Data Processing Agreement.

§ 01Parties and scope

This Data Processing Agreement (“DPA”) is entered into between:

• the customer named in the Agreement (“Customer”, “you”), as controller; and
• Toursprung GmbH (“Maptoolkit”, “we”), Mariahilfer Straße 93/20, 1060 Vienna, Austria, FN 432876h, Commercial Court Vienna, as processor.

“Agreement” means our Terms of Service and any individual contract between you and us for the API Services. This DPA forms part of the Agreement; no separate signature is needed. It applies whenever we process personal data on your behalf. If you act as a processor for your own client, we act as your sub-processor and this DPA applies accordingly.

This DPA does not cover data we process as an independent controller – account administration, billing, aggregated usage statistics, security and abuse prevention, and legal compliance. That processing is described in our Privacy Policy.

If you have signed an individual data processing agreement with us, that agreement takes precedence over this DPA. If this DPA conflicts with the Agreement, this DPA prevails in matters of data protection. Terms such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meaning given in the GDPR.

§ 02What we process

Subject matter	Providing the API Services: maps and map styles, vector and raster tiles, static maps, routing, geocoding, elevation, weather, data enhancement and Maptoolkit Connectors
Nature and purpose	Receiving, answering and logging API requests; storing and serving geodata you upload; operating, securing and debugging the API Services
Categories of data subjects	End Users of your websites and applications; where applicable, persons named in geodata you upload
Categories of personal data	Request data: truncated IP address (last three digits set to 000), time, full URL including query parameters (for example search terms, addresses, coordinates), referer, origin, user agent, API key. Full IP address and HTTP data, transiently, at Cloudflare (if used). Geodata you upload (for example POIs and tours), to the extent it contains personal data
Special categories	None. You must not send special categories of personal data (Art. 9 GDPR) to the API Services
Duration	The term of the Agreement, plus the deletion periods in § 10

Details of our logs are in § 14 of our Privacy Policy.

§ 03Your instructions

We process personal data only on your documented instructions. The Agreement, this DPA and your configuration of the API Services are your complete instructions at the time of signing. Further instructions must be in writing (email is enough) and within the scope of the Agreement.

We do not process the data for our own purposes. If the law requires us to process data otherwise, we tell you before we do, unless the law forbids it.

If we believe an instruction infringes data protection law, we tell you without undue delay and may suspend it until you confirm or change it.

If an authority asks us to disclose your data, we refer it to you and inform you without undue delay, unless the law forbids it.

§ 04Confidentiality

Everyone who processes personal data on our behalf is bound to confidentiality by contract or by law. This obligation continues after they leave Maptoolkit.

§ 05Security

We implement the technical and organisational measures in Annex 1 (Art. 32 GDPR). We may update them as technology evolves, provided the overall level of protection does not decrease.

§ 06Personal data breaches

If we become aware of a personal data breach affecting your data, we notify you without undue delay. We tell you, as far as we know at the time, what happened, which data and roughly how many End Users are affected, the likely consequences and what we are doing about it, and send updates as we learn more.

We notify the contact you have given us in the admin backend, otherwise your account owner. Notifying you is not an admission of fault.

§ 07Helping you

Taking into account the nature of the processing, we help you to:

• answer data subject requests (Chapter III GDPR). If an End User contacts us about your application, we forward the request to you without undue delay and tell the End User we have done so. Because our logs contain only truncated IP addresses, we usually cannot identify an individual End User in them;
• meet your obligations under Art. 32 to 36 GDPR (security, breach notification, data protection impact assessments, prior consultation), by providing the information we have.

Where assistance requires significant effort, we may charge reasonable costs, which we agree with you in advance.

§ 08Sub-processors

You authorise us to use the sub-processors listed in Annex 2 and on our sub-processor page.

Changes. We announce any new or replaced sub-processor on the sub-processor page at least 30 days before it starts processing your data. Customers who subscribe to updates there are also notified by email.

