Dokumen ini tersedia dalam bahasa Inggris, dan versi bahasa Inggris adalah versi yang berlaku.
Movialy — Data Processing Addendum (DPA)
Last updated: 24 September 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Red Friend Co., Ltd., trading as Movialy ("Processor", "we", "us"), and the customer ("Controller", "you"). It governs our processing of personal data on your behalf when you use the Movialy service ("Service").
It applies where you act as a data controller (or as a processor on behalf of another controller) and we process personal data as your processor, in particular the personal data of your renters and of your Authorized Users.
In case of conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA prevails. Capitalized terms not defined here have the meaning given in the Terms of Service.
1. Definitions
Terms such as "personal data", "processing", "data subject", "controller", "processor", and "personal data breach" have the meanings given in the GDPR and/or the Thai PDPA, as applicable. "Applicable Data Protection Law" means all laws relating to data protection and privacy that apply to the processing under this DPA. "Customer Personal Data" means the personal data processed by us on your behalf under this DPA.
2. Roles of the Parties
2.1 You are the controller of the personal data of your renters and Authorized Users that is processed through the Service, whether it is entered by you, by your Authorized Users, or by your renters through your Public Booking Website or the links you send them. You determine the purposes and means of that processing.
2.2 We act as your processor for that personal data and process it only on your documented instructions.
2.3 We are an independent controller for (a) the data described in our Privacy Policy (for example account administration, billing, and security), and (b) where you enable it, the improvement of automatic reading described in Section 9. That processing is governed by our Privacy Policy and by Section 9.
3. Your Instructions and Responsibilities
3.1 You instruct us to process Customer Personal Data only (a) to provide and maintain the Service, (b) as set out in the Terms of Service and this DPA, and (c) as configured by you in the Service, including the emails you send to renters, your Public Booking Website, and the links you send to renters.
3.2 You are responsible for having a valid legal basis and any required consents to collect and process the personal data you process through the Service, including identity and driving documents and photographs, and for giving the required notices to data subjects, including on your Public Booking Website.
3.3 You will not use the Service to process personal data in violation of Applicable Data Protection Law, and your instructions will not require us to do so. We will inform you if, in our opinion, an instruction infringes Applicable Data Protection Law.
3.4 Third-party credentials. Where you enter the login credentials of a third-party platform (for example a GPS tracking platform) in a vehicle record, we store them as Customer Data, as provided by you. They are visible to your Authorized Users who can view that vehicle and to our platform administrators for support. You are responsible for using credentials with the lowest privileges that platform allows.
4. Details of Processing
Subject matter: provision of the Movialy fleet and booking management Service.
Duration: the term of your Account, plus the retention and deletion periods described in the Terms of Service, the Privacy Policy, and Section 12.
Nature and purpose: hosting, storage, transmission, display, and processing of Customer Personal Data to deliver the features of the Service: bookings, check-in and check-out with photos and meter readings, reading of documents and dashboards, finance and ledgers, maintenance, reporting, emails to renters, Public Booking Websites, and renter links.
Categories of data subjects: your renters and drivers, your Authorized Users, and any other individuals whose data you choose to process through the Service.
Categories of personal data: identity and contact details; identity and driving documents (driver's licence, passport, identity card), including their images and the data read from them; photographs of vehicles and documents; booking, payment, deposit, and ledger records; notes and ratings; emails sent to renters; access data of renter links; and related technical metadata.
Special categories of data: the Service is not intended to process special categories of personal data. Identity documents may incidentally reveal information such as nationality or a facial photograph; the Service does not use them for biometric identification. You must not enter other sensitive data unless you have ensured a lawful basis for doing so.
5. Confidentiality
We ensure that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and that access is limited to those who need it to provide the Service. Platform administrator access is restricted and logged.
6. Security Measures
We implement appropriate technical and organizational measures to protect Customer Personal Data, as summarized in Annex 2. We may update these measures, provided that the overall level of security is not reduced.
7. Sub-Processors
7.1 You grant us a general authorization to engage sub-processors to provide the Service. Current sub-processors are listed in Annex 1 and in our Privacy Policy.
7.2 We impose on each sub-processor data-protection obligations no less protective than those in this DPA, and we remain responsible to you for their performance.
