Legal
Data Processing Agreement
Last updated 12 October 2026.
This document is being finalised with legal counsel and may change. Where it differs from your signed order form or agreement, the signed document applies. Questions: contact us.
When your business uses VROOM, you decide what personal data goes into it — customers, drivers, employees, investors — and why. For that data you are the controller and VROOM acts as your processor. The full Data Processing Agreement is provided with your order form; this page summarises its commitments.
What we commit to
- Process your data only to provide and support the service, and on your documented instructions.
- Keep it confidential, and make sure people with access are bound to confidentiality.
- Protect it with appropriate technical and organisational measures, including role-based access, logging of document downloads and exports, and private storage of uploaded files.
- Use sub-processors (for example hosting, e-mail delivery and, where you enable them, messaging or AI providers) only under written terms, and tell you who they are.
- Help you respond to requests from individuals exercising their rights.
- Tell you without undue delay if we become aware of a personal data breach affecting your data.
- Return or delete your data at the end of the service, as set out in your agreement.
Integrations you enable
Some features send data to third parties that you choose to connect, such as Meta for WhatsApp, Pilot GPS, an AI provider, or authority systems once access is issued. Those providers process data under their own terms with your business.
Requesting the DPA
To review or sign the full agreement, contact us.