Your right to object. You may object on reasonable data protection grounds within those 30 days. We will then try to find a solution with you, for example by not using the new sub-processor for your requests. If we cannot, either party may terminate the affected API Services with effect from the date of the change, and we refund any prepaid fees for the period after termination.

We bind every sub-processor by contract to data protection obligations equivalent to this DPA (Art. 28(4) GDPR). We remain responsible to you for our sub-processors’ compliance.

§ 09Where we process data

Our own infrastructure and our backups are in the EU (Germany, Finland, France).

Cloudflare sits in front of our API endpoints as CDN and DDoS protection, unless your contract excludes it. Cloudflare processes request data on its global network, which may include countries outside the EU/EEA. This transfer is covered by Cloudflare’s certification under the EU-US Data Privacy Framework and by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3: processor to processor) in our agreement with Cloudflare. All connections are TLS-encrypted.

We do not transfer your data outside the EU/EEA in any other way – including to you – without your prior written consent and appropriate safeguards (Art. 44 ff. GDPR).

§ 10Deletion and return

• Request logs are deleted automatically after 30 days, also after the Agreement ends; they are not returned.
• Backups are overwritten after at most 90 days.
• Geodata you upload is kept until you delete it or the Agreement ends. When it ends, we return it on request in a common format and then delete it, unless the law requires us to keep it. Copies in backups are overwritten as described above.

§ 11Audits

We make available the information you need to verify our compliance with this DPA, starting with this DPA, Annex 1 and our security information pack, which we send on request. Questions the pack leaves open can be sent to security@maptoolkit.com.

If that is not sufficient, you or an independent auditor bound to confidentiality may audit us. Audits must be announced at least 14 days in advance, take place during business hours, and must not unreasonably disrupt our operations. Audits of our sub-processors’ data centres are carried out through the reports and certifications those providers publish.

Audits are limited to once per year and are at your cost, except after a personal data breach affecting your data or where a supervisory authority requires an audit.

§ 12Liability

Liability under this DPA is governed by the Agreement, including its limitations, unless the GDPR requires otherwise (Art. 82 GDPR).

§ 13Term, law and jurisdiction

This DPA runs for as long as we process personal data on your behalf. §§ 10 and 11 survive termination.

Governing law and jurisdiction follow the Agreement.

§ 14Changes

We may update this DPA when the law, our services or our sub-processors change. We inform you by email at least 30 days before material changes take effect. If you object to a material change on reasonable data protection grounds and we cannot find a solution together, you may terminate the Agreement before the change takes effect; prepaid fees for the period after termination are refunded pro rata. Changes to sub-processors follow § 08.

§ 15Contact

Toursprung GmbH · Mariahilfer Straße 93/20, 1060 Vienna, Austria
Privacy: privacy@maptoolkit.com · Security: security@maptoolkit.com

Annex 1 · Technical and organisational measures

We may adapt these measures as technology evolves, provided the overall level of protection does not decrease (§ 05).

Confidentiality

• Production systems are hosted in EU data centres (Hetzner, Server4You), whose operators are responsible for physical security.
• Access to production systems is limited to a few administrators on a need-to-know basis and requires strong, key- or certificate-based authentication.
• Credentials are kept in an encrypted password manager.
• IP addresses are truncated before any log entry is written.

Integrity

• All traffic is encrypted in transit (TLS 1.2 or higher); maintenance access is encrypted.
• Code changes go through pull requests before release.
• Production and development environments are separated; customer data is not used for development.

Availability and resilience

• Components are deployed redundantly; firewalls and network policies restrict traffic.
• Backups are stored in separate data centres (Hetzner Object Storage, Finland; Server4You, France) and overwritten after at most 90 days.
• DDoS protection through Cloudflare (where used).

Organisation

• Confidentiality obligations for all staff; regular security reviews.
• Art. 28 agreements with all sub-processors.
• Privacy by default: no tracking, no profiling, no use of request data for AI training.

Annex 2 · Sub-processors

Our sub-processors are listed at /legal/subprocessors. That page, in its version current at any time, forms Annex 2. Changes follow § 08.