Data processing agreement (DPA)

01Parties and acceptanceLink to this section: Parties and acceptance

This data processing agreement is made between:

• the venue, as controller: the organisation that accepts the terms of use for venues when creating its venue in Muvo;
• Muvo, as processor: the owner identified in the legal notice.

It forms part of the terms of use and is accepted together with them. Where the two conflict on data protection matters, this agreement prevails.

Pending legal review: To be confirmed by legal counsel: whether a signable version is also needed for public bodies and schools

02Subject matterLink to this section: Subject matter

Muvo will process, on the venue’s behalf, the personal data needed to provide the audio guide creation and publishing service described in the terms of use.

This agreement does not cover dashboard users’ account data or billing data, which Muvo processes as a controller under its privacy policy.

03DurationLink to this section: Duration

This agreement lasts for as long as the relationship between the venue and Muvo. When it ends, the section “End of processing” applies.

04Nature and purpose of processingLink to this section: Nature and purpose of processing

Muvo carries out the following operations, automatically and solely to provide the service:

• storing and hosting the venue’s content (texts, audio, images, documents);
• sending paragraph text to the AI providers to generate the voices and translations the venue requests;
• processing recorded or uploaded audio (trimming, volume, noise reduction);
• publishing the content in the player for visitors;
• recording anonymous usage statistics for the audio guides and counting distinct visitors using hashes;
• managing access codes and visitor passes;
• making backups and deleting data at the end.

05Types of data and data subjectsLink to this section: Types of data and data subjects

The venue must not include special categories of data (health, beliefs, ethnic origin and so on) or children’s data without the necessary legal basis and consents.

06The venue’s obligationsLink to this section: The venue’s obligations

As controller, the venue:

• decides what personal data to include in its content and ensures it has a legal basis to process and publish it;
• informs the people concerned, for example those who record their voice;
• where children are involved (for example, students who record their voice or appear in images for a school project), obtains and keeps authorisation from their parents or legal guardians before recording or publishing, and complies with any applicable education rules;
• gives Muvo lawful instructions, which are those resulting from using the dashboard and from these terms;
• handles data subjects’ requests concerning its content.

Pending legal review: To be completed by legal counsel: exact wording of the clause on recordings and data of children, and whether to offer schools a template consent form

07Muvo’s obligationsLink to this section: Muvo’s obligations

As processor, Muvo undertakes to:

• process the data only on the venue’s documented instructions, including with regard to international transfers, unless the law requires otherwise, in which case it will inform the venue beforehand where the law allows;
• tell the venue if it believes an instruction breaches data protection law;
• not use the data for its own purposes or disclose it to third parties, other than the sub-processors listed below;
• ensure that everyone authorised to process the data is bound by confidentiality;
• apply the security measures described in this agreement;
• help the venue meet its obligations on security, breach notification, impact assessments and prior consultation, taking into account the nature of the processing;
• keep a record of processing activities as a processor (Art. 30(2) GDPR).

08Sub-processorsLink to this section: Sub-processors

The venue gives Muvo general authorisation to use the following sub-processors:

The full list of Muvo’s providers, including those that only process data for which Muvo is the controller (such as Stripe), is in the privacy policy.

Muvo contractually binds each sub-processor to data protection obligations equivalent to those in this agreement and remains liable to the venue for their compliance. Muvo will give notice of any change of sub-processors by updating this list and informing admins at least Pending legal review: To be completed: notice period, e.g. 30 days in advance; the venue may object on reasonable grounds and, if no agreement is reached, cancel the service.

Pending legal review: To be confirmed by legal counsel: each provider’s DPA, and that Google and Anthropic do not use data sent to their APIs to train models

09Security measuresLink to this section: Security measures

• Location: main database hosted in the European Union.
• Isolation between venues: every query is filtered by venue in the code and, on top of that, the database enforces it with row-level security (RLS), enabled and forced on every table holding venue data.
• Encryption: TLS-encrypted communications; encryption at rest provided by the database and storage providers.
• Access: passwordless sign-in (magic link or OAuth), revocable sessions, mandatory two-factor authentication for the superadmin, and least-privilege permissions checked on the server for every action.
• Secrets: keys and credentials kept out of the code.
• Traceability: an activity log of dashboard and superadmin actions.
• Rate limiting on sign-in and access codes; IP addresses are only used in hashed form.
• Backups: daily, kept for 30 days by the database provider Pending legal review: confirm.

Muvo reviews and updates these measures in line with the state of the art and the risks involved.

10Data subjects’ rightsLink to this section: Data subjects’ rights

If a data subject contacts Muvo to exercise their rights over data included in a venue’s content, Muvo will forward the request to the venue without undue delay and will not respond on its own unless the venue instructs it to.

Muvo will help the venue respond as far as possible. In most cases the venue can correct or delete the data itself, directly from the dashboard.

11Personal data breachesLink to this section: Personal data breaches

If Muvo becomes aware of a security breach affecting the venue’s data, it will notify the venue without undue delay, aiming to do so within 48 hours of becoming aware of it Pending legal review: confirm period, by email to the venue’s admins.

The notification will include, as far as is known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. Where not all the information is available at once, it will be provided in phases.

12International transfersLink to this section: International transfers

Where a sub-processor processes data outside the European Economic Area, Muvo will ensure the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework) or by the European Commission’s standard contractual clauses, with supplementary measures where necessary.

Pending legal review: To be completed by legal counsel: the specific safeguard applicable to each sub-processor outside the EEA

13End of processingLink to this section: End of processing

Before closing its venue, the venue can download its content from the dashboard. Once the venue is closed, Muvo deletes it and all its files after a 30-day grace period Pending legal review: confirm period, during which the venue can ask for it to be restored.

Backups containing that data are deleted when their retention cycle ends. Muvo will only keep data, locked, where the law requires it.

14Audits and informationLink to this section: Audits and information

Muvo will make available to the venue the information needed to demonstrate compliance with this agreement, and will allow for and contribute to audits and inspections carried out by the venue or an auditor it appoints, with reasonable notice, during business hours, without access to other venues’ data and subject to confidentiality.

Pending legal review: To be completed by legal counsel: maximum frequency, allocation of costs and whether provider certifications can be relied on instead

15Liability and governing lawLink to this section: Liability and governing law

Each party is liable for its own breaches of data protection law under Article 82 GDPR. If Muvo uses the data for its own purposes or breaches this agreement, it will be considered a controller in respect of that processing.

This agreement is governed by Spanish law and the GDPR, with the jurisdiction set out in the terms of use for venues.

Pending legal review: To be confirmed by legal counsel: how this agreement interacts with the liability cap in the terms of use