Data Processing Agreement

Pinglide · Version 1.3 · Effective 5 November 2026

This Data Processing Agreement ("DPA") is between the customer that accepts the Pinglide Terms of Service ("Customer") and Marius Zakarauskas, individual activity certificate No. 1554078, Debreceno g. 8-10, Klaipėda, Lithuania ("Provider"). It forms part of the Terms of Service at https://pinglide.com/terms ("Terms"), and sets out the terms required by Article 28(3) of the GDPR.

1. Formation and precedence

1.1 This DPA takes effect when Customer accepts the Terms, and applies whenever Provider processes Customer Personal Data. No separate signature is needed. A countersigned copy is available on request from privacy@pinglide.com; signing it does not change its terms.

1.2 On the processing of Customer Personal Data, this DPA prevails over the Terms. On everything else, the Terms prevail. Where the SCCs apply, they prevail over both.

1.3 Capitalised terms not defined in this DPA have the meaning given in the Terms. "Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR.

2. Definitions

• GDPR — Regulation (EU) 2016/679.
• Data Protection Law — the GDPR, the national rules implementing Directive 2002/58/EC (ePrivacy), and any other law on the protection of personal data that applies to the processing.
• Customer Personal Data — personal data contained in Customer Content or in Visitor Measurement Data, which Provider processes on Customer's behalf.
• Sub-processor — another processor that Provider engages to process Customer Personal Data.
• SCCs — the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.
• EEA — the European Economic Area.

3. Roles and scope

3.1 Customer is the controller of Customer Personal Data, and Provider is its processor. Where Customer acts as a processor for its own client, Provider is Customer's sub-processor, and Customer ensures that its client's instructions and authorisations are reflected in this DPA.

3.2 Annex I describes the processing.

3.3 This DPA does not cover personal data that Provider processes for its own purposes, as an independent controller: account holders' data, billing, support, security and fraud prevention, and compliance with Provider's legal obligations. That processing is described in the Privacy Policy at https://pinglide.com/privacy.

3.4 Anonymisation. Customer instructs Provider to anonymise and aggregate Customer Personal Data so that no person can be identified from it, and to use the result to operate, secure and improve the Service and to produce statistics (Terms §7.8). Once anonymised, that data is not personal data and is not covered by this DPA.

4. Customer's responsibilities

4.1 Customer is responsible for the lawfulness of the processing it instructs, including: having a legal basis for it; giving data subjects the information required by Articles 13 and 14 of the GDPR, including that Provider processes their data as Customer's processor; obtaining any consent required — including under the national rules implementing Article 5(3) of the ePrivacy Directive, before switching on visitor measurement; deciding whether to switch visitor measurement on; and the accuracy of Customer Content, including the position of every location, whether it was placed by Customer, by an import, by geocoding or by a sync from a linked Google Sheet (Terms §10.3 to §10.7).

4.2 Customer will not upload or cause Provider to process special categories of personal data (Article 9 GDPR), personal data relating to criminal convictions and offences (Article 10 GDPR), or personal data of children.

4.3 Customer's instructions must comply with Data Protection Law. Customer's indemnity in Terms §19 covers all claims, losses and costs — and, to the extent the law permits, fines — arising from unlawful instructions or from Customer's breach of Data Protection Law.

4.4 Customer is responsible for answering data subjects and supervisory authorities about Customer Personal Data, with Provider's assistance under §5.6 and §5.7.

5. Provider's obligations

5.1 Instructions — Art. 28(3)(a). Provider processes Customer Personal Data only on Customer's documented instructions, including with regard to transfers outside the EEA, unless Union or Member State law requires otherwise; in that case Provider informs Customer before processing, unless that law prohibits it on important grounds of public interest. Customer's complete and final instructions are: (a) the Agreement; (b) Customer's configuration and use of the Service — for example switching visitor measurement on or off, publishing, unpublishing and deleting; and (c) any further written instruction that Provider agrees to. Any other instruction is a change request, which Provider may refuse or make subject to fees.

5.2 Provider informs Customer immediately if, in its opinion, an instruction infringes Data Protection Law, and may suspend carrying out that instruction until Customer confirms or changes it. This is not an obligation to review Customer's instructions for legality.

5.3 Confidentiality — Art. 28(3)(b). Provider ensures that everyone it authorises to process Customer Personal Data is committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

5.4 Security — Art. 28(3)(c). Provider implements the technical and organisational measures in Annex II, which meet Article 32 GDPR. Provider may update them, provided the overall level of protection is not reduced.

