Hovera as a processor
The data you enter into Hovera — about your clients, horses, staff and, in a transport company, drivers — is processed by us (Sendormeco Holding sp. z o.o.) as a processor, on your behalf and on your instructions. You remain the controller of that data. The full split of roles is in the privacy policy.
Data processing agreement (DPA)
The data processing agreement (Art. 28 GDPR) is part of the agreement to use Hovera. Full text: app.hovera.app/dpa.
Categories of entrusted data
- Stable clients: name, email, phone, address
- Operational data: rides, passes, livery, invoices
- Horse data: owner, documents, health history entered by the stable
- Transport company drivers: contact details, licences with expiry dates
- Location of the driver’s phone during a trip — only if the transport company enables trip tracking (below)
Trip tracking for carriers
A transport company can enable trip tracking. The driver app then records the phone’s location about every 15 minutes — only from “Start trip” to “Finish trip”, with a persistent notification on the phone. The company office sees the route; a customer who came through a Hovera inquiry sees only the last point, and only during the trip. Trails are deleted after 30 days. The transport company is the controller of this data and informs its drivers before enabling tracking.
Security measures
- Encryption in transit (TLS)
- A separate database for every customer
- Role-based access control, change log
- Daily backups stored outside the production server
- Availability monitoring
Sub-processors
- Hetzner Online GmbH (Germany) — hosting and backups
- PayU S.A. (Poland) — payments
- Revolut Bank UAB (Lithuania, EEA) — payments
- Mailgun Technologies, Inc. (EU servers) — transactional email
- SMSAPI / ComVision sp. z o.o. (Poland) — SMS
- HeiGIT gGmbH — OpenRouteService (Germany) and Mapbox, Inc. (USA, standard contractual clauses) — route calculation
- Google Ireland Ltd — Firebase Cloud Messaging — push notifications in the mobile app
We give 30 days’ notice of any change of sub-processors.
The full list of data recipients — including those where we are the controller ourselves: OpenStreetMap map tiles, Google Analytics statistics (only with consent) and Bunny Fonts typefaces — is in the privacy policy.
Return and deletion of data after the agreement ends
For 90 days after the agreement ends the data is kept and the Customer may export it themselves in the panel (CSV and ICS files and attachments in a ZIP archive). After that the data is deleted or returned to the Customer as controller at its choice (point 8 of the data processing agreement).
Your rights
You can download your company’s data yourself in the panel: Settings → Data export. The export creates a ZIP archive with CSV files (the contents of the company’s tables), summaries, a calendar in ICS format (stables) and attachments; it also works while the account is suspended for an unpaid invoice and when it is blocked for non-payment. Limits: 3 exports per day, a link valid for 24 hours, attachments up to 25 MB per file and 250 MB in total (Terms § 8(2)). In the case of administrative suspension and after the account is cancelled we supply the data on request sent to office@hovera.app. Send account deletion requests to the same address.
Contact
We have not appointed a data protection officer — we are not required to. For data matters write to office@hovera.app.