GDPR & Data Protection

GeoJibe is committed to protecting personal data and supporting customers in meeting their obligations under the European Union General Data Protection Regulation (“GDPR”) and other applicable data protection laws.

This page explains how GDPR principles apply to GeoJibe and the measures we take to support customers that process personal data using our services.

1. Our Role Under GDPR

GeoJibe's role under GDPR depends on the type of information being processed.

GeoJibe as a Data Controller

We generally act as a data controller for personal data that we collect and use for our own business purposes, such as:

• Account and contact information;
• Subscription and billing information;
• Communications with us;
• Website and application security information;
• Service usage and diagnostic information; and
• Information necessary to administer and support customer accounts.

Our processing of this information is described in our Privacy Policy.

GeoJibe as a Data Processor

When a customer uploads, imports, connects, transforms, synchronizes, or otherwise processes data through GeoJibe, the customer generally determines the purposes and means of that processing.

Where that Customer Data contains personal data, the customer is generally the data controller and GeoJibe acts as a data processor on the customer's behalf.

We process such data according to the customer's instructions and as necessary to provide the GeoJibe service.

2. Customer Responsibilities

Customers are responsible for determining whether the data they process through GeoJibe contains personal data and for ensuring that their use of GeoJibe complies with applicable data protection laws.

This includes, where applicable:

• Establishing a lawful basis for processing;
• Providing required privacy notices;
• Responding to data-subject requests;
• Obtaining consent where consent is required;
• Configuring appropriate access and security controls;
• Determining appropriate retention periods; and
• Ensuring that personal data is transferred only to authorized destinations.

GeoJibe provides technical tools for processing data but does not determine the customer's purpose for processing Customer Data.

3. GDPR Principles

We seek to operate GeoJibe consistently with the core data protection principles established by GDPR.

These include:

Lawfulness, fairness, and transparency. Personal data should be processed lawfully, fairly, and transparently.

Purpose limitation. Personal data should be collected and processed for specified and legitimate purposes.

Data minimization. Processing should be limited to personal data reasonably necessary for the intended purpose.

Accuracy. Reasonable steps should be taken to ensure that personal data is accurate where accuracy is relevant to its use.

Storage limitation. Personal data should not be retained longer than reasonably necessary.

Integrity and confidentiality. Appropriate technical and organizational measures should be used to protect personal data.

Accountability. Organizations processing personal data are responsible for demonstrating compliance with applicable data protection requirements.

4. Lawful Bases for Processing

Where GeoJibe acts as a controller, we process personal data only where we have an appropriate legal basis.

Depending on the circumstances, this may include:

• Performance of a contract;
• Our legitimate interests in operating, securing, supporting, and improving GeoJibe;
• Compliance with legal obligations; or
• Consent, where consent is required.

Where GeoJibe acts as a processor, the customer is responsible for determining the lawful basis for processing Customer Data.

5. Data Processing Agreement

Customers subject to GDPR may request a Data Processing Agreement (“DPA”) covering GeoJibe's processing of personal data on their behalf.

Our DPA addresses matters required by Article 28 of GDPR, including:

• Processing only on documented instructions;
• Confidentiality obligations;
• Security measures;
• Use of subprocessors;
• Assistance with data-subject requests;
• Assistance with certain security and compliance obligations;
• Return or deletion of personal data following termination, subject to applicable retention requirements; and
• Information reasonably necessary to demonstrate compliance with applicable processor obligations.

To request a DPA, contact us at [PRIVACY/LEGAL EMAIL].

6. Subprocessors

GeoJibe may use third-party service providers to help operate the Service. Where these providers process personal data contained in Customer Data on our behalf, they may act as subprocessors.

Depending on the GeoJibe service and deployment, subprocessors may provide services such as:

• Hosting and infrastructure;
• Email delivery;
• Payment processing;
• Monitoring and error reporting;
• Customer support; and
• Artificial intelligence functionality.

We require subprocessors that process Customer Data to provide appropriate data protection and security commitments.

A current list of applicable subprocessors may be made available at [SUBPROCESSOR PAGE URL] or upon request.

7. International Data Transfers

GeoJibe and its subprocessors may process personal data in countries outside the European Economic Area (“EEA”), United Kingdom, or Switzerland.

Where applicable law requires safeguards for an international transfer, we use an appropriate transfer mechanism.

Depending on the circumstances, this may include:

• An adequacy decision;
• The European Commission's Standard Contractual Clauses (“SCCs”);
• The UK International Data Transfer Addendum or other applicable UK transfer mechanism; or
• Another legally recognized transfer mechanism.

Where necessary, we may also implement supplementary technical or organizational safeguards appropriate to the circumstances.

