Menu
Fleet Safety Pricing Telemetry Hub Company Support
Sign In Launch App

Data Processing Agreement

Last updated: 30 October 2026.

This Data Processing Agreement ("DPA") forms part of the Terms of Service and Privacy Policy between BlackFortz Capital Ltd (trading as Vechtron), a company registered in England and Wales under company number 16153268, with registered office at Unit F Winston Business Park, Churchill Way, Chapeltown, Sheffield, S35 2PS ("Vechtron", "we", "processor") and the customer identified in the applicable order or self-serve signup ("Customer", "you", "controller").

This DPA is designed to meet Article 28 of the UK GDPR, Article 28 of the EU GDPR, and the Nigeria Data Protection Act 2023 (NDPA). By using the Service you accept this DPA; a counter-signed copy is available on request to privacy@vechtron.com.

1. Definitions

Capitalised terms not defined here have the meaning given in the UK GDPR / EU GDPR. "Service" means the Vechtron fleet-intelligence platform as defined in the Terms of Service. "Sub-processor" means any third party we engage to process Customer Personal Data on our behalf — the current list is at /sub-processors/ and is incorporated by reference.

2. Role of the parties

The Customer is the data controller of the personal data processed through its account ("Customer Personal Data"). Vechtron is the data processor acting on the Customer's documented instructions, which are the Terms of Service, this DPA, and in-app configuration choices.

3. Processing details (Annex I)

  • Subject matter. Provision of the Vechtron Service to the Customer.
  • Duration. The term of the Agreement + 30 days for deletion (longer where legally required — see § 10).
  • Nature and purpose. Fleet-intelligence SaaS: ingestion of vehicle telemetry, driver data and user accounts; delivery of dashboards, alerts, reports, mobile apps and an AI assistant.
  • Types of personal data.

- Account data: name, email, phone, password hash, role, organization membership.

- Driver data: name, phone, email, licence number (if provided), driver scorecards.

- Vehicle telemetry: GPS, speed, heading, ignition, engine diagnostics (CAN/OBD-II), fuel level, maintenance history, inspection records, iButton identifiers.

- Communications: in-app messages, AI-assistant chat, support tickets.

- Technical data: IP address, device identifiers, browser type, OS, usage events.

  • Categories of data subjects. Fleet operators, their drivers, their administrative users, and (incidentally) third parties captured by cameras or sensors if the Customer enables such features.
  • Special categories. None required for the Service. If the Customer chooses to upload sensitive data, the Customer warrants it has a lawful basis to do so and this DPA covers it.

4. Customer instructions

Vechtron processes Customer Personal Data only on documented Customer instructions, which are (a) this DPA, (b) the Terms of Service, (c) in-app configuration the Customer makes, and (d) any additional written instructions the Customer gives via privacy@vechtron.com. If an instruction appears to violate law, we will inform the Customer and may suspend processing of that instruction.

5. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by a written confidentiality obligation (employment contract or NDA). Access is role-restricted and audit-logged inside our platform.

6. Security measures (Annex II)

  • Encryption in transit — TLS 1.2+ on all public endpoints; HSTS enabled.
  • Encryption at rest — database volume encryption at the hypervisor level.
  • Access control — SSH key-only on all production servers (no passwords); role-based access with least-privilege; MFA required for all employee accounts on shared services.
  • Network isolation — production hosts behind firewall; database not publicly reachable; services communicate via internal docker network.
  • Secrets management — secrets in environment-scoped stores, never in source control; rotated on departure or incident.
  • Logging + monitoring — Prometheus + Grafana for metrics; application logs retained 12 months; audit log of admin actions available in-product to Customer admins.
  • Change management — every production change is a reviewed, signed git commit with CI tests; releases via tag + CI/CD; rollback supported.
  • Backups — nightly encrypted database backups to a geographically-separate location; retained 30 days; restoration tested quarterly.
  • Secure development — OWASP + CIS baseline configurations; dependency scans on every build; secret-scanning on every commit.
  • Incident response — see § 9. Breach-response runbook maintained.

