Last updated: 23 October 2026 (Draft)
TUZO HQ LTD uses the providers below to run TUZO HQ. Each may handle personal data that driving schools hold in TUZO HQ, only to provide its service to us, under a written contract that protects that data. This list forms part of our Data Processing Agreement (Schedule 1 of our Terms and Conditions, paragraph A6.2). We will give at least 14 days' notice before adding or replacing a provider.
| Provider | What it does | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosts the application, database and server backups | All data held in TUZO HQ | [Germany or Finland: to be confirmed] | European Union, covered by UK adequacy regulations |
| Cloudflare, Inc. | Security, traffic filtering, content delivery, bot checks and encrypted backup storage | Visitors' IP addresses and requests; encrypted backup copies | Global network; backups stored in the EU | UK International Data Transfer Addendum or UK-US Data Bridge |
| Resend, Inc. | Sends emails from TUZO HQ and from schools | Names, email addresses, email content | United States | UK-US Data Bridge or UK International Data Transfer Addendum |
| The SMS Works Ltd | Sends text message reminders | Names, mobile numbers, message content | United Kingdom | Not needed |
| GoCardless Ltd | Collects TUZO HQ subscription payments by Direct Debit | Customer name, email and bank details | United Kingdom and European Union | Not needed |
| 650 Industries, Inc. (Expo) | Delivers notifications to the TUZO HQ phone apps | Device identifiers, notification text | United States | UK-US Data Bridge or UK International Data Transfer Addendum |
| Browser push services (Google, Apple, Mozilla) | Deliver notifications to web browsers | Notification identifiers, notification text | United States | The provider's own terms |
| Meta Platforms Ireland Ltd | Handles messages on a school's own WhatsApp, Messenger and Instagram accounts, only when the school connects them | Enquirers' names, account names, message content | Ireland and United States | Meta's terms with the school, including UK transfer clauses |
| Ideal Postcodes (postcodes.io) | Turns UK postcodes into map positions | Postcodes only | United Kingdom | Not needed |
Backups. Backup copies held by Hetzner and Cloudflare are encrypted before they leave our server and are not edited. We delete each one when it reaches the end of its life, which is up to 400 days after it was taken (daily copies after 35 days or less, monthly copies after up to 400 days). Our Privacy Policy and paragraph A11.3 of Schedule 1 to our Terms explain how erased people are erased again if a backup is ever restored.
Schools' own payment providers. A school can connect its own account with Stripe, SumUp, Square, PayPal or GoCardless to take payments from its learners. When it does, TUZO HQ sends the payment details needed (such as a learner's name, email address and the amount) to that provider on the school's instructions. The provider acts under its own agreement with the school, not as a sub-processor of TUZO HQ.
If you have a question about this list, email [email protected] or call, text or WhatsApp 07466 785266.