1. Scope

This Data Processing Agreement ("DPA") is part of the Terms of Service between ManuHive and the organization that uses the Service (the "Customer"). It takes effect when the Customer accepts the Terms of Service; no separate signature is needed.

It covers the personal data that ManuHive processes on the Customer's behalf when it provides the Service ("Customer Personal Data"). It does not cover the data ManuHive processes for its own purposes, such as account administration, billing, security and the analytics of our website; our Privacy Policy describes that processing.

If this DPA and the Terms of Service conflict on the protection of personal data, this DPA prevails.

A Customer that needs a signed copy, for example for its records or an audit, can ask for one at the address in section 15.

2. Definitions

"Controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the General Data Protection Regulation (EU) 2016/679 ("GDPR"). "Data Protection Law" means the GDPR, Greek Law 4624/2019 and any other data protection law of the European Union or of its member states that applies to the processing, and, for a Customer established outside the European Union, the data protection law of its own country to the extent it applies to the processing. A "sub-processor" is another processor that ManuHive engages to process Customer Personal Data. Other capitalized terms have the meanings given in the Terms of Service.

3. Roles

The Customer is the controller of Customer Personal Data, and ManuHive is its processor. Where the Customer itself processes the data on behalf of another controller, ManuHive acts as its sub-processor, and the Customer passes on the instructions and information that this DPA requires.

The Customer is responsible for the lawfulness of the processing it decides on. It must have a legal basis for the data it enters; give its staff, its customers and anyone else whose data it enters the information the law requires (for example, that the times of their work steps are recorded); and make sure that its instructions comply with Data Protection Law and with employment law, including any duty to inform or consult employee representatives. A Customer established outside the European Union tells ManuHive in writing of any requirement of its own country's law that goes beyond this DPA.

4. Details of the Processing

Subject matter and duration: providing the Service to the Customer, for as long as the Customer uses it, and the deletion period in section 11.
Nature and purpose: storing, organizing, displaying, retrieving, sending (for example notification emails) and deleting data, so that the Customer can plan and run production, manage orders, stock, purchasing and deliveries, and analyze its performance; and support when the Customer asks for it.
Data subjects: the Customer's users (its staff and contractors), the people who work at its machines, its drivers, the contact persons of its customers, suppliers and transport companies, and the people it sends order tracking links or quotes to.
Types of personal data: names, email addresses, phone numbers and job roles; user accounts, roles, sign-in records and PINs; work records (who started, paused or finished which step of work, when and for how long) and the performance figures calculated from them for each person; delivery addresses and routes, delivery photos and notes, and the location of a driver who shares it while driving a route (kept only until the route ends, at most 24 hours); contact details of the Customer's customers, suppliers and transport companies; comments, notes and files the Customer chooses to upload; and the audit log of who changed what.
Special categories of personal data (such as health or biometric data) and data about criminal convictions are not to be entered: the Terms of Service do not allow it without our prior written agreement.

5. Instructions

ManuHive processes Customer Personal Data only on the Customer's documented instructions. The Terms of Service, this DPA and the Customer's use and configuration of the Service (the data it enters, the settings it chooses, the people it invites and the integrations it switches on) are the Customer's complete instructions when this DPA takes effect. Further instructions must be given in writing and must be possible within the Service.

ManuHive processes Customer Personal Data otherwise only where European Union or member state law requires it. In that case, it informs the Customer before the processing, unless that law forbids it.

ManuHive informs the Customer without delay if, in its opinion, an instruction infringes Data Protection Law.

6. Confidentiality and Security

Everyone at ManuHive who can access Customer Personal Data is bound by confidentiality and accesses it only as far as needed to provide the Service, to handle a request from the Customer or to meet a legal obligation.

ManuHive applies the technical and organizational measures in Annex 1 to protect Customer Personal Data, in line with Article 32 GDPR. It may change them as technology develops, provided the overall level of protection is not reduced.

