1. Scope

This Data Processing Agreement ("DPA") is part of the Terms of Service between ManuHive and the organization that uses the Service (the "Customer"). It takes effect when the Customer accepts the Terms of Service; no separate signature is needed.

It covers the personal data that ManuHive processes on the Customer's behalf when it provides the Service ("Customer Personal Data"). It does not cover the data ManuHive processes for its own purposes, such as account administration, billing, security and the analytics of our website; our Privacy Policy describes that processing.

If this DPA and the Terms of Service conflict on the protection of personal data, this DPA prevails.

A Customer that needs a signed copy, for example for its records or an audit, can ask for one at the address in section 15.

2. Definitions

"Controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the General Data Protection Regulation (EU) 2016/679 ("GDPR"). "Data Protection Law" means the GDPR, Greek Law 4624/2019 and any other data protection law of the European Union or of its member states that applies to the processing. A "sub-processor" is another processor that ManuHive engages to process Customer Personal Data. Other capitalized terms have the meanings given in the Terms of Service.

3. Roles

The Customer is the controller of Customer Personal Data, and ManuHive is its processor. Where the Customer itself processes the data on behalf of another controller, ManuHive acts as its sub-processor, and the Customer passes on the instructions and information that this DPA requires.

The Customer is responsible for the lawfulness of the processing it decides on. It must have a legal basis for the data it enters; give its staff, its customers and anyone else whose data it enters the information the law requires (for example, that the times of their work steps are recorded); and make sure that its instructions comply with Data Protection Law and with employment law, including any duty to inform or consult employee representatives.

4. Details of the Processing

Subject matter and duration: providing the Service to the Customer, for as long as the Customer uses it, and the deletion period in section 11.
Nature and purpose: storing, organizing, displaying, retrieving, sending (for example notification emails) and deleting data, so that the Customer can plan and run production, manage orders, stock, purchasing and deliveries, and analyze its performance; and support when the Customer asks for it.
Data subjects: the Customer's users (its staff and contractors), the people who work at its machines, its drivers, the contact persons of its customers, suppliers and transport companies, and the people it sends order tracking links or quotes to.
Types of personal data: names, email addresses, phone numbers and job roles; user accounts, roles, sign-in records and PINs; work records (who started, paused or finished which step of work, when and for how long) and the performance figures calculated from them for each person; delivery addresses and routes, delivery photos and notes, and the location of a driver who shares it while driving a route (kept only until the route ends, at most 24 hours); contact details of the Customer's customers, suppliers and transport companies; comments, notes and files the Customer chooses to upload; and the audit log of who changed what.
Special categories of personal data (such as health or biometric data) and data about criminal convictions are not to be entered: the Terms of Service do not allow it without our prior written agreement.

5. Instructions

ManuHive processes Customer Personal Data only on the Customer's documented instructions. The Terms of Service, this DPA and the Customer's use and configuration of the Service (the data it enters, the settings it chooses, the people it invites and the integrations it switches on) are the Customer's complete instructions when this DPA takes effect. Further instructions must be given in writing and must be possible within the Service.

ManuHive processes Customer Personal Data otherwise only where European Union or member state law requires it. In that case, it informs the Customer before the processing, unless that law forbids it.

ManuHive informs the Customer without delay if, in its opinion, an instruction infringes Data Protection Law.

6. Confidentiality and Security

Everyone at ManuHive who can access Customer Personal Data is bound by confidentiality and accesses it only as far as needed to provide the Service, to handle a request from the Customer or to meet a legal obligation.

ManuHive applies the technical and organizational measures in Annex 1 to protect Customer Personal Data, in line with Article 32 GDPR. It may change them as technology develops, provided the overall level of protection is not reduced.

Security is shared. ManuHive is responsible for the security of the Service. The Customer is responsible for how it uses the Service: who it gives access to and with which role, removing access when someone leaves, keeping passwords, PINs and the devices at its machines under its control, and keeping secret the links and keys it creates in the Service (order tracking links, Power BI, Tableau and Excel links, calendar feeds, API keys and ERP credentials), revoking or renewing them if they are exposed.

