GDPR

The EU General Data Protection Regulation (GDPR) governs how personal data of people in the European Union is collected and processed. GeoMaps is built and operated from within the EU (Spain), and protecting your data — and the data of the people you map — is built into how the product works.

This page is a short, plain-English summary of how we approach the GDPR. The full detail lives in our Privacy Policy at https://geomaps.co/privacy, which is the authoritative document.

The GDPR splits responsibility between the data controller (who decides why and how data is processed) and the data processor (who processes it on the controller's instructions). With GeoMaps there are two distinct relationships:

• Your account data — your name, email and how you use the Service. Here GeoMaps is the controller, and we explain what we collect and why in the Privacy Policy.
• The data you import or connect about your own customers, leads and contacts ("Customer Data"). Here you are the controller and GeoMaps acts as your processor — we only process that data to provide the mapping service to you, on your instructions.

GeoMaps runs on Railway, a cloud platform, with the application and database hosted in the United States. We use a small set of carefully chosen subprocessors to run the Service — for example payments, email, map tiles and geocoding. The current list, what each one does and where it is located, is below:

We only share what each provider needs to perform its function, and we keep this list up to date as the Service evolves.

Because some of our infrastructure and subprocessors are located in the United States, personal data may be transferred outside the European Economic Area (EEA). Where that happens, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified — so the data keeps an equivalent level of protection.

If you are in the EU/EEA, you have the following rights over your personal data. Much of this you can do yourself directly in the app at any time; for anything else, just email us.

• Access — get a copy of the personal data we hold about you.
• Rectification — correct data that is wrong or incomplete.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a portable, machine-readable format.
• Objection — object to certain processing, including direct marketing.
• Withdraw consent — where we rely on consent, withdraw it at any time.

To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with your local data-protection authority, or with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), https://www.aepd.es — though we'd appreciate the chance to put things right first.

When you upload or connect data about your own customers, leads or contacts, you are the controller of that personal data and you are responsible for having a lawful basis to process it (such as consent or legitimate interest) and for giving those people any notices the law requires.

As your processor, we only handle that data to run the Service for you, we don't use it for our own purposes, and we hold it under the same safeguards described above. If you need a Data Processing Agreement (DPA) for your records, email [email protected] and we'll make one available.

We protect data with encryption in transit, hashed passwords, access controls and least-privilege practices. We keep personal data only for as long as we need it to provide the Service or to meet legal obligations, and you can export or delete your data — and close your account — at any time. The Privacy Policy describes our retention and security practices in full.

For any data-protection or GDPR question — including DPAs, subprocessors or exercising your rights — email [email protected]. For the complete detail, please read our Privacy Policy at https://geomaps.co/privacy.