Sub-processor list

PUBLISHED AT WWW.CARCLOUDSOLUTIONS.COM/SUB-PROCESSORS | VERSION 1.1 | LAST UPDATED: 28 OCTOBER 2026

This list forms part of the CarCloud Terms of Service (www.carcloudsolutions.com/terms-of-service). It is referred to in Clauses 10.6 and 29.4 and in Schedule 1, which together form the data processing agreement with Business Subscribers. It should be read with the CarCloud Privacy Notice, the Cookie Policy, the Business Order Form and the Business Onboarding Steps (www.carcloudsolutions.com/business-onboarding-steps).

1. About this list

When a business customer (a Business Subscriber) uses the CarCloud Platform, it is the data controller for the personal data of its drivers and other users (Customer Data), and CarCloud Solutions Ltd is its data processor. CarCloud uses a small number of other companies to help provide the Platform. Where they process Customer Data on CarCloud’s behalf, they are sub-processors.

Under Terms of Service Clause 29.4, each Business Subscriber gives CarCloud a general authorisation to use sub-processors, provided that CarCloud:

keeps this list up to date and available;
puts a written contract in place with each sub-processor containing the same data protection obligations as Terms of Service Clause 29, including prompt notification of any personal data breach (UK GDPR Article 28(4));
remains responsible to the Business Subscriber for each sub-processor’s acts and omissions; and
gives Business Subscribers at least 30 days’ notice of any change (see section 4).

Section 3 lists other organisations that receive personal data in connection with CarCloud but are not sub-processors, with the reason in each case. The CarCloud Platform is hosted in the UK (Microsoft Azure, UK South region). Organisations that receive only anonymised and aggregated data (Usage Analytics, Terms of Service Clause 9.3) are not sub-processors and are not listed, because anonymised data is not personal data. Any provider that processes personal data to help CarCloud anonymise it, or to provide artificial intelligence features, is listed in section 2.