Security is shared. ManuHive is responsible for the security of the Service. The Customer is responsible for how it uses the Service: who it gives access to and with which role, removing access when someone leaves, keeping passwords, PINs and the devices at its machines under its control, and keeping secret the links and keys it creates in the Service (order tracking links, Power BI, Tableau and Excel links, calendar feeds, API keys and ERP credentials), revoking or renewing them if they are exposed.

7. Sub-processors

The Customer gives ManuHive general authorization to engage sub-processors. The current sub-processors are listed in Annex 2.

ManuHive gives the Customer at least 30 days' notice before it adds or replaces a sub-processor, by email to the Workspace's administrators or by a notice in the Service. The Customer may object on reasonable data protection grounds within that period. If the objection cannot be resolved, the Customer may stop using the affected part of the Service, and ManuHive refunds any fees paid in advance for the time after that.

ManuHive binds every sub-processor, by written contract, to data protection obligations that give at least the same level of protection as this DPA. As Article 28(4) GDPR requires, ManuHive remains responsible to the Customer for the performance of its sub-processors' obligations.

Services that the Customer connects itself, such as its ERP system, its own webhook addresses or business intelligence tools, and the people it sends tracking links, quotes or emails to, receive data on the Customer's instruction. They are not ManuHive's sub-processors.

8. Location and International Transfers

The database and file storage that hold Customer Personal Data are hosted in the European Union, in Ireland.

Some sub-processors are established in the United States or in Singapore, or may access data from there. Any transfer of personal data outside the European Economic Area is covered by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for certified companies) or by the European Commission's Standard Contractual Clauses, as set out in each sub-processor's data processing terms.

ManuHive is established in Greece and is subject to the law of the European Union and of Greece. Supabase Pte. Ltd., which runs the database and file storage, is a company under the law of Singapore; the infrastructure it uses is run by Amazon Web Services in Ireland and is subject to EU law and, through those companies, possibly also to the laws of Singapore and the United States. The other sub-processors are subject to the laws of the countries named in Annex 2. If a public authority outside the European Union asks ManuHive for the Customer's data, ManuHive provides it only where an international agreement or EU law allows it, gives no more than is required, and informs the Customer first unless that is forbidden. The sub-processors' own commitments on such requests are set out in their data processing terms.

9. Assistance to the Customer

Taking into account the nature of the processing, ManuHive helps the Customer, as far as possible, to answer requests from data subjects who exercise their rights (access, rectification, erasure, restriction, portability and objection). Administrators can view, correct, export and delete most data in the Service themselves.

If ManuHive receives such a request directly, it passes it to the Customer without undue delay, and at the latest within three business days, and does not answer it itself, unless the law requires otherwise.

With the information available to it, ManuHive also helps the Customer to meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation of a supervisory authority (Articles 32 to 36 GDPR). ManuHive may charge reasonable costs for help that goes beyond what the Service and this DPA provide, unless the help is needed because ManuHive breached this DPA.

10. Personal Data Breaches

ManuHive notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice is sent to the email addresses of the Workspace's administrators.

The notice describes, as far as the information is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not yet available is sent as soon as it is.

ManuHive takes reasonable steps to contain the breach and limit its effects. The Customer, as controller, decides whether to notify the supervisory authority and the people concerned; ManuHive does not notify them on the Customer's behalf unless the law requires it or the Customer asks. A notification is not an admission of fault or liability.

11. Deletion and Return of Data

While it uses the Service, the Customer can export its data at any time: PDF and CSV exports on the relevant pages, and a full export of the Workspace in Settings.

When an administrator deletes the Workspace in Settings, its records are deleted immediately and permanently, and the files uploaded to it within 30 days. When the Customer's use of the Service ends in any other way, ManuHive keeps the data for 30 days so that the Customer can ask for an export, and then deletes it. Both apply unless European Union or member state law requires ManuHive to keep the data.

A member's sign-in account (name and email address) is deleted automatically 30 days after it stops belonging to any Workspace, unless a Workspace's records still refer to that person; it is then kept until the person or the Customer asks for its deletion, and it can always be deleted earlier on request. Copies held in the hosting provider's backups are deleted as those backups expire in its normal cycle.

