Data Processing Agreement (UK GDPR Article 28)

Version 1.0 · Effective 11 October 2026

This agreement forms part of the 10mil Terms of Service. It applies whenever 10mil processes personal data on a workshop's behalf.

1. Parties and roles

The workshop using 10mil is the controller of the personal data of its customers, staff and enquirers.

10mil Technologies Ltd (company number 17241824, ICO registration ZC241695, 66 Paul Street, London, EC2A 4NA) is the workshop's processor.

For workshop account data (the owner's and staff sign-in details, billing and usage), 10mil is the controller — see our Privacy Policy.

2. Subject matter, duration, nature and purpose

Providing workshop management software: bookings, customers and vehicles, estimates, invoices, payments, reminders, the customer app, accounting sync and AI features. Processing lasts for the term of the workshop's subscription and the deletion period in section 4.

3. Types of data and data subjects

Names, contact details, addresses, vehicle registrations, VINs and vehicle history, job, estimate, invoice and payment records, messages, call recordings and transcripts (AI Receptionist), and documents uploaded.

Data subjects: the workshop's customers, staff and enquirers.

4. 10mil's obligations

  • Process personal data only on the workshop's documented instructions. Using the service as designed is the workshop's instruction.
  • Make sure everyone at 10mil who can access the data is bound by confidentiality.
  • Keep appropriate security: encryption in transit and at rest, access controls, row-level isolation between workshops, two-factor sign-in for platform admins, and audit logs.
  • Help the workshop answer data-subject requests and carry out data protection impact assessments.
  • Tell the workshop about a personal data breach without undue delay, and within 48 hours of becoming aware of it.
  • At the end of the service, delete or return the data: workshops can export their data and delete their account themselves. Backups expire within 30 days, unless the law requires us to keep something longer.
  • Make available the information needed to show we comply, and allow reasonable audits — once a year, with 30 days' notice.

5. Sub-processors

The workshop gives general authorisation for 10mil to use sub-processors. Each is bound by data protection terms at least as protective as this agreement. Current sub-processors:

ProviderPurposeLocation
Supabase Inc. (via Lovable Cloud)Database, sign-in, file storage and server functionsEU (Ireland)
Lovable Labs Inc.Website and app hosting, sending emails, AI gateway that forwards AI requestsEU / USA
Google (Gemini, via the Lovable AI gateway)AI features — vehicle and diagnostic context only, registrations and VINs maskedEU / USA
OpenAI (via the Lovable AI gateway)Some AI features — same masked vehicle/diagnostic contextUSA
Resend Inc.Sending some account and customer emailsUSA / EU
Stripe Payments Europe LtdSubscriptions, invoice card payments and payoutsEU / USA
Twilio Inc.AI Receptionist phone calls (when switched on)USA / EU
ElevenLabs Inc.AI Receptionist voice (when switched on)USA / EU
CheckCarDetails LtdVehicle and MOT lookups by registrationUK
HaynesPro / Infopro DigitalTechnical repair data looked up by registration or VINEU (Netherlands) / UK
Open Charge Map and OSRM routingCustomer app EV charger search and routes — approximate location onlyEU
Perplexity AI and FirecrawlWeb research for diagnostics — no personal data sentUSA
Xero LtdAccounting sync — only if the workshop connects it, on its instructionUK / USA / Australia
Intuit (QuickBooks)Accounting sync — only if the workshop connects it, on its instructionUSA

We give 30 days' notice of any new sub-processor by email and on this page. If the workshop objects, it can close its account before the change takes effect.

6. International transfers

Personal data is only transferred outside the UK where UK adequacy regulations apply or the UK International Data Transfer Agreement or Addendum is in place.

7. Liability, law and version

Liability is as set out in the Terms of Service. This agreement forms part of the Terms. It is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.

Version 1.0, 11 October 2026. Questions: privacy@10mil.co.uk.