5.5 Sub-processors — Art. 28(3)(d). See §6.

5.6 Data subject requests — Art. 28(3)(e). Taking into account the nature of the processing, Provider assists Customer, by appropriate technical and organisational measures and insofar as this is possible, in responding to requests from data subjects exercising their rights under Chapter III of the GDPR. Customer first uses the Service's own features — for example editing or deleting locations, or deleting a map. If Provider receives a request directly, it refers the data subject to Customer without answering it in substance, unless the law requires otherwise. Assistance beyond the Service's features is charged at Provider's then-current rates, which Provider tells Customer in advance.

5.7 Other assistance — Art. 28(3)(f). Taking into account the nature of the processing and the information available to it, Provider assists Customer in meeting its obligations under Articles 32 to 36 of the GDPR (security, notification of personal data breaches, data protection impact assessments and prior consultation), primarily by making this DPA, Annex II and other available documentation available. Further assistance is charged as in §5.6.

5.8 Personal data breaches. Provider notifies Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, by email to the address on Customer's Account. The notification describes, as far as the information is available: the nature of the breach, including the categories and approximate number of data subjects and records concerned; its likely consequences; and the measures taken or proposed to address it. Information not available at first may be provided in phases. Notifying or responding to a breach is not an acknowledgement of fault or liability.

5.9 Deletion or return — Art. 28(3)(g). See §10.

5.10 Demonstrating compliance — Art. 28(3)(h). See §8.

6. Sub-processors

6.1 Authorisation. Customer gives Provider general written authorisation to engage Sub-processors. Customer approves the Sub-processors listed in Annex III.

6.2 Their obligations. Provider imposes on each Sub-processor, by contract, the same data protection obligations as set out in this DPA, as required by Article 28(4) GDPR. Provider remains liable to Customer for each Sub-processor's performance of those obligations, subject to §11.

6.3 Changes. Provider informs Customer of any intended addition or replacement of a Sub-processor at least 14 days before it starts processing Customer Personal Data, by updating Annex III at https://pinglide.com/dpa#annex-iii--sub-processors and by email to the address on Customer's Account or a notice in the dashboard.

6.4 Objections. Customer may object in writing to privacy@pinglide.com within those 14 days, on reasonable grounds relating to data protection. The parties then discuss the objection in good faith. If Provider does not resolve it, Customer's sole and exclusive remedy is to terminate the affected Plan or the Agreement, by notice given before the change takes effect, without penalty; fees already paid are not refunded. If Customer does not object within 14 days, it accepts the change.

6.5 Emergency replacement. Where a Sub-processor has to be replaced urgently for reasons outside Provider's reasonable control — for example because it stops providing its service or because of a security risk — Provider may make the replacement immediately and inform Customer as soon as possible afterwards. §6.4 then applies from that notice.

7. Transfers outside the EEA

7.1 Provider processes Customer Personal Data primarily in the EEA. Provider transfers it outside the EEA only where Data Protection Law permits: under an adequacy decision (including the EU-US Data Privacy Framework, for certified recipients), under the SCCs, or under another safeguard permitted by Article 46 GDPR. Customer authorises such transfers to the Sub-processors listed in Annex III.

7.2 Transfers to Sub-processors. Where a transfer to a Sub-processor outside the EEA is not covered by an adequacy decision, Provider enters into Module 3 (processor to processor) of the SCCs with that Sub-processor, or relies on another valid safeguard.

7.3 Transfers to Customer. Where Customer is established outside the EEA, in a country without an adequacy decision, Module 4 (processor to controller) of the SCCs is incorporated into this DPA by reference for any transfer of Customer Personal Data from Provider to Customer, with the selections in Annex IV.

7.4 If a transfer safeguard is invalidated, Provider moves to another lawful safeguard. If none is reasonably available, either party may terminate the affected processing by notice.

8. Audits and information

8.1 Information. Provider makes available to Customer the information necessary to demonstrate compliance with Article 28 GDPR: this DPA and its annexes; summaries of Sub-processors' certifications and audit reports, where available; and written answers to one reasonable security questionnaire in any 12-month period.

8.2 Audits and inspections. Customer, or an independent auditor mandated by Customer, may carry out an audit, including an inspection, only where: (a) the information provided under §8.1 is not reasonably sufficient to demonstrate compliance; (b) a supervisory authority requires it; or (c) a personal data breach has affected Customer Personal Data. Such an audit:

• takes place no more than once in any 12-month period, except under (b) or (c);
• is requested in writing at least 30 days in advance, with a proposed scope;
• takes place during business hours, without unreasonably disrupting Provider's operations;
• covers Provider's own systems and processes only — for Sub-processors, their own audit reports and certifications are relied on;
• is carried out by an auditor bound by confidentiality who is not a competitor of Provider;
• and its results are Provider's confidential information.

