Data Processing Agreement (DPA)

Company Information

moovit, s.r.o.

IČO: 45240639

IČ DPH: SK2022919415

Bobuľová 11/B, 900 28 Ivanka pri Dunaji, Slovakia

Emails:privacy@renvia.app, support@renvia.app

1. Introduction

This Data Processing Agreement ("DPA") forms part of the contractual relationship between moovit, s.r.o., trading as Renvia ("Renvia" or "Data Processor"), and the customer ("Customer" or "Data Controller"). This DPA governs the processing of Customer Data by Renvia on behalf of the Customer in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR").

This DPA sets forth the terms and conditions under which Renvia processes personal data on behalf of the Customer and reflects the Parties' commitment to data protection and privacy.

2. Definitions

Capitalized terms used in this DPA shall have the meanings assigned to them in the GDPR or as defined herein:

• "Customer": The entity which determines the purposes and means of the processing of Customer Data (Data Controller).
• "Renvia": moovit, s.r.o., acting as Data Processor on behalf of the Customer.
• "Customer Data": Any personal data provided by or on behalf of the Customer to Renvia for processing in connection with the services.
• "Data Controller": The entity which determines the purposes and means of the processing of personal data.
• "Data Processor": The entity which processes personal data on behalf of the Data Controller.
• "Subprocessor": Any third party engaged by Renvia to process Customer Data on behalf of the Customer.

3. Scope and Application

This DPA applies to all processing of Customer Data by Renvia in connection with the provision of services pursuant to the underlying service agreement between the Parties. Renvia shall process Customer Data solely in accordance with the documented instructions of the Customer, including those set forth in this DPA, the service agreement, and applicable law.

4. Roles of the Parties

The Customer is the Data Controller and Renvia is the Data Processor with respect to Customer Data. Renvia acts only on documented instructions from the Customer and does not determine the purposes or means of processing.

5. Processing Instructions

Renvia shall process Customer Data only on documented instructions from the Customer. Such instructions include this DPA, the service agreement, and any additional written instructions provided by the Customer. Renvia shall immediately inform the Customer if, in its opinion, any instruction infringes applicable data protection law.

Renvia shall process Customer Data only on documented instructions from the Customer, including with regard to transfers of Customer Data to a third country or an international organization, unless required to do so by applicable European Union or Member State law. In such a case, Renvia shall inform the Customer of that legal requirement before processing unless prohibited by law on important grounds of public interest.

Renvia shall make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations set forth in Article 28 GDPR and this DPA.

6. Confidentiality

Renvia ensures that all personnel authorized to process Customer Data are committed to confidentiality obligations, whether contractual or statutory. Access to Customer Data is strictly limited to those individuals who require access to fulfill Renvia's obligations under this DPA.

7. Security of Processing

Renvia shall implement and maintain appropriate technical and organizational measures to protect Customer Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. These measures shall be appropriate to the risks involved and shall include, but are not limited to, the following:

• Encryption in Transit: All Customer Data transmitted between Customer and Renvia's systems is protected using TLS 1.2 or higher to ensure confidentiality and integrity.
• Encryption at Rest: Customer Data stored by Renvia is encrypted at rest using industry-standard encryption algorithms where applicable.
• Role-Based Access Control (RBAC): Access to Customer Data is restricted based on job responsibilities and enforced by RBAC mechanisms to ensure least privilege.
• Multi-Factor Authentication (MFA): MFA is implemented for access to systems processing Customer Data where applicable, enhancing security against unauthorized access.
• Logging: Access and processing activities involving Customer Data are logged comprehensively to provide audit trails and support forensic investigations.
• Monitoring: Systems are continuously monitored for security events, anomalies, and potential threats using automated tools and security information and event management (SIEM) solutions.
• Backups: Regular backups of Customer Data are performed and securely stored to ensure data availability and integrity, with backup retention policies aligned with business and legal requirements.
• Least Privilege: Access rights are granted only to the minimum necessary personnel and reviewed periodically to prevent privilege creep.
• Vulnerability Management: Renvia conducts regular vulnerability assessments and applies security patches promptly to mitigate risks.
• Incident Response: Renvia maintains documented incident response procedures to detect, contain, investigate, and remediate security incidents involving Customer Data.
• Secure Software Development Practices: Renvia follows secure development lifecycle practices, including code reviews, static and dynamic analysis, and security testing, to minimize vulnerabilities in software processing Customer Data.

8. Personnel Access Controls

Renvia ensures that all personnel authorized to access Customer Data are subject to appropriate background checks, confidentiality agreements, and receive ongoing data protection training. Access rights are reviewed regularly and revoked immediately upon termination or role change.

9. Subprocessors

The Customer authorizes Renvia to engage Subprocessors to process Customer Data in connection with the services. Renvia shall:

• Maintain a current list of authorized Subprocessors, which is available to the Customer upon request and included in Annex III of this DPA.
• Ensure that all Subprocessors are bound by written agreements imposing data protection obligations substantially equivalent to those contained in this DPA pursuant to Article 28(4) GDPR, including confidentiality, security, and data subject rights assistance.
• Remain fully liable for the acts and omissions of its Subprocessors to the same extent as if Renvia had performed the services itself.

