Data processing agreement

Roles

For query content you submit, you are the controller and ApiNavi B.V. is the processor. This DPA is incorporated into the terms of service and needs no separate signature, though a signed copy is available for procurement.

Scope and instructions

We process query content solely to return the requested response and to maintain the service. Any other processing requires your documented instruction.

Categories: coordinates, addresses, place identifiers and, where you send them, asset identifiers. Data subjects: your end users, drivers and staff.

Security measures

TLS 1.3 in transit, AES-256 at rest, key-scoped access, least-privilege internal access with quarterly review, encrypted backups, and infrastructure changes through peer-reviewed code.

Personnel with production access are subject to background checks and annual security training. Breach notification to you within 48 hours of becoming aware.

Subprocessors

The current list is published on the subprocessors page. We give 30 days' notice before adding one, and you may object in that window and terminate without penalty if the objection cannot be resolved.

Transfers

Transfers outside the EEA rely on the European Commission's standard contractual clauses, with a transfer impact assessment available on request. EU-pinned accounts have no routine transfer.

Audit and deletion

You may request our most recent penetration test summary and security documentation once a year; on-site audit is available to Enterprise customers with 30 days' notice.

The audit right runs one way only. You may inspect us; the terms of service give us no right to inspect you, your records or your premises, and our own meter is the record of what you owe.

On termination, query content is already non-retained; account data is deleted within 90 days except where retention is legally required.