VehtraVEHTRAInspections
Technician Login

Data Processing Agreement

Last updated 21 September 2026

1. Parties & how this applies

This Data Processing Agreement ("DPA") is made between:

  • EZDevelopments, the business name of Elliott Zac Broomhall, a sole trader of 8 Steele Avenue, Stoke-on-Trent, ST6 7ED, United Kingdom, ICO registration number ZB891515 ("we", "us", the "Processor"); and
  • the organisation that subscribes to the Vehtra platform ("you", the "Customer", the "Controller").

This DPA forms part of, and is governed by, the Vehtra Terms of Service. It applies automatically from the moment you begin using the platform, and it satisfies the requirement in Article 28(3) of the UK GDPR for a written contract between a controller and its processor. You do not need to sign a separate copy. If your organisation requires a countersigned version, contact us and we will provide one on request.

Where this DPA conflicts with the Terms of Service on the subject of data protection, this DPA takes precedence.

2. Definitions

"UK GDPR", "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given to them in the UK General Data Protection Regulation and the Data Protection Act 2018. "Customer Personal Data" means personal data contained in the content you put into the platform. "Sub-processor" means a third party engaged by us to process Customer Personal Data.

3. Roles of the parties

For Customer Personal Data, you are the controller and we are your processor. You decide why and how that data is processed; we process it only to provide the platform to you.

We are an independent controller for your account data, billing data and our own operational data such as request logs. That processing is described in our Privacy Policy and is outside the scope of this DPA.

4. Details of the processing

Subject matter. Provision of the Vehtra platform to you.

Duration. For as long as your subscription is in place, plus the retention period described in section 11.

Nature and purpose. Hosting, storage, organisation, retrieval, display and transmission of the records you create, so that you can record and evidence vehicle inspections and checks and, where applicable, share records with your own customers.

Types of personal data and categories of data subject. These differ by product and are set out in Annex A (Vehtra Inspections) and Annex B (Vehtra Walkarounds).

Special category data. The platform is not designed to hold special category personal data as defined in Article 9 UK GDPR, and you agree not to enter it.

5. Our obligations as processor

We will:

  • Process only on your instructions. Process Customer Personal Data only on your documented instructions, including in relation to transfers outside the UK, unless required to do otherwise by law — in which case we will tell you first, unless the law prohibits us from doing so. Your use of the platform, together with the Terms of Service and this DPA, constitutes your documented instructions. We will tell you if, in our opinion, an instruction infringes data protection law.
  • Keep it confidential. Ensure that anyone authorised to process Customer Personal Data is bound by an appropriate duty of confidentiality.
  • Keep it secure. Implement and maintain appropriate technical and organisational measures under Article 32 UK GDPR. The measures in force are described in Annex C.
  • Control sub-processors. Engage sub-processors only on the terms in section 7.
  • Help you answer data subjects. Taking account of the nature of the processing, assist you by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights. Where a data subject contacts us directly about your records, we will not respond substantively but will refer them to you and let you know.
  • Help you meet your own obligations. Assist you in complying with Articles 32 to 36 UK GDPR — security, breach notification, and data protection impact assessments — taking into account the nature of the processing and the information available to us.
  • Delete or return the data. At the end of the provision of services, delete or return Customer Personal Data as set out in section 11.
  • Demonstrate compliance. Make available to you the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits as set out in section 12.

6. Your obligations as controller

You are responsible for:

  • Having a lawful basis for the personal data you put into the platform, and for the processing you instruct us to carry out.
  • Telling the people whose data you enter — typically your drivers, technicians and customers — how their data is used, including that check and inspection records identify who carried out the work and when.
  • The accuracy of the data you enter, and for not entering personal data you have no right to enter.
  • Managing who in your organisation has an account, what role they hold, and removing access when someone leaves.

7. Sub-processors

You give us general authorisation to engage the sub-processors listed below. Each is bound by written terms imposing data protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.

  • Google Ireland Limited / Google LLC (Firebase) — authentication and identity. United States.
  • Brevo (Sendinblue SAS) — transactional email delivery. European Union.
  • Stripe, Inc. / Stripe Payments Europe Ltd — subscription payments. Stripe acts as an independent controller for card data. United States and Ireland.
  • Render Services, Inc. — application and database hosting. United States.
  • Vercel, Inc. — frontend hosting and content delivery. United States.

We will give you at least 30 days’ notice by email before adding or replacing a sub-processor. If you reasonably object on data protection grounds within that period, we will work with you in good faith to find an alternative; if we cannot, you may terminate your subscription without penalty and receive a pro-rata refund of any prepaid fees for the remainder of the period.

8. Security

We maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Those measures are set out in Annex C. We may update them, provided the level of protection is not reduced.

9. International transfers

Some sub-processors are located outside the United Kingdom. Where Customer Personal Data is transferred outside the UK, we rely on appropriate safeguards under Article 46 UK GDPR, including the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU-US Data Privacy Framework where the recipient is certified.

10. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, so far as we are able: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide all of that at once, we will provide it in phases without further undue delay.

Reporting a breach to the ICO, and notifying affected data subjects where required, is your responsibility as controller; we will provide reasonable assistance.

11. Return & deletion of data

On termination or expiry of your subscription you may, for a period of 30 days, request an export of your data. At your choice we will return it or delete it.

Unless you ask us to delete it sooner, we will delete Customer Personal Data within 90 days of the end of that export period, except where we are required by law to keep it, in which case we will keep it only for as long as the law requires and continue to protect it under this DPA.

Note that archiving a record within the platform hides it from everyday views but does not erase it. Deletion under this section means permanent removal of your organisation’s data from our systems. There is no self-service delete: we carry it out ourselves, on your written request by email to info@vehtra.co.uk, or on the timetable above. We will confirm by email once it is done.

12. Audits & information

On reasonable written request, and no more than once in any 12-month period unless required by a supervisory authority or following a personal data breach, we will provide the information reasonably necessary to demonstrate compliance with this DPA. Where that is not sufficient for your purposes, we will allow an audit by you or an independent auditor appointed by you, on at least 30 days’ notice, during business hours, subject to confidentiality, and conducted so as not to disrupt the service or the data of other customers. You bear the cost of the audit unless it reveals a material breach of this DPA.

13. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service. Nothing in this DPA limits any liability that cannot be limited under applicable law, including a data subject’s rights to compensation.

14. Changes to this agreement

We may update this DPA where needed to reflect a change in the law, in the platform, or in our sub-processors. Material changes will be notified by email with reasonable notice before they take effect.

15. Governing law

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

16. Contact

Data protection queries, sub-processor objections, audit requests, export requests and deletion requests should be sent by email to info@vehtra.co.uk. Email is the fastest route and the one we monitor; please use it in preference to post. Our address for service of documents is given in section 1.

Annex A — Vehtra Inspections

Categories of data subject: your employees and contractors who hold accounts (technicians, workshop staff, fleet managers); drivers and other individuals named in inspection records; your customers and their staff, including customer-portal users.

Types of personal data: names, email addresses, account identifiers, organisation membership and role; customer records you create, including contact details; vehicle registrations and details associated with an individual or business; photographs taken during inspections, which may show individuals or identifiable property; signatures captured on inspections; free-text repair and inspection notes, which may name individuals.

Processing operations: collection, storage, organisation, retrieval, display, generation of PDF reports, and transmission by email to recipients you designate.

Annex B — Vehtra Walkarounds

Categories of data subject: your employees and contractors who hold accounts, principally drivers recording daily checks, together with the managers and administrators who review them.

Types of personal data: names, email addresses, account identifiers, organisation membership, site membership and role; check activity records — which named user started and completed each walkaround check, against which vehicle, at which site, with the date and time of each; odometer readings; free-text defect and monitor notes, which may name or describe individuals; vehicle details including registration and chassis number; an activity log of actions taken in the platform, attributed to a named user.

A note on this data. Walkaround records show which member of your staff checked which vehicle and when. That is employee activity data. It exists because it is what a compliant check record requires, and it is yours — but you should make sure your staff know it is recorded and how you use it, particularly if you use it for any purpose beyond compliance.

Processing operations: collection, storage, organisation, retrieval, display, and reporting and aggregation for dashboards and defect reports.

Annex C — Security measures

The technical and organisational measures in place are:

  • Authentication. All access requires a verified identity issued by Google Firebase Authentication. Every request to the platform’s API is authenticated; there are no unauthenticated endpoints other than signed payment-provider webhooks.
  • Access control. Data is partitioned by organisation, and access within an organisation is governed by a role model (Owner, Admin, Member, Viewer) applied either organisation-wide or per site. Authorisation is enforced on the server for every request, not in the browser.
  • Encryption in transit. All traffic between users, the application and the database is encrypted using TLS.
  • Payment data. Card details are entered directly with Stripe and never reach our servers.
  • Audit logging. Significant actions are recorded to an activity log attributed to a named user with a timestamp.
  • Multi-factor authentication. Administrator access to every system named in section 7 — Render, Vercel, Firebase, Stripe and Brevo — requires multi-factor authentication, as do the email accounts used for account recovery.
  • Personnel. The business is operated by a single individual. Access to production systems is limited to that individual and is not shared.
  • Backups and recovery. The database is backed up continuously by our hosting provider, supporting point-in-time recovery to any moment within the preceding three days. Recovery restores to a separate instance, so a restore can be validated before it is relied on.
  • Sub-processor diligence. Infrastructure is provided by established vendors with their own recognised security programmes, as listed in section 7.

TO CONFIRM BEFORE PUBLISHING — add each of these only once it is true: encryption at rest for the database and its backups (not stated either way in the hosting provider’s backup documentation, so confirm before claiming); a documented restore test; retention of exports beyond the three-day recovery window; vulnerability scanning or penetration testing.