8.3 Costs. Customer bears the costs of an audit, including Provider's reasonable internal costs at its then-current rates. If an audit reveals a material breach of this DPA by Provider, Provider bears its own costs and remedies the breach.

9. Requests from public authorities

If a public authority requests access to Customer Personal Data, Provider will, unless the law prohibits it: notify Customer promptly; try to redirect the authority to Customer; assess whether the request is lawful, and challenge it where there are reasonable grounds to consider it unlawful; and disclose only the minimum the law requires.

10. Deletion and return

10.1 During the Agreement, Customer can delete Customer Content and maps through the Service, and can have its data exported as described in Terms §13.

10.2 When the Agreement ends, Customer may request an export within 30 days — or, when switching providers, within the retrieval period in Terms §13.4. Provider deletes Customer Personal Data within 60 days after the end of that period. Copies in backups are overwritten in their normal rotation no later than 30 days after that; until then they remain protected under this DPA and are not otherwise processed.

10.3 Provider may keep Customer Personal Data that Union or Member State law requires it to store, for as long as required, and it remains protected under this DPA.

10.4 During the Agreement, Visitor Measurement Data is also deleted as described in Annex I.

10.5 Provider confirms deletion in writing on request.

11. Liability

11.1 Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations in Terms §18, which apply to the Terms and this DPA together, in aggregate.

11.2 This does not limit: (a) either party's liability to data subjects under Article 82 GDPR; (b) liability under the SCCs, where they apply, which the parties may not limit between themselves; or (c) any liability that cannot be limited under applicable law.

11.3 Where both parties are liable to a data subject for the same damage and one of them pays full compensation, it may claim back from the other the part of the compensation corresponding to the other's responsibility, as provided in Article 82(5) GDPR.

12. Term and changes

12.1 This DPA lasts for as long as Provider processes Customer Personal Data.

12.2 Provider may change this DPA in the same way as the Terms (Terms §21), and at any time where a change is needed to comply with Data Protection Law, a decision of a supervisory authority, or new standard contractual clauses. No change reduces the overall level of protection for Customer Personal Data.

13. Law and jurisdiction

This DPA is governed by the laws of the Republic of Lithuania, and disputes are decided by the courts set out in Terms §23. Where the SCCs apply, they are governed as selected in Annex IV.

Annex I — Description of the processing

A. The parties

• Data exporter and controller: Customer, as identified in its Account. Contact: the email address on the Account.
• Data importer and processor: Marius Zakarauskas, Debreceno g. 8-10, Klaipėda, Lithuania. Contact: privacy@pinglide.com.
• Activities: provision of the Service under the Terms.

B. Processing 1 — visitor measurement

Takes place only for maps where Customer has switched visitor measurement on, from Customer's next publish.

• Data subjects: people who use Customer's Published Maps on websites ("Visitors").
• Personal data:
  • IP address — stored in full, and shown truncated in the dashboard;
  • approximate location — country, city and coordinates — only where the hosting network derives them from the IP address; never from the device's GPS;
  • the hostname and path of the page showing the map, and the referring page's address (each truncated to 255 characters);
  • device type (desktop, tablet or mobile), derived from the browser's user-agent string, which is not stored;
  • interactions with the map: that it loaded; locations opened, and whether from a pin, a list row or a cluster; shapes opened; card sections expanded and photo galleries viewed; search text (up to 80 characters) and the number of results; suggestions chosen; and presses of "find nearest" (the Visitor's position is not sent), directions, phone, email and website links — each with its time offset in milliseconds, up to 60 per page view;
  • a random session identifier generated inside the page, not stored on the device, used only to group the reports from one page view;
  • the session's start time, taken from the server's clock.
• Special categories: none intended. Search text is free text entered by Visitors; Customer should not switch on measurement for maps where Visitors are likely to type sensitive information.
• Nature of the processing: receiving the reports sent by the embed script; filtering automated traffic; checking the reporting website against the map's domain allowlist; storing; combining records into daily statistics; showing them to Customer in the dashboard; deleting.
• Purpose: to show Customer how Visitors use its maps.
• Frequency: continuous while measurement is on, with one stored record per page view.
• Retention:
  • session records: 30 days on the Free Plan, 180 days on Starter, 365 days on Pro, then deleted automatically, at most a day late;
  • daily statistics — counts per location, search text, suggestion, country, device, referring website and page, and positions rounded to one decimal place (about 11 km) — contain no IP addresses, and are kept until Customer deletes the map or the Agreement ends (§10).
• When Customer switches measurement off, collection stops within about a minute. Records already stored remain until they are deleted as above.

