Data processing agreement
Last updated: 14 November 2026
This data processing agreement (“DPA”) applies when you (“Customer”) send personal data to the OpenGeocoding API and OpenGeocoding (CVR 41697385), Geislersgade 14, 4., 2300 Copenhagen S, Denmark (“we”, “us”, “Processor”) processes it on your behalf. It is part of the Terms of service. Our Privacy policy asks you to have it in place before you submit personal data: to do that, email support@opengeocoding.com from your account’s address and say you accept it. It applies from the day we confirm by email. We can also send a signed copy.
It covers only personal data in the queries you send to the API, for example an address that identifies a person, or the IP address of a visitor whose browser calls the API with your browser key. Data about you and your team (account, billing, sign-in) is ours as controller, as the Privacy policy describes. If you run the open-source geocoder yourself, none of your data comes to us and this DPA does not apply.
1. Standard contractual clauses
The parties agree to the controller-to-processor Standard Contractual Clauses of the European Commission, Implementing Decision (EU) 2021/915 (clauses 1 to 10 and Annexes I to IV), which are incorporated into this DPA by reference. You are the controller, or a processor for your own customer, and we are your processor, or your sub-processor. The choices the clauses leave open are:
- Clause 7.7(a), sub-processors: option 2, general written authorisation, with the notice period in section 4.
- Clause 9.2, breaches: we tell you without undue delay and within 48 hours of becoming aware.
- Clause 7.6, audits: we answer a reasonable security questionnaire at most once a year. You can audit us on 30 days’ notice, during working hours and without disrupting service, at your own cost unless the audit finds a material breach by us.
- Clause 7.8, transfers: the sub-processors in section 4 outside the EU and EEA are covered by the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795), under which they are certified. We transfer Customer data outside the EU and EEA only to a sub-processor, and only on such a safeguard.
- Annexes I to IV: sections 2 to 4 below. Annex I’s controller is you, as named on your account.
If this page conflicts with the clauses, the clauses prevail. If it conflicts with the Terms of service on personal data, this DPA prevails. Each party’s liability is subject to the limits in the Terms of service, except where the law does not allow them, including liability to data subjects under Article 82 GDPR. Danish law governs, and Danish courts have jurisdiction, without limiting the rights of data subjects or the powers of any supervisory authority.
2. Description of the processing (Annex II)
| Item | Detail |
|---|---|
| Purpose | Answering your geocoding requests (search, autocomplete, retrieve, reverse and regions), and enforcing rate limits and credit balances. |
| Data subjects | People whose address or location appears in your queries, and visitors whose browsers call the API with your browser key. |
| Personal data | Address text and coordinates in your queries, including GET URL parameters; the API key you authenticate with; for browser-key calls, the visitor’s IP address and the Origin of the page. |
| Special data | None intended. Do not send special categories of personal data (Article 9) or data about criminal convictions (Article 10). |
| Nature | Receiving the query, forwarding it to the geocoder, returning the reply and counting the call. Query addresses and coordinates are not stored with your account or written to our logs, and replies are marked not to be cached. |
| What we do keep | Counts of calls per key, operation and day; counts of rejected calls per key, reason and day, with the refused origin for browser keys; and, for authentication lockouts, keyed hashes of network identifiers for up to 15 minutes. None contains the query. Retention is in the Privacy policy. |
| Duration | While you use the API. Because we keep no query data, nothing needs returning or deleting when you stop, apart from the account records the Privacy policy describes. |
3. Security measures (Annex III)
- API keys are stored only as SHA-256 hashes, and network identifiers only as keyed hashes.
- Our servers keep no access logs, and we never log query strings, addresses or API keys. Error reports exclude request bodies and query parameters.
- To keep queries out of any URL, send them in POST bodies.
- Traffic is encrypted in transit. Production runs in Hetzner’s Helsinki data centre, and only the people who run the service have access to it.
- Backups are kept for 15 days and stored in Cloudflare R2.
- The code that handles your queries is open source in our repository, so you can inspect it.
We may update these measures if the level of protection does not fall.
4. Sub-processors (Annex IV)
| Sub-processor | Processing | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of servers and database | Helsinki, Finland |
| Cloudflare, Inc. | Proxy for API traffic, which carries each request, including GET URL parameters, to our servers; R2 storage for database backups | United States and global network; EU–US Data Privacy Framework |
| Functional Software, Inc. (Sentry) | Error reports from our services, which exclude request bodies and query parameters and are not meant to contain Customer data | EU (Germany) region; EU–US Data Privacy Framework |
Each is bound by a data processing agreement requiring protections equivalent to this DPA, and we stay responsible for their performance. We will list any new or replaced sub-processor on this page and email the account owner at least 30 days before it starts processing Customer data. If you object on reasonable data protection grounds within that time, we will work with you on an alternative; if we cannot find one, you can stop using the API and close your account before the change takes effect, and we will refund any prepaid amount for the period after.
Other providers in the Privacy policy (Brevo, Slack, Anthropic, Stripe, GitHub, Fastmail, Chatwoot) handle account, billing, support and security data, not the content of your queries.
5. Requests from data subjects
If someone asks us directly to exercise their rights over data we process for you, we refer them to you and email you within 5 working days. We cannot look up a person in query data, because we do not store it.
Contact
OpenGeocoding, CVR 41697385, Geislersgade 14, 4., 2300 Copenhagen S, Denmark, support@opengeocoding.com, +45 50 39 72 24