• Renvia shall provide at least 15 days prior notice of any material addition or replacement of a Subprocessor.
• Customer may object within the notice period on reasonable data protection grounds.
• The objection must describe the specific risk or compliance concern.
• The Parties shall work in good faith to resolve the concern.
• If no commercially reasonable solution can be reached, Customer may discontinue the affected services and terminate the impacted portion of the services.
• Failure to object within the notice period constitutes approval.

All Subprocessors are bound by written agreements imposing data protection obligations substantially equivalent to those contained in this DPA pursuant to Article 28(4) GDPR.

10. International Transfers

Customer Data may be transferred outside the European Economic Area ("EEA") only if appropriate safeguards are in place, such as:

• Transfers based on adequacy decisions by the European Commission.
• Standard Contractual Clauses ("SCCs") approved by the European Commission implemented between Renvia and any third-country recipients.
• Transfer Impact Assessments conducted by Renvia to evaluate the legal environment of third countries and implementation of supplementary measures where necessary to ensure an adequate level of protection.
• Use of additional safeguards such as encryption, pseudonymization, or contractual commitments to protect Customer Data during and after transfer.

Renvia commits to comply with all applicable data transfer laws and regulations and to cooperate with the Customer in relation to transfer compliance.

Where Customer Data is transferred outside the EEA and no adequacy decision applies, the European Commission Standard Contractual Clauses shall be deemed incorporated by reference into this DPA to the extent required by applicable law. Renvia shall implement the applicable SCC module and any supplementary safeguards reasonably required to achieve an essentially equivalent level of protection.

11. Assistance with Data Subject Requests

Renvia shall assist the Customer in responding to requests from data subjects exercising their rights under the GDPR, including access, rectification, erasure, restriction, portability, and objection. Such assistance shall be provided in a timely manner and in accordance with the Customer's instructions.

12. Assistance with GDPR Compliance

Renvia shall assist the Customer in ensuring compliance with obligations pursuant to Articles 32 to 36 of the GDPR, including but not limited to:

• Implementing appropriate technical and organizational measures to ensure security of processing.
• Data breach notification obligations.
• Data protection impact assessments.
• Consultations with supervisory authorities.

Renvia's assistance shall be proportionate to the nature of processing and available information.

13. Personal Data Breach Notification

Renvia shall notify the Customer without undue delay upon becoming aware of a personal data breach affecting Customer Data. Such notification shall include:

• A description of the nature and scope of the breach.
• Details of the categories and approximate number of data subjects and data records affected.
• Measures taken or proposed to be taken to contain, investigate, and remediate the breach.
• Contact details of Renvia's data protection officer or responsible contact.

Renvia shall cooperate fully with the Customer in investigating the breach, mitigating its effects, and complying with any notification obligations imposed by law.

14. Audit and Inspection Rights

The Customer shall have the right to audit and inspect Renvia's compliance with this DPA, subject to the following conditions:

• Reasonable prior written notice of at least thirty (30) days.
• Audits shall be conducted no more than once per calendar year unless required by law or following a personal data breach or security incident.
• Remote audits and reviews are preferred to minimize disruption.
• Audits shall be conducted during normal business hours and in a manner that does not unreasonably interfere with Renvia's operations.
• All auditors shall be subject to confidentiality obligations no less restrictive than those contained herein.
• The Customer shall bear its own costs associated with such audits unless otherwise agreed or required by law.

Renvia shall make available information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR. Where appropriate, Renvia may satisfy audit requests through third-party audit reports, certifications, security documentation, questionnaires, or similar compliance materials.

15. Return and Deletion of Customer Data

Upon termination or expiration of the service agreement, Renvia shall, at the Customer's choice, return all Customer Data in a commonly used, machine-readable format or securely delete such data, except where retention is required by law.

Renvia shall provide the Customer with an opportunity to export Customer Data prior to deletion. Deletion shall be completed within thirty (30) days of the Customer's instruction, subject to backup lifecycle policies.

Backup copies containing Customer Data shall be deleted in accordance with Renvia's backup retention policies, which do not exceed ninety (90) days unless otherwise required by law.

16. Liability

Liability arising from the processing of Customer Data shall be governed by the terms of the underlying service agreement and applicable law, including the GDPR. Nothing in this DPA shall expand or limit the liability allocation set forth in the service agreement except as required by mandatory law.

17. Term and Termination

This DPA shall remain in effect for the duration of the service agreement and shall terminate upon the return or deletion of all Customer Data in accordance with Section 15 of this DPA.

18. Governing Law and Jurisdiction

This DPA shall be governed by and construed in accordance with the laws of Slovakia, without regard to its conflict of law provisions. The Parties submit to the exclusive jurisdiction of the courts of Slovakia for any disputes arising out of or in connection with this DPA.

19. Contact Information

For all data protection matters relating to this DPA, the Customer may contact Renvia at:
privacy@renvia.app
support@renvia.app

ANNEX I – DETAILS OF PROCESSING

ANNEX II – TECHNICAL AND ORGANIZATIONAL MEASURES

ANNEX III – AUTHORIZED SUBPROCESSORS

The list above reflects the Subprocessors authorized by Renvia as of the Effective Date of this DPA. Renvia may update this list from time to time in accordance with Section 9 of this DPA. The current list of authorized Subprocessors may be made available through Renvia documentation, customer communications, or a dedicated Subprocessors page.