Data processing agreement

Last updated 20 October 2026

This data processing agreement ("DPA") forms part of the terms of service for any customer ("Customer") who uses Maps by DeltaBreen in the course of a business on a site or application used by other people, and applies automatically from the moment the Customer does so. It is written to meet Article 28 of the GDPR. DeltaBreen Limited (the operator of Maps by DeltaBreen), a company registered in Ireland with company number 826627 and VAT number IE4835019QH, of Gorey, Co. Wexford, Ireland is the "Processor"; the Customer is the "Controller". Enterprise customers may sign a countersigned copy on request.

1. Subject matter, duration, nature and purpose

The Processor serves map tiles, fonts, sprites, styles, static map images, search, elevation and directions answers to the Controller's end users, and hosts the data layers and icons the Controller uploads. Processing consists of receiving token, tile, raster tile, static image, search, elevation and directions (route, distance table and travel-time area) requests from end users' browsers and apps, answering them, storing and serving the Controller's uploads, keeping counts of what end users do with the Controller's maps on plans with visitor stats, and holding the associated account, key, usage and audit records. Duration: the term of the Controller's account plus the retention periods in the privacy policy.

2. Data and data subjects

End-user data: IP addresses and user agents in transient request logs (at most 30 days), the origin of the page, the tile coordinates requested, and the text and position sent with a search or elevation request and the points of a directions request, including an end user's location when they choose to share it, none of which is stored; on plans with visitor stats, counts per map and day of views, places opened, buttons pressed and the towns picked in a search, which hold no address, typed text, IP address or cookie. Uploaded data: whatever the Controller puts in the data layers and icons it uploads. Account data: email addresses of the Controller's users, key names and origins, usage counts, style content, hashed IP addresses in the audit log. Data subjects: the Controller's staff and the end users of the Controller's site or application.

3. The Processor's obligations

• Process personal data only on the Controller's documented instructions, which are these terms and the use of the service, unless required by EU or Member State law, in which case the Processor informs the Controller first where allowed.
• Ensure everyone with access is bound by confidentiality.
• Apply the security measures in section 5.
• Engage sub-processors only as listed in section 6, under written terms no less protective than this DPA, and give 30 days' notice by email of a change so the Controller may object; if the Controller reasonably objects on data-protection grounds and we cannot resolve it, the Controller's sole remedy is to stop using the affected feature or terminate the affected service.
• Assist the Controller with data subject requests, security, breach notification and impact assessments, given the nature of the processing and the information available.
• At the Controller's choice, delete or return all personal data at the end of the service and delete existing copies, unless EU or Member State law requires storage; account deletion does this within 30 days.
• Make available the information needed to show compliance and allow audits, on reasonable notice, no more than once a year unless an authority requires otherwise, under confidentiality, at the Controller's cost, and without access to other customers' data or to our security secrets — a recognised third-party audit report satisfies this where one exists.

4. The Controller's obligations

The Controller warrants that it has a lawful basis for its end users' data reaching the Processor, that its privacy notice mentions the map provider, and that it configures keys and origins so only its own sites use them.

5. Security measures

• Transport encryption (TLS) on every connection; the token of every tile request that carries one (vector tiles and the raster tiles of our map plugins) is validated before a tile is served, by a web application firewall in front of the tile host or, where tiles are served straight from the Processor's tile server, by that server; and the Processor's servers check the key of every static image and key-based raster tile request.
• Secret keys stored as hashes; server secrets kept outside the database; production reachable only over a private network.
• No cookies or tracking on the tile host; no storage of tile requests; request logs retained at most 30 days.
• Administrative actions logged; per-tenant audit log; encrypted backups within the EU.

6. Sub-processors and international transfers

The Controller authorises the sub-processors below. Where a sub-processor processes personal data outside the EEA, the transfer relies on an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses with appropriate safeguards, as noted for each.

Contabo GmbH and BunnyWay d.o.o. were added on 13 October 2026. BunnyWay d.o.o. handles no data until we put it to use.

7. Breach notification

The Processor notifies the Controller without undue delay, and in any case within 48 hours, of becoming aware of a personal data breach affecting the Controller's data, with the information Article 33(3) requires as it becomes available.

8. Liability and law

Liability under this DPA is subject to the limits in the terms of service. It is governed by Irish law. Questions: [email protected].