7.3 We will notify you of any intended addition or replacement of a sub-processor at least thirty (30) days in advance. You may object on reasonable data-protection grounds within that period. If we cannot resolve a well-founded objection, you may, as your sole remedy, terminate the affected part of the Service by written notice.
8. Artificial Intelligence Processing
8.1 Where you use AI-assisted features, the relevant images and text (for example a dashboard photo or an identity document submitted for a booking) are sent to the AI sub-processors listed in Annex 1, solely to return the requested result.
8.2 AI results may contain errors. You are responsible for reviewing and confirming them before relying on them. You can disable AI features in the Service settings.
9. Improvement of Automatic Reading (Optional)
9.1 The option to help improve automatic reading is disabled by default. Only you can enable it, in your settings.
9.2 Where you enable it, you authorize us to keep, for ninety (90) days, the photos of dashboards and identity documents read by the Service, together with the values read and your corrections, to measure and improve reading accuracy. For this limited purpose, we act as an independent controller.
9.3 These samples are accessible only to authorized Movialy personnel, are never sold, and are used for no other purpose. They are deleted automatically, including their image files, after ninety days. Disabling the option stops the collection of new samples. You may ask us to delete existing samples earlier.
9.4 You are responsible for informing your renters of this processing in accordance with Applicable Data Protection Law.
10. Assistance to the Controller
10.1 Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects (access, rectification, erasure, restriction, portability, objection). The Service also provides export and deletion features that you can use directly. If we receive a request directly from one of your data subjects, we will forward it to you.
10.2 Where relevant and at your reasonable request, we will assist you with data-protection impact assessments and prior consultations with supervisory authorities, taking into account the information available to us.
11. Personal Data Breach
We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably available to us to help you meet your own notification obligations.
12. Return and Deletion of Data
Upon termination of the Service, Customer Data remains available for export for thirty (30) days. After that period, we delete Customer Personal Data, except where we are required by law to retain it. Residual copies in backups are overwritten in the ordinary course of backup rotation.
13. International Transfers
Where providing the Service involves transferring Customer Personal Data across borders, we ensure that an appropriate transfer mechanism is in place as required by Applicable Data Protection Law, such as Standard Contractual Clauses under the GDPR, or the mechanisms recognized under the Thai PDPA. The locations of our sub-processors are listed in Annex 1.
14. Audit
We will make available to you the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by you or by an auditor mandated by you, subject to reasonable notice, confidentiality, and business hours. Audits are limited to once per calendar year, unless a supervisory authority requires more.
15. Liability
The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.
16. Governing Law
This DPA is governed by the law specified in the Terms of Service (Thailand), without prejudice to the mandatory provisions of Applicable Data Protection Law.
Annex 1 — Sub-Processors of Customer Personal Data
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. (via Lovable Cloud) | Database, authentication, file storage, server functions | United States / EU (per project configuration) |
| Cloudflare, Inc. | Hosting and delivery of the application, Public Booking Websites, and renter links; edge functions; caching | United States; global edge network |
| Alibaba Cloud (Qwen models) | AI reading of dashboards and identity documents, classification, suggestions, translation | Singapore |
| Anthropic, PBC (Claude models) | AI fallback for the same features | United States |
| Lovable AI Gateway | Generation of vehicle thumbnail images | United States / EU |
| Lovable (email service) | Delivery of emails sent from the Service to renters and users | United States / EU |
| Omise / Opn Payments | Payment processing | Thailand / Singapore |
| ClickUp | Support tickets and bug reports | United States |
Annex 2 — Technical and Organizational Measures (Summary)
- Encryption of personal data in transit (HTTPS/TLS).
- Logical tenant isolation enforced by Row Level Security at the database level.
- Role-based access control (roles and per-feature permissions), re-verified on the server and, for financial records, in the database.
- Signed, time-limited links for access to stored photos and documents.
- Audit logging of changes to bookings, financial lines, clients, and vehicles.
- Restricted and logged platform administrator access.
- Session management with expiry, password reset, limitation of repeated sign-in attempts, and optional device sign-in (passkeys).
- Scheduled jobs authenticated with a dedicated secret.
- Automated retention: removal of photos, deactivation of renter links, and deletion of training samples after the periods described in the Terms of Service and the Privacy Policy.
- Daily reset and isolation of demonstration data.