Legal
Sub-Processors
Last updated:
VeloCMS (operated by Muharrem Ltd) uses the following third-party sub-processors to deliver its service. All sub-processors are bound by data processing agreements and appropriate safeguards under UK GDPR Article 28.
We will notify tenants at least 30 days before adding or removing a sub-processor. To object to a new sub-processor, contact [email protected].
Stripe
Stripe, Inc. / Stripe Payments Europe, Ltd.
- Jurisdiction
- USA / Ireland
- Transfer mechanism
- UK-US Data Bridge + SCCs
- Purpose of processing
- Payment processing, subscription management, invoicing
- Data categories
- ·Name
- ·Payment card data
- ·Billing address
- ·Subscription status
Resend
Resend Inc.
- Jurisdiction
- USA
- Transfer mechanism
- SCCs
- Purpose of processing
- Transactional email delivery (account notifications, export links, GDPR confirmations)
- Data categories
- ·Email address
- ·Email content
Cloudflare
Cloudflare, Inc.
- Jurisdiction
- USA
- Transfer mechanism
- UK-US Data Bridge
- Purpose of processing
- CDN, DDoS protection, DNS, SSL/TLS certificates for custom tenant domains
- Data categories
- ·IP addresses (ephemeral)
- ·Domain names
- ·SSL certificate metadata
Railway
Railway Corp.
- Jurisdiction
- USA
- Transfer mechanism
- SCCs
- Purpose of processing
- Cloud infrastructure — Next.js application server, PocketBase database hosting
- Data categories
- ·All data stored on the VeloCMS platform (infrastructure-level access only)
Sentry
Functional Software, Inc.
- Jurisdiction
- USA
- Transfer mechanism
- UK-US Data Bridge
- Purpose of processing
- Error tracking and performance monitoring
- Data categories
- ·Error stack traces
- ·Browser/device type
- ·Page URLs
- ·User ID (anonymised)
This list is maintained by Muharrem Ltd and updated when sub-processors are added, removed, or materially changed. Tenants who have signed a Data Processing Agreement (DPA) with VeloCMS will be notified by email of any changes.
Questions? [email protected]