Sub-processors

This is the complete list of third parties that process personal data on our behalf, published under Art. 28(2) GDPR. It is also the notification mechanism our Data Processing Agreement points at: when we add a processor we publish it here before it starts processing, and a customer may object. Every entry names what the provider actually receives. "Everything" means everything, and we say so where it is true rather than writing "infrastructure services". Subscribe to changes, or object to one, at [email protected].

Where the platform runs and where the data lives.

This is the section that matters most, because it is where the widest range of data leaves our infrastructure. None of these providers may use our data to train their models; that is contractual, not a hope.

Used where a customer runs outbound or inbound calls through the platform.

Only where a user connects the channel.

Connected by the customer, using the customer's own credentials.

Connected by the carrier. These are the sources of vehicle positions and of driver records including tachograph hours — see the notice for drivers and contacts.

Two things that most platforms buy as a service, we run ourselves — and it is a privacy advantage, not only a cost one: • Address search and geocoding runs on our own Photon instance. When you type an address into TOVR, that address is not sent to Google, HERE or Mapbox. • Route calculation and distances run on our own Valhalla instance. Origins, destinations and route geometry are not sent to a routing provider. Both are built from OpenStreetMap data — see Attributions. Transporeon/Trimble appears in section 7 as a geocoding FALLBACK only, used when our own lookup cannot resolve an address.

We publish a new processor here before it starts processing personal data. Customers under a DPA may object, and we will either address the objection or allow the customer to terminate the affected part of the service. The date at the top of this page is the date of the current list.