Sub-Processors
This page lists the third-party sub-processors that may process Customer Personal Data on behalf of HQ Parts UK Ltd (trading as Vectro) in connection with the Service. It supports our Data Processing Agreement. We notify subscribers by email or in-app notice at least 30 days before adding a new sub-processor.
Active Sub-Processors
| Provider | Service | Categories of Data | Location | Transfer Mechanism |
|---|---|---|---|---|
| Railway Corp. | Application hosting and managed PostgreSQL database | All Customer Personal Data stored in the application database (account data, customer data, quotes, orders, attachments stored as BLOBs, authentication tokens, usage logs) | EU West (Amsterdam) | Within UK / EEA — adequacy |
| Cloudflare, Inc. | R2 object storage — encrypted database backups (30-day rolling retention) and storage of file attachments uploaded for manufacturer production orders | Database backups (full snapshot of personal data); manufacturer order files (technical drawings, plans, photos relating to orders) | EU West | Within UK / EEA — adequacy. Where Cloudflare's corporate access requires US transfers, UK IDTA / SCCs apply. |
| Stripe Payments UK, Ltd. / Stripe, Inc. | Subscription billing and payment processing | Customer billing contact details, payment method details (handled directly by Stripe — Vectro does not store full card numbers) | UK / United States | UK adequacy (UK entity); UK IDTA for transfers to Stripe Inc. (US) |
| Resend (Resend, Inc.) | Transactional email delivery (quotes to end customers, appointment reminders, supplier order emails, account notifications) | Recipient name and email address; subject and body of the message; any file attachments (such as quote PDFs or order attachments) | United States | UK IDTA / SCCs; encryption in transit |
| Google LLC (optional, only if you connect) | Google Calendar API for two-way appointment synchronisation; Google OAuth for sign-in | Calendar event details that Vectro creates on the Customer's connected Google Calendar (date, time, customer name, location); OAuth tokens; basic Google profile (email, name) of the connecting user | United States | UK IDTA / SCCs; Google's Limited Use requirements |
How to be notified of changes
By using the Service, you are subscribed to sub-processor change notifications, which we send to the email address registered to your account. You may also revisit this page at any time to see the current list. The "Last updated" date reflects the most recent change.
Objections
If you object to a new sub-processor on reasonable data-protection grounds, please contact us at support@vectro.uk within 30 days of the notice. We will work in good faith to address your concern. If we cannot reach a resolution and the new sub-processor is essential to the Service, you may terminate the affected portion of the Service in accordance with clause 6.2 of the DPA.