7. Sub-processors

The Customer gives ManuHive general authorization to engage sub-processors. The current sub-processors are listed in Annex 2.

ManuHive gives the Customer at least 30 days' notice before it adds or replaces a sub-processor, by email to the Workspace's administrators or by a notice in the Service. The Customer may object on reasonable data protection grounds within that period. If the objection cannot be resolved, the Customer may stop using the affected part of the Service, and ManuHive refunds any fees paid in advance for the time after that.

ManuHive binds every sub-processor, by written contract, to data protection obligations that give at least the same level of protection as this DPA. As Article 28(4) GDPR requires, ManuHive remains responsible to the Customer for the performance of its sub-processors' obligations.

Services that the Customer connects itself, such as its ERP system, its own webhook addresses or business intelligence tools, and the people it sends tracking links, quotes or emails to, receive data on the Customer's instruction. They are not ManuHive's sub-processors.

8. Location and International Transfers

The database and file storage that hold Customer Personal Data are hosted in the European Union, in Ireland.

Some sub-processors are established in the United States, or may access data from there. Any transfer of personal data outside the European Economic Area is covered by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for certified companies) or by the European Commission's Standard Contractual Clauses, as set out in each sub-processor's data processing terms.

9. Assistance to the Customer

Taking into account the nature of the processing, ManuHive helps the Customer, as far as possible, to answer requests from data subjects who exercise their rights (access, rectification, erasure, restriction, portability and objection). Administrators can view, correct, export and delete most data in the Service themselves.

If ManuHive receives such a request directly, it passes it to the Customer without undue delay and does not answer it itself, unless the law requires otherwise.

With the information available to it, ManuHive also helps the Customer to meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation of a supervisory authority (Articles 32 to 36 GDPR). ManuHive may charge reasonable costs for help that goes beyond what the Service and this DPA provide, unless the help is needed because ManuHive breached this DPA.

10. Personal Data Breaches

ManuHive notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice is sent to the email addresses of the Workspace's administrators.

The notice describes, as far as the information is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not yet available is sent as soon as it is.

ManuHive takes reasonable steps to contain the breach and limit its effects. The Customer, as controller, decides whether to notify the supervisory authority and the people concerned; ManuHive does not notify them on the Customer's behalf unless the law requires it or the Customer asks. A notification is not an admission of fault or liability.

11. Deletion and Return of Data

While it uses the Service, the Customer can export its data at any time: PDF and CSV exports on the relevant pages, and a full export of the Workspace in Settings.

When an administrator deletes the Workspace in Settings, its records are deleted immediately and permanently, and the files uploaded to it within 30 days. When the Customer's use of the Service ends in any other way, ManuHive keeps the data for 30 days so that the Customer can ask for an export, and then deletes it. Both apply unless European Union or member state law requires ManuHive to keep the data.

A member's sign-in account (name and email address) is deleted automatically 30 days after it stops belonging to any Workspace, unless a Workspace's records still refer to that person; it is then kept until the person or the Customer asks for its deletion, and it can always be deleted earlier on request. Copies held in the hosting provider's backups are deleted as those backups expire in its normal cycle.

12. Audits and Information

ManuHive makes available to the Customer the information needed to demonstrate compliance with Article 28 GDPR: this DPA, the measures in Annex 1, and answers to reasonable security questions, once a year or after a personal data breach.

The Customer, or an independent auditor it appoints who is bound by confidentiality, may also audit ManuHive's compliance with this DPA. The Customer gives at least 30 days' written notice; an audit takes place at most once a year (unless a supervisory authority requires it or a personal data breach has occurred), during business hours, without access to other customers' data, and at the Customer's cost. Sub-processors are audited through the certifications and audit reports they make available.

13. Liability

The limitations and exclusions of liability in Section 12 of the Terms of Service apply to all claims under or in connection with this DPA, counted together with all claims under the Terms of Service, to the extent the law allows. They do not limit liability that cannot be limited under applicable law, or any party's liability to data subjects under Article 82 GDPR.

14. Duration, Changes and Governing Law

This DPA applies for as long as ManuHive processes Customer Personal Data, including after the Terms of Service end, until the data has been deleted.

ManuHive may update this DPA, for example when the law or the list of sub-processors changes. Changes are announced as the Terms of Service describe. A change that lowers the protection of Customer Personal Data is announced at least 30 days before it takes effect, and the Customer may stop using the Service before then.

This DPA is governed by the same law, and disputes go to the same courts, as the Terms of Service. If a provision is invalid, the rest remains in force. This DPA is published in English, Greek and German; if the versions differ, the English version prevails.

15. Contact

Questions about this DPA, requests for a signed copy, objections to a sub-processor and audit requests:

manuhiveos@gmail.com

Annex 1. Technical and Organizational Measures

ManuHive protects Customer Personal Data with the following measures:

Hosting and encryption: the database, sign-in and file storage run on Supabase in the European Union (Ireland), in an environment Supabase operates under SOC 2. Data is encrypted in transit (HTTPS) and at rest.
Separation of customers: Row-Level Security rules on every table limit each signed-in person to the data of their own Workspace, and database functions check membership of the Workspace they act on. Automated tests try to reach another Workspace's data and must be refused.
Access control: access in the Service follows the roles that the Customer's administrators assign, so each person sees what their role needs. Only administrators can read the audit log and the PINs, and only administrators and logistics staff can see where a driver is.
Sign-in: passwords are stored only as hashes (bcrypt); passwords chosen in the app are checked against known leaked passwords without the password leaving the device; two-factor authentication is available to every user and, once enrolled, is required for the platform administrator; every PIN mixes letters and digits; repeated wrong PINs are blocked for a while; an account's sign-in on a device ends after 30 days without use.
Audit log: changes to records and settings, sign-ins and data exports are written to an append-only audit log in which each entry is chained to the previous one with SHA-256, so that any alteration can be detected.
Website and network: all traffic is encrypted with HTTPS and HSTS; the website runs behind Cloudflare and sends strict security headers, including a Content Security Policy.
Secrets: ERP credentials are kept encrypted in a secrets vault, API keys are stored only as hashes, and the database's service key is used only on our servers. Exports never include passwords, PINs, API keys or connection credentials. Administrators can revoke or renew order tracking links, Power BI, Tableau and Excel links, calendar feeds and API keys.
Testing: changes to the Service are checked by automated tests; changes to the database are also checked by database tests of the separation between Workspaces and of every deletion path. We act on the security checks of our database provider.
Limits and monitoring: sign-in by PIN, the public API, the Power BI, Tableau and Excel link and machine-data connections are rate-limited, and errors are recorded and reviewed.
Incidents: a written procedure for handling security incidents and personal data breaches, including notifying customers as section 10 describes.
Automatic deletion: the files of a deleted Workspace, accounts that have belonged to no Workspace for 30 days, a driver's location once the route ends, and invitation PINs once used are deleted automatically every day, which automated tests check.

Annex 2. Sub-processors

ManuHive uses the following sub-processors. Each processes personal data only to provide its part of the Service.

Supabase, Inc. (United States): database, sign-in, file storage and server functions. The data is stored in the European Union (Ireland); server functions may run in the region nearest to the person using the Service.
Cloudflare, Inc. (United States): delivers the website and protects it against attacks. Sees visitors' IP addresses and the pages they open, and forwards email sent to our notification address.
ZAP-Hosting GmbH (Germany): hosts the server that delivers the website's files. Sees visitors' IP addresses and the addresses of the pages they open.
Resend (United States): sends the Service's emails, such as invitations, sign-in and password emails, alerts and reports, from its EU region. Receives the recipients' email addresses and the content of the emails.
Google LLC (United States): maps, address search and route planning (Google Maps Platform), which receive addresses and the locations of delivery stops; sign-in with Google, for those who choose it; website analytics (Google Analytics 4, see section 10 of the Privacy Policy); and our support mailbox (Gmail).
Stripe, Inc. (United States): payments for paid plans. Receives the billing administrator's email address and the company name; card details are entered on Stripe's own page.

Services the Customer connects itself are not sub-processors (section 7). Changes to this list are announced as section 7 describes.