address, phone number and similar contact information, usernames and passwords. Payment and Financial Information. Credit card number, bank information, and billing address. Demographic information. Employment status, occupation, region. If you participate in a survey or inquiry, you will have the opportunity to provide additional information such as gender, race, salary, age, and other personal information. From the surveys, in turn, data such as inclinations and attributes that Tableau generates can help us further understand you and your preferences. In addition, information generated during the course of your transaction with MoveAgain, including account information, logins, passwords, and purchase history is processed and analyzed, including travel information, scheduling information, furniture selection or accessibility requirements, and usage and geographic data. Tableau collects information related to your use of our products, services and websites and the Platform.
We use the rating platform Trustpilot A/S, Pilestræde 58, DK-1112 Copenhagen, Denmark (www.trustpilot.de). Trustpilot is the responsible party in terms of data protection with regard to the data provided by customers on the Trustpilot website. The rating is published on Trustpilot's website and can also be displayed on our website in so-called widgets. Further details can be found in the data protection provisions (https://de.legal.trustpilot.com/end-user-privacy-terms) of Trustpilot and their GTC (https://de.legal.trustpilot.com/end-user-terms-and-conditions).