Privacy
Policy

1. Data Controller

The data controller for personal data processed through Movemative is:

Paldesk d.o.o.
OIB: 58818971615
Prilaz Vladislava Brajkovica 15, Zagreb, Croatia
hello@movemative.com

This Privacy Policy applies to personal data collected and processed when you use the Movemative platform at movemative.com and its subdomains.

Our role: controller and processor

For personal data related to account management, billing, and operation of the platform, Paldesk d.o.o. acts as a data controller and determines the purposes and means of processing.

For personal data contained in shipment documents, party records, and other Customer Data submitted through the Service, Paldesk d.o.o. acts as a data processor on behalf of the organisation that submitted the data. In this capacity we process such data only on your documented instructions. A Data Processing Agreement (DPA) is available on request at hello@movemative.com.

2. Data We Collect

We collect the following categories of personal data:

Account and identity data

Name, work email address, job title, and authentication credentials, collected when you register or are invited to an organisation account.

Organisation data

Company name, VAT number, registered address, contact details, and operator identifiers (including DIWASS operator IDs), provided when setting up your organisation profile.

Shipment and document data

Data entered when creating waste shipment notifications, eCMR documents, and Annex VII filings. This may include personal data relating to drivers, signatories, responsible persons, and contact persons at third-party facilities. You are responsible for ensuring you have a lawful basis to submit this data.

Usage and technical data

IP address, browser type, pages visited, session duration, error logs, and other diagnostic information collected automatically when you use the Service. This data is used to maintain and improve the Service.

Billing data

Payment and billing information is processed directly by Paddle (our Merchant of Record). We do not store full payment card details. We receive transaction identifiers and subscription status from Paddle.

Communications data

Records of communications you send us (support emails, feedback forms), used to respond to your enquiries and improve the Service.

3. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service you have subscribed to, including account management, shipment document creation, and DIWASS integration.
• Legitimate interests (Art. 6(1)(f)): Operating, maintaining, and improving the Service; detecting and preventing fraud and security incidents; sending product update communications to existing customers. We have balanced these interests against your rights — you may object as described in Section 7.
• Legal obligation (Art. 6(1)(c)): Complying with applicable laws, including financial record-keeping, tax obligations, and responding to lawful requests from public authorities.
• Consent (Art. 6(1)(a)): Where we rely on consent (e.g. optional marketing emails), you may withdraw it at any time without affecting prior processing.

4. How We Use Your Data

We use your personal data to:

• Provide, operate, and maintain the Service
• Process and transmit waste shipment documents to DIWASS and other systems on your behalf
• Manage your account, subscription, and credits
• Send transactional emails (account verification, shipment status updates, credit alerts)
• Respond to support enquiries
• Monitor service health, diagnose errors, and improve the platform
• Comply with legal and regulatory obligations
• Send product news and feature announcements to registered users (you can unsubscribe at any time)

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not sell your personal data to third parties.

5. Data Sharing and Sub-Processors

We share personal data with the following categories of recipients where necessary to provide the Service:

Where AI-powered features are used within the Service, only the minimum data necessary to fulfil the request is transmitted to the AI provider. We do not use Customer Data to train external AI models, and we do not permit AI sub-processors to use Customer Data for their own model training purposes.

"SCCs" refers to the European Commission's Standard Contractual Clauses, which provide an appropriate safeguard for transfers of personal data to third countries.

We may also disclose personal data to public authorities or regulators where required by law or in response to a lawful request.

6. Data Retention

We retain personal data for as long as necessary to provide the Service and comply with our obligations:

• Account data: Retained for the duration of your account, plus 3 years after closure for legal and audit purposes.
• Shipment and document data: Retained for a minimum of 5 years from the date of shipment completion, in accordance with Regulation (EU) 2024/1157 record-keeping requirements. You may export your data at any time from your account.
• Usage and technical data: Retained for up to 12 months.
• Billing records: Retained for 7 years as required by Croatian tax law.

7. Your Rights Under GDPR

If you are located in the European Economic Area, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data, subject to legal retention obligations.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdrawal of consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at hello@movemative.com. We will respond within 30 days. You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) at azop.hr, or with the supervisory authority in your EU member state.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encryption in transit (TLS), encryption at rest, access controls, and regular security reviews.

No method of transmission or storage is 100% secure. If you become aware of a security vulnerability or incident, please notify us immediately at hello@movemative.com.

9. Cookies and Tracking

Movemative uses essential cookies required for authentication, session management, and security (including cookies set by Clerk for authentication). We do not use third-party advertising cookies or tracking pixels.

You can control cookies through your browser settings, but disabling essential cookies will prevent you from using the authenticated parts of the Service.

10. Children

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately.

11. Updates to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a notice in the Service. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.

12. Contact

For any questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact us:

Paldesk d.o.o.
OIB: 58818971615
Prilaz Vladislava Brajkovica 15, Zagreb, Croatia
hello@movemative.com