C. Processing 2 — Customer Content

• Data subjects: people who are named, pictured or contactable through Customer Content — for example Customer's staff, franchisees, dealers and stockists and their contact people, and individuals whose address is one of Customer's locations.
• Personal data: names; addresses and coordinates; phone numbers; email addresses; website links; opening hours; descriptions and custom fields; photographs and logos.
• Nature of the processing: storing; importing from files and spreadsheets; geocoding addresses and calculating routes through Sub-processors; where Customer links a map to a Google Sheet and keeps it in sync, reading that sheet and geocoding and publishing its rows automatically, without a review step; editing; publishing as a static file that is publicly available and displayed on websites through the embed script; exporting; deleting.
• Purpose: to provide the Service.
• Retention: until Customer deletes it, and then as in §10.

D. Duration

The term of the Agreement, plus the periods in §10.

E. Competent supervisory authority

For Customer, the supervisory authority competent for Customer. For Provider, the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija).

Annex II — Technical and organisational measures

Encryption

• Every connection to the dashboard, the embed script, published map files and the visitor measurement endpoint uses HTTPS.
• Passwords are stored only as salted Argon2 hashes.
• Data in the database and file storage is protected at rest by the hosting provider's encryption (AES). Database backups, where taken, are encrypted in transit and at rest, and kept in a separate location from the primary data.

Access control

• Customer data can be read only through an authenticated session belonging to its owner. Every read of Visitor Measurement Data checks ownership of the map first.
• Visitor measurement records carry no user-level permissions. Only Provider's server, using administrative credentials, can read them.
• Administrative credentials exist only on servers, never in browsers or in the embed script.
• Staff access is limited to what each role needs, under confidentiality obligations.

Authentication

• Sign-in cookies are HttpOnly, Secure and SameSite=Strict.
• Resetting a password ends every other session for that account.
• Password-reset and email-confirmation requests are rate limited.

Data minimisation in published maps

• The embed script sets no cookies and uses no browser storage. No identifier outlives a page view.
• Visitor measurement is off by default, and is switched on per map.
• One report per page view, with limits on the number of events (60), the length of any text (80 characters) and the size of the report.
• No IP-geolocation lookups are made. Location comes only from what the hosting network already provides. Daily statistics round positions to about 11 km and contain no IP addresses.
• IP addresses are shown truncated in the dashboard.

Abuse prevention

• Reports from automated traffic are filtered out.
• Reports are accepted only for published maps with measurement on, and only from websites on the map's domain allowlist.
• A monthly ceiling on stored sessions applies to each map, and report size is limited.

Availability and resilience

• The primary database is hosted in the European Union (Frankfurt, Germany).
• Database backups are taken automatically where the hosting plan in use provides them, at the frequency and for the retention that plan sets.

Organisation

• Sub-processors are bound by data processing terms and listed in Annex III.
• Personal data breaches are assessed and notified as set out in §5.8.
• Requests from public authorities are handled as set out in §9.
• These measures are reviewed regularly, and whenever the Service changes how it processes Customer Personal Data.

Annex III — Sub-processors

Last updated: 5 November 2026

Not Sub-processors under this DPA:

• OpenFreeMap serves map tiles directly to the Visitor's browser. It receives no Customer Personal Data from Provider.
• Resend (email), Google and GitHub (sign-in) and Link, LLC (formerly Lemon Squeezy LLC), trading as Lemon Squeezy (payments) process only the data Provider handles as a controller for its own customers — see the Privacy Policy. They never receive Customer Personal Data.
• Google Sheets, where Customer links a map to a sheet: Provider reads a sheet that Customer has itself shared by link or published to the web through Google, under Customer's own agreement with Google. Google does not process Customer Personal Data on Provider's behalf.

Annex IV — Standard contractual clauses

Applies only to transfers under §7.3.

• Module: Module 4 (processor to controller).
• Clause 7 (docking clause): not included.
• Clause 11(a) (independent dispute resolution body): not included.
• Clause 17 (governing law): the laws of the Republic of Lithuania.
• Clause 18 (choice of forum and jurisdiction): the courts of the Republic of Lithuania competent for Klaipėda.
• Annex I.A and I.B of the SCCs: Annex I of this DPA.
• Annex II of the SCCs, where relevant: Annex II of this DPA.

Marius Zakarauskas · Individual activity certificate No. 1554078 · Debreceno g. 8-10, Klaipėda, Lithuania · privacy@pinglide.com