7. Sub-processors

  • The current list is at /sub-processors/.
  • The Customer gives general authorisation for Vechtron to engage sub-processors subject to this DPA.
  • Vechtron gives 30 days' advance notice before adding, removing or materially changing a sub-processor, via the sub-processors page and an email to the Customer's designated data-protection contact.
  • The Customer may object to a new sub-processor within those 30 days on reasonable grounds. We will work with the Customer to find an alternative; if we can't, the Customer may terminate the affected portion of the Service per § 6 of the Terms of Service.
  • Every sub-processor is bound by substantially the same data-protection obligations as this DPA.

8. Data-subject rights

Vechtron will, taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures to respond to data-subject requests (access, rectification, erasure, restriction, portability, objection, automated-decision review). The Service provides in-product tooling for most of these (self-serve profile edit, data export, account deletion). Requests we cannot fulfil in-product are escalated to privacy@vechtron.com and processed within applicable statutory deadlines (30 days under GDPR / NDPA).

9. Personal-data breach notification

If Vechtron becomes aware of a personal-data breach affecting Customer Personal Data, we will notify the Customer without undue delay and in any case within 72 hours. The notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, measures taken, and the point of contact for further information. We will cooperate fully with the Customer's own regulatory notification obligations.

10. Deletion and return

On termination of the Agreement, Vechtron will, at the Customer's choice:

  • Delete all Customer Personal Data within 30 days of the written request, OR
  • Return it in a machine-readable format (JSON / CSV / PDF where applicable) within 30 days.

We retain copies solely where required by law — tax and invoice records for seven years under UK / Nigerian tax law — and security-audit logs for 12 months. Retained data is isolated, access-restricted and used only for the compliance purpose.

11. Audits

The Customer may audit Vechtron's compliance with this DPA no more than once in any 12-month period, with 30 days' advance notice, by:

1. Receiving our most recent summary of security controls (SOC-2-equivalent self-attestation while we work toward a formal SOC 2 Type II), AND

2. Submitting a written questionnaire that we will answer within 30 days.

Where that is insufficient and the Customer has reasonable grounds for a deeper assessment, we will arrange an on-site or remote audit by a mutually-agreed independent assessor at the Customer's cost. We will cooperate reasonably with regulator audits at no cost.

12. International transfers

  • EU/UK personal data remains in Germany (EU). Operational staff access from Nigeria is governed by Standard Contractual Clauses (SCCs — UK Addendum where applicable) and the NDPA.
  • Customer Personal Data may be transferred to sub-processors in jurisdictions listed on the sub-processors page. Each transfer is covered by SCCs or an adequacy decision (EU-US Data Privacy Framework for US sub-processors; NDPR adequacy for Nigeria where applicable).
  • The parties agree the UK IDTA (or SCCs with UK Addendum) applies by reference where this DPA governs a UK → non-adequate-country transfer. For EU → non-adequate-country transfers, the 2021 EU SCCs (Modules 2 and 3 as applicable) apply.

13. Liability

The limitations of liability in the Terms of Service apply to this DPA. Nothing in this DPA excludes either party's liability where it cannot be excluded by law.

14. Term and termination

This DPA takes effect when the Customer accepts the Terms of Service and continues for the term of the Agreement. On termination, the obligations in §§ 9, 10 and 12 survive.

15. Governing law

England and Wales, consistent with § 13 of the Terms of Service.

16. Contact

Data Protection Officer:

privacy@vechtron.com

BlackFortz Capital Ltd (trading as Vechtron)

Unit F Winston Business Park, Churchill Way, Chapeltown, Sheffield, S35 2PS, United Kingdom.

Company number: 16153268.

If you require a counter-signed PDF for your records, email the DPO with your legal entity name, trading name, VAT number (if any) and signatory details. We counter-sign within 5 business days.