2. Current sub-processors

Sub-processor	Service provided	Customer Data processed	Location of processing	Transfer safeguard (if outside the UK)	Status	Since
Microsoft Limited (Microsoft Azure)	Cloud hosting, database, file storage and message queues for the CarCloud Platform	All Customer Data held on the Platform	Data at rest in the United Kingdom (Azure UK South). Microsoft engineering, support and security personnel access it remotely from outside the UK, including from the United States	2021 EU Standard Contractual Clauses, with the UK International Data Transfer Addendum (UK Addendum) for transfers from the UK. Microsoft is also certified to the UK Extension to the EU-US Data Privacy Framework. (Microsoft Products and Services Data Protection Addendum, 22 May 2026.) Access is restricted by role, carried out from secure admin workstations and logged	Live	January 2026
DragonflyDB Ltd (Dragonfly Cloud)	Managed in-memory data store (cache) for the CarCloud Platform, used for sessions, sign-in tokens and cached look-ups	Session data and sign-in tokens for Admins, drivers and other Users; cached look-ups; the email addresses that link Platform users to their CRM records	United Kingdom (Microsoft Azure, UK South)	Not applicable. Dragonfly’s data processing addendum limits processing to the UK, the EU/EEA and Switzerland, and incorporates the UK Addendum to the EU Standard Contractual Clauses for any transfer (DragonflyDB Data Processing Addendum)	Live	July 2026
ONO App Ltd (ONO.app)	Incident and claims tracking software, supplied under the CarCloud brand as Claims & Incidents Tracking	Driver and vehicle details; incident records, including photos, locations and details of third parties, passengers and witnesses; health information, where recorded	United Kingdom (primary hosting). Some of ONO’s own sub-processors process data in the USA, New Zealand and Pakistan	New Zealand: UK adequacy regulations. USA: UK Extension to the EU-US Data Privacy Framework where the provider is certified, otherwise the UK Addendum or IDTA. Pakistan: IDTA or UK Addendum with a transfer risk assessment. All under ONO’s data processing agreement with CarCloud	Coming soon	Not yet in use
One Auto API Limited	Vehicle valuations and outstanding finance data (trade and private-sale valuations, and finance agreements registered against a vehicle)	Registration marks of company-owned vehicles on a Business Subscriber’s account (never grey fleet vehicles), and the valuation and finance data returned against them. One Auto is also used for vehicles in personal accounts, where CarCloud is the controller.	United Kingdom	Not applicable	Live	January 2026
HubSpot UK Holdings Limited (data processed by HubSpot, Inc.)	Transactional email — driver and admin invitations, email verification and service notifications, sent in the Business Subscriber’s name. Also CarCloud’s CRM and support desk.	Driver and admin names, email addresses, company association and message content	European Union (Germany), on HubSpot’s EU1 instance; support access from the United States	UK Extension to the EU-US Data Privacy Framework, under which HubSpot, Inc. self-certifies, with the UK Addendum (International Data Transfer Addendum) to the EU Standard Contractual Clauses as a fallback (HubSpot Data Processing Agreement)	Live	January 2026
Google Cloud EMEA Limited — Firebase Cloud Messaging	Push notifications to the CarCloud companion app	Device identifiers and push notification tokens	Google’s global network — Cloud Messaging has no regional data residency	Google Cloud Data Processing Addendum, which incorporates the UK Addendum to the EU Standard Contractual Clauses. Google LLC is also certified under the UK Extension to the EU-US Data Privacy Framework.	Coming soon	Not yet in use
Sentry (Functional Software, Inc.)	Application error and crash monitoring across the web app, the companion app and all backend services	Error reports, which can include user identifiers, request context and data in flight at the time of an error	United States	UK Extension to the EU-US Data Privacy Framework, under which Functional Software, Inc. self-certifies, with the UK Addendum to the EU Standard Contractual Clauses as a fallback (Sentry Data Processing Addendum)	Live	January 2026
Cloudflare, Inc.	Content delivery, security and bot protection for the CarCloud Platform	IP addresses, request data and security signals for all traffic to the Platform	Cloudflare’s global network, including the United States	UK Extension to the EU-US Data Privacy Framework, under which Cloudflare, Inc. self-certifies, with the UK Addendum to the EU Standard Contractual Clauses as a fallback (Cloudflare Data Processing Addendum)	Live	January 2026
PostHog, Inc.	Product analytics and session recording showing how the Platform is used, only with the user’s consent given at login. Sensitive fields are masked in session recordings	Usage and technical data for Platform users, tied to a persistent identifier	European Union data region; support access from the United States	UK Extension to the EU-US Data Privacy Framework, under which PostHog, Inc. self-certifies, with the UK Addendum (International Data Transfer Addendum) to the EU Standard Contractual Clauses as a fallback (PostHog Data Processing Agreement)	Live	April 2026
Automotive Software Solutions Ltd	Driving licence checks with the DVLA, and vehicle data services: vehicle lookup by registration, key dates (MOT and tax), road tax, service/maintenance/repair forecasting and fuel costs	Driver name, date of birth, licence number, DVLA check results (including criminal offence data) and DVLA consent records; vehicle registration marks and the vehicle data returned against them. Fuel-cost and maintenance forecasts are provided only for company-owned vehicles and personal accounts, never for grey fleet vehicles on a business account	United Kingdom	Not applicable	Live (vehicle data); licence checks coming soon	January 2026
Zitadel, Inc. (Zitadel Cloud)	Authentication and identity management for the CarCloud Platform	Login credentials, user identifiers and session data for Admins, drivers and other Users	European Union (Germany), on Zitadel Cloud’s EU region	Not applicable. The EEA is covered by UK adequacy regulations (Zitadel Data Processing Agreement)	Coming soon	Not yet in use

3. Other organisations that are not sub-processors

These organisations receive personal data in connection with CarCloud, but they do not process Customer Data on CarCloud’s behalf, so they are not sub-processors. They are listed here for transparency, and they are also described in the CarCloud Privacy Notice.

Organisation	Role	Data involved	Why it is not a sub-processor
Stripe	Card payments for CarCloud subscriptions	Billing contact details and card details (collected directly by Stripe)	Processes CarCloud’s own billing data. CarCloud is the controller of that data, and Stripe is a separate controller for some purposes, such as fraud prevention (stripe.com/privacy).
CookieYes	Cookie consent banner and consent record-keeping on the CarCloud website	Website visitors’ consent choices and a consent identifier	Used for CarCloud’s own website, as controller, to record and manage visitors’ cookie choices (see the Cookie Policy).
Google (Google Analytics)	Website analytics, with consent	Website usage data	Used for CarCloud’s own website, as controller (see the Cookie Policy).
ComplianceTrak Ltd (company number 11095036; registered office 14 Wistanes Green, Wessington, Alfreton, Derbyshire, DE55 6JN; FCA Firm Reference Number 914597; www.compliancetrak.io)	CarCloud’s FCA principal firm	Records of insurance and finance introductions, and related complaints	An independent controller for its own regulatory oversight.
Insurers, brokers and lenders	Insurance and finance introductions; receiving incident details	Details the customer asks CarCloud to pass on	Independent controllers. Data is sent only when the customer or driver chooses.
DVLA	Source of driving licence and vehicle data	Licence and vehicle data	A public authority and independent controller. Licence checks are submitted to the DVLA through Automotive Software Solutions Ltd (section 2), with the driver’s consent.
Apple App Store and Google Play	Distribution of the CarCloud companion app	App download and store account data	Independent controllers under their own terms with the user.
Atlas Consolidated (UK) Ltd (company number 16197917; registered office 14 Queen Anne’s Gate, London, SW1H 9AA), UK subsidiary of Atlas Consolidated Pte. Ltd. (Singapore)	Payment card programme (coming soon), provided using its Hugo Hub product line	Card application and transaction data	Atlas Consolidated (UK) Ltd (which has applied to the FCA for authorisation as an electronic money institution) and the FCA-authorised third parties that provide the regulated card services are controllers of card data. CarCloud’s role, and whether Atlas Consolidated (UK) Ltd will also process card data on CarCloud’s behalf, for example to display it in the Platform, will be confirmed before the card launches. If it will, it will be added to section 2 with 30 days’ notice.
Telematics providers (coming soon)	Data imported through API connections	Vehicle location, journeys and driving events	Chosen and connected by the Business Subscriber, which has its own contract with them.

4. Changes to this list and how to object

CarCloud will give Business Subscribers at least 30 days’ notice before adding or replacing a sub-processor. Notice is sent by email to each Business Subscriber’s Admins (Account Admins and Fleet Admins) and by updating this page (Terms of Service Clauses 10.6 and 29.4(d)).

A Business Subscriber may object to a change within 14 days of the notice, on genuine data protection grounds, by emailing hello@carcloudsolutions.com. CarCloud will work with the Business Subscriber in good faith to find a solution.

If no solution is reached, the Business Subscriber may terminate its subscription by written notice before the change takes effect (Terms of Service Clause 29.4).

In an emergency, for example where a sub-processor must be replaced to protect the security of Customer Data, CarCloud may make a change with shorter notice and will tell Business Subscribers as soon as possible.

5. How CarCloud manages its sub-processors

Due diligence on each sub-processor’s security and data protection practices before it is appointed, and periodically afterwards.
A written contract containing the same obligations as Terms of Service Clause 29, including confidentiality, security, assistance with data subject requests, return or deletion of data, audit rights, and breach notification fast enough for CarCloud to notify Business Subscribers within 24 hours (Terms of Service Clause 10.5).
Processing in the UK wherever possible. Any transfer outside the UK is protected by UK adequacy regulations (including the UK-US data bridge for certified US companies), the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

6. Contact

Questions about this list, or to register for update notifications: hello@carcloudsolutions.com, or by post to CarCloud Solutions Ltd, Grosvenor House, 11 St Pauls Square, Birmingham, B3 1RB.

Version history

Version	Date	Changes
1.0	5 October 2026	First published list.
1.1	28 October 2026	Added DragonflyDB Ltd (Dragonfly Cloud), in use since July 2026 but missing from version 1.0. Corrected a web address.