Sub-processors
Last reviewed: June 2026
MATIC AUTOMOTIVE LIMITED (the data controller for the vehReports platform) engages the following sub-processors to deliver the service. Each entry sets out the purpose of the processing, what personal data is shared, where the processor is based and the contractual basis. We notify tenants of changes at least 30 days before a new sub-processor handles their data, in line with our standard DPA.
| Sub-processor | Purpose | Personal data shared | Region |
|---|---|---|---|
| Stripe Payments Europe Ltd | Card payments, recurring billing, invoices, Stripe Tax | Billing contact name, email, company, address; card metadata (last 4); transaction history | EU / UK / US (Stripe DPA) |
| Twilio Inc. | Transactional SMS for OTP + critical notifications | Mobile phone number, message body | EU / US |
| Mailgun Technologies Inc. | Transactional + product email delivery | Recipient email, name, message body | EU (eu.mailgun.net) / US fallback |
| DVLA (Vehicle Enquiry Service) | Vehicle registration data lookups by VRM | Vehicle registration number (no personal data of the lookup-requester) | UK |
| UK Vehicle Data Ltd | MOT history, vehicle history checks (stolen / finance / write-off / valuation) | Vehicle registration number | UK |
| LA5 Digital Automate | DVLA driver-licence share-code verification | Licence number, share code, driver date of birth, returned entitlements / endorsements | UK |
| Amazon Web Services EMEA SARL (AWS) | Application hosting, S3 object storage, CDN (London region) | All tenant data — encrypted at rest | UK (eu-west-2) |
| Cloudflare, Inc. | CDN, DDoS protection, edge TLS | IP addresses, request metadata | EU / global edge |
| Google LLC (Analytics 4) | Anonymised marketing-site analytics (only after explicit cookie consent) | Pseudonymous client ID, anonymised IP, page views | EU / US |
| Sentry (Functional Software Inc.) | Application error monitoring (server-side stack traces) | Error context — includes user ID and tenant ID; PII scrubbed before transmit | EU / US |
International transfers
Where a sub-processor transfers personal data outside the UK, the transfer is covered by either (a) a UK Adequacy decision, (b) the UK International Data Transfer Agreement, or (c) Standard Contractual Clauses with appropriate supplementary measures. We don't transfer data to jurisdictions without an appropriate safeguard.
Notification of changes
We notify the named DPO / billing contact on every paying tenant at least 30 days before adding a new sub-processor that will process their personal data. Tenants on the free tier can subscribe to change notifications by emailing [email protected].
Want a Data Processing Agreement?
Our DPA template is available at vehreports.com/legal/dpa. Paying tenants can also request a counter-signed copy from the billing area of their account.