8. Data Location

The location in which Customer Data is processed may depend on the GeoJibe service, hosting environment, and deployment selected by the customer.

Dedicated or on-site GeoJibe deployments may provide customers with additional control over where their data is hosted and processed.

Customers with specific data-residency requirements should contact us before processing regulated or location-restricted data through the Service.

9. Data Subject Rights

GDPR provides individuals with certain rights concerning their personal data, subject to applicable conditions and exceptions.

These may include the right to:

• Access personal data;
• Correct inaccurate personal data;
• Request deletion of personal data;
• Restrict certain processing;
• Object to certain processing;
• Receive certain personal data in a portable format;
• Withdraw consent where processing is based on consent; and
• Lodge a complaint with an appropriate supervisory authority.

Where GeoJibe acts as the controller, individuals may contact us directly to exercise applicable rights.

Where GeoJibe processes Customer Data as a processor, requests concerning that data should generally be directed to the GeoJibe customer that controls the data.

We will provide reasonable assistance to customers in responding to valid data-subject requests as required by applicable law and our DPA.

10. Data Deletion and Retention

GeoJibe retains personal data only for as long as reasonably necessary for the purposes for which it is processed, subject to contractual, operational, security, and legal requirements.

Customers may delete or replace data through available GeoJibe functionality where supported.

Temporary files and intermediate processing artifacts may be automatically removed according to our operational retention practices.

Following termination of a service, Customer Data will be deleted or returned in accordance with the applicable agreement and our retention procedures, except where continued retention is required by law or reasonably necessary for security, fraud prevention, dispute resolution, or other legitimate purposes permitted by applicable law.

11. Security

We use appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

Measures may include, as appropriate:

• Access controls;
• Authentication mechanisms;
• Encryption in transit;
• Protection of stored credentials;
• Network and infrastructure security;
• Logging and monitoring;
• Security updates and vulnerability management;
• Isolation of data-processing workloads; and
• Backup and recovery procedures.

Security measures may vary depending on the GeoJibe product, deployment model, and customer configuration.

Customers are responsible for appropriately securing their own accounts, credentials, connected systems, and destinations.

12. Personal Data Breaches

If we become aware of a personal data breach affecting Customer Data for which GeoJibe acts as a processor, we will notify the affected customer without undue delay as required by applicable law and our DPA.

We will provide information reasonably available to us to assist the customer in meeting applicable breach-notification obligations.

Customers remain responsible for determining whether notification to supervisory authorities or affected individuals is required when they act as the data controller.

13. Privacy by Design and Data Minimization

GeoJibe is designed as a data-processing platform, and customers control the data sources, transformations, and destinations they configure.

We encourage customers to process only the data necessary for their intended purpose and to avoid transferring unnecessary personal or sensitive information.

Where practical, we design features to limit unnecessary access to Customer Data and separate temporary processing from persistent application data.

14. AI-Assisted Features

Some GeoJibe features may use artificial intelligence services to assist users in generating transformations, configurations, expressions, or job instructions.

Where an AI provider processes personal data on our behalf in connection with Customer Data, applicable processor and subprocessor requirements will apply.

Customers should avoid submitting personal data to AI-assisted features unless that data is necessary for the intended operation and the customer has an appropriate legal basis for doing so.

GeoJibe may design AI-assisted workflows so that generated instructions can subsequently be executed deterministically without repeatedly submitting Customer Data to an AI service.

15. Sensitive and Special Category Data

GeoJibe is a general-purpose geospatial data-processing service and is not specifically designed for processing special categories of personal data under Article 9 of GDPR.

Customers intending to process health information, biometric information, precise information revealing protected characteristics, or other particularly sensitive personal data should evaluate whether GeoJibe's applicable deployment, contractual terms, and security measures are appropriate for their requirements before doing so.

16. Dedicated and On-Site Deployments

GeoJibe may be available in shared, dedicated, and customer-controlled deployment models.

Dedicated or on-site deployments may provide additional control over:

• Infrastructure;
• Data location;
• Network access;
• Data retention;
• Connected systems; and
• Security configuration.

For customer-operated on-site deployments, the customer may be responsible for many infrastructure, security, backup, retention, and data-protection measures that would otherwise be handled by the hosted service.

The applicable agreement will determine the respective responsibilities of GeoJibe and the customer.

17. Supervisory Authorities

Individuals located in the EEA have the right to lodge a complaint with the data protection supervisory authority responsible for their country or region if they believe their personal data has been processed in violation of GDPR.

We encourage individuals to contact us first so that we have an opportunity to address their concerns.

18. Contact Us

For questions about GDPR, our data protection practices, a Data Processing Agreement, or a data-subject request, contact: