Data Processing Addendum
Last updated: August 2026
This Addendum applies when you use LOCATIONiQ to process personal data on behalf of your own organization or clients. It supplements our Terms of Service. If you require a countersigned copy, email support@locationiq.io.
1. Roles
For personal data you submit ("Customer Personal Data"), you are the data controller and LOCATIONiQ ([LEGAL ENTITY NAME]) is the data processor. We process Customer Personal Data only on your documented instructions — principally, to provide the Service — and as required by law.
2. Scope of processing
Subject matter: providing commercial real-estate site-selection analytics. Duration: the term of your subscription. Data subjects: your users and the broker/landlord/owner contacts you enter. Categories of data: names, business emails and phone numbers, and site/analysis records. We do not intentionally process special categories of data.
3. Confidentiality
Personnel authorized to process Customer Personal Data are bound by confidentiality obligations.
4. Security
We implement appropriate technical and organizational measures consistent with our security practices and the NY SHIELD Act — encryption in transit, authenticated and role-scoped access, tenant isolation, encrypted secrets, signed download URLs, and rate limiting.
5. Sub-processors
You authorize us to engage the sub-processors listed in our Privacy Policy (hosting, database, payments, email, storage, AI, and data APIs). We remain responsible for their performance and will impose data-protection obligations on them. We will give reasonable notice of new sub-processors.
6. Data subject requests & assistance
Taking into account the nature of processing, we will provide reasonable assistance to help you respond to data-subject requests and to meet your security, breach-notification, and impact-assessment obligations. Self-service export and deletion are available in Account settings.
7. Personal data breach
We will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, with the information reasonably available to help you meet your notification obligations.
8. International transfers
We process data in the United States. Where you transfer personal data of EU/UK/Swiss data subjects to us, the parties will rely on an appropriate transfer mechanism (e.g., the EU Standard Contractual Clauses), which are incorporated by reference where required.
9. Return & deletion
On termination, you may export Customer Personal Data before your account is deleted. After deletion, we remove Customer Personal Data from active systems, with backups rolling off on a standard schedule, except where retention is required by law.
10. Audits
On reasonable written request (no more than annually, subject to confidentiality), we will make available information necessary to demonstrate compliance with this Addendum.