12. Audits and Information

ManuHive makes available to the Customer the information needed to demonstrate compliance with Article 28 GDPR: this DPA, the measures in Annex 1, and answers to reasonable security questions, once a year or after a personal data breach.

The Customer, or an independent auditor it appoints who is bound by confidentiality, may also audit ManuHive's compliance with this DPA. The Customer gives at least 30 days' written notice; an audit takes place at most once a year (unless a supervisory authority requires it or a personal data breach has occurred), during business hours, without access to other customers' data, and at the Customer's cost. Sub-processors are audited through the certifications and audit reports they make available.

13. Liability

The limitations and exclusions of liability in Section 12 of the Terms of Service apply to all claims under or in connection with this DPA, counted together with all claims under the Terms of Service, to the extent the law allows. They do not limit liability that cannot be limited under applicable law, or any party's liability to data subjects under Article 82 GDPR.

14. Duration, Changes and Governing Law

This DPA applies for as long as ManuHive processes Customer Personal Data, including after the Terms of Service end, until the data has been deleted.

ManuHive may update this DPA, for example when the law or the list of sub-processors changes. Changes are announced as the Terms of Service describe. A change that lowers the protection of Customer Personal Data is announced at least 30 days before it takes effect, and the Customer may stop using the Service before then.

This DPA is governed by the same law, and disputes go to the same courts, as the Terms of Service. If a provision is invalid, the rest remains in force. This DPA is published in English, Greek and German; if the versions differ, the English version prevails.

15. Contact

Questions about this DPA, requests for a signed copy, objections to a sub-processor and audit requests:

manuhiveos@gmail.com

16. Additional Terms for Specific Countries

These terms apply in addition where the Customer, or the processing, is subject to the law named.

United Kingdom and Switzerland: for personal data subject to the UK GDPR, transfers outside the United Kingdom use the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner, or the UK Extension to the EU-US Data Privacy Framework. For personal data subject to the Swiss Federal Act on Data Protection, the EU Standard Contractual Clauses apply with the changes Swiss law requires (the FADP in place of the GDPR, the FDPIC as the supervisory authority, and Switzerland counted as a member state so that people in Switzerland can enforce their rights there), or the Swiss-US Data Privacy Framework.
California: where ManuHive processes personal information as a service provider under the California Consumer Privacy Act (CCPA), it does not sell or share it; does not keep, use or disclose it for any purpose other than providing the Service, or outside its direct business relationship with the Customer; does not combine it with personal information from other sources except as the CCPA permits; complies with the CCPA and gives the level of privacy protection it requires; and tells the Customer if it can no longer meet these obligations. The Customer may take reasonable steps to make sure ManuHive uses the personal information in line with the Customer's CCPA obligations and, after notice, to stop and remedy unauthorized use.
Israel: for the purposes of Regulation 3 of the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, ManuHive undertakes to take adequate measures to protect the privacy of the data subjects and not to transfer Customer Personal Data to any third party other than the sub-processors the Customer has authorized under this DPA.
Colombia: where the Customer is subject to Law 1581 of 2012, ManuHive, as processor (encargado), processes the personal data in line with the principles of that law and the Customer's information processing policy, only for the purposes the data subjects have authorized, safeguards the security of the databases and keeps the processing confidential.
Local transfer contracts: where the Customer's law requires a particular contract for sending personal data to ManuHive (for example the standard clauses of Saudi Arabia's SDAIA, Turkey's KVKK or Brazil's ANPD, or Vietnam's transfer agreement), ManuHive signs it on the Customer's request, in the form that law prescribes.
Customer filings: the Customer makes any registration, declaration, permit request, consent or impact assessment that its own law requires before it sends personal data to ManuHive (for example in Algeria, Botswana, Côte d'Ivoire, Morocco, Oman, Quebec, Tanzania or Tunisia). ManuHive gives it the information it needs for this: Annex 1, Annex 2 and section 8.

Annex 1. Technical and Organizational Measures

ManuHive protects Customer Personal Data with the following measures:

Hosting and encryption: the database, sign-in and file storage run on Supabase in the European Union (Ireland), in an environment Supabase operates under SOC 2. Data is encrypted in transit (HTTPS) and at rest.
Separation of customers: Row-Level Security rules on every table limit each signed-in person to the data of their own Workspace, and database functions check membership of the Workspace they act on. Automated tests try to reach another Workspace's data and must be refused.
Access control: access in the Service follows the roles that the Customer's administrators assign, so each person sees what their role needs. Only administrators can read the audit log and the PINs, and only administrators and logistics staff can see where a driver is.
Sign-in: passwords are stored only as hashes (bcrypt); passwords chosen in the app are checked against known leaked passwords without the password leaving the device; the sign-up, sign-in and password forms are checked by Cloudflare Turnstile, which tells people from automated programs, and the sign-in server refuses those requests without a valid check; two-factor authentication is available to every user and, once enrolled, is required for the platform administrator; deleting the Workspace, switching on, renewing or viewing the Power BI, Tableau and Excel link, and creating an API key all require a two-factor code entered in the same sign-in; every PIN mixes letters and digits; repeated wrong PINs are blocked for a while; an account's sign-in on a device ends after 30 days without use; a tablet at a machine signs in with the machine's PIN and gets a key of its own, which ends after 30 days without use, when the machine's PIN changes or when an administrator signs the tablet out.
Audit log: changes to records and settings, sign-ins and data exports are written to an append-only audit log in which each entry is chained to the previous one with SHA-256, so that any alteration can be detected.
Website and network: all traffic is encrypted with HTTPS and HSTS; the website runs behind Cloudflare and sends strict security headers, including a Content Security Policy.
Secrets: ERP credentials are kept encrypted in a secrets vault, API keys are stored only as hashes, and the database's service key is used only on our servers. Exports never include passwords, PINs, API keys or connection credentials. Administrators can revoke or renew order tracking links, Power BI, Tableau and Excel links, calendar feeds and API keys.
Testing: changes to the Service are checked by automated tests; changes to the database are also checked by database tests of the separation between Workspaces and of every deletion path. We act on the security checks of our database provider.
Limits and monitoring: sign-in by PIN, the public API, the Power BI, Tableau and Excel link and machine-data connections are rate-limited, and errors are recorded and reviewed.
Incidents: a written procedure for handling security incidents and personal data breaches, including notifying customers as section 10 describes.
Automatic deletion: the files of a deleted Workspace, accounts that have belonged to no Workspace for 30 days, a driver's location once the route ends, and invitation PINs once used are deleted automatically every day, which automated tests check.

Annex 2. Sub-processors

ManuHive uses the following sub-processors. Each processes personal data only to provide its part of the Service.

Supabase Pte. Ltd. (Singapore): database, sign-in, file storage and server functions. The data is stored in the European Union (Ireland), on infrastructure run by Amazon Web Services; server functions may run in the region nearest to the person using the Service.
Cloudflare, Inc. (United States): hosts and delivers the website and protects it against attacks, including the check on the sign-up, sign-in and password forms that tells people from automated programs (Turnstile). Sees visitors' IP addresses and the pages they open, and forwards email sent to our notification address.
Resend (Plus Five Five, Inc., United States): sends the Service's emails, such as invitations, sign-in and password emails, alerts and reports, from its EU region. Receives the recipients' email addresses and the content of the emails.
Google LLC (United States) and its affiliate Google Ireland Limited (Ireland): maps, address search and route planning (Google Maps Platform), which receive addresses and the locations of delivery stops; sign-in with Google, for those who choose it; website analytics (Google Analytics 4, see section 10 of the Privacy Policy); and our support mailbox (Gmail).
Stripe Payments Europe, Limited (Ireland), part of the Stripe group (United States): payments for paid plans. Receives the billing administrator's email address and the company name; card details are entered on Stripe's own page.

Services the Customer connects itself are not sub-processors (section 7). Changes to this list are announced as section 7 describes.