Privacy and Cookie Policy

1. Introduction

This Privacy and Cookie Policy explains how we collect, use, store, and protect personal data when you visit our Website, create an account, use our geospatial tools and APIs, or contact us.

We are committed to protecting your privacy and processing personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Danish data protection legislation.

2. Data Controller

The data controller responsible for processing your personal data is:

• Name: Geospatial Toolbox
• Address: Læhegnet 85, 7190 Billund
• Country: Denmark
• Email: contact@geospatialtoolbox.com
• Website: https://geospatialtoolbox.com

If you have questions about this policy or how we process your personal data, please contact us using the email address above.

3. Personal Data We Collect

3.1 Account Information

When you create an account, we may collect:

• Username and full name
• Email address
• Password hash
• Account creation and modification timestamps
• Account status and access permissions
• API key associated with your account

Passwords are stored as password hashes rather than as plain-text passwords. We use account information to manage accounts, authenticate users, provide API access, and maintain security.

3.2 API Usage and Technical Logs

When you use our APIs or Website, our systems may process:

• IP address
• Date and time of requests
• Requested API endpoints
• HTTP status codes and request outcomes
• API key or account identifier associated with a request
• Request counts and usage statistics
• Browser or device information, where available

We use this information to operate the service, enforce usage limits, monitor performance, prevent abuse, troubleshoot errors, and protect our systems.

API requests may contain coordinates, geographical data, search terms, or other information submitted by users. We process this information as necessary to provide the requested functionality. Please do not submit personal or confidential information unless the relevant functionality requires it.

3.3 Contact Information

If you contact us by email or through a contact form, we may collect your name, email address, message content, and other information you voluntarily provide. We use this information to respond to enquiries and provide support.

3.4 Payment and Subscription Information

If paid subscriptions are introduced, we may process subscription plans, payment status, transaction references, billing information, renewal dates, cancellation dates, and access entitlements.

Payments may be handled by a third-party payment provider. Payment card details will not be stored directly by us unless explicitly stated otherwise.

The identity of the payment provider and its privacy policy will be disclosed when payment functionality is introduced.

3.5 Analytics Data

If analytics tools are enabled, we may collect information about page views, navigation patterns, browser characteristics, and interactions with Website features. Non-essential analytics technologies will only be used after valid consent where required by law.

4. Purposes and Legal Bases for Processing

We process personal data only where an applicable legal basis exists.

• Account management and API access: Performance of a contract or steps taken at your request before entering into a contract.
• Payments and subscriptions: Performance of a contract and compliance with legal obligations.
• Security, API limits, and abuse prevention: Legitimate interests, where appropriate.
• Technical troubleshooting: Legitimate interests, where appropriate.
• Support enquiries: Legitimate interests or performance of a contract, depending on the circumstances.
• Accounting and legal compliance: Compliance with legal obligations.
• Non-essential analytics cookies: Consent, where required by law.

Where we rely on legitimate interests, we consider the impact on your rights and freedoms. Where processing is based on consent, you may withdraw your consent at any time.

5. Sharing of Personal Data

We do not sell personal data to third parties.

We may share personal data with the following recipients where necessary:

• Hosting and infrastructure providers
• Email providers
• Payment providers
• Analytics providers, where enabled
• Professional advisers and public authorities where legally required

Our hosting and infrastructure providers may process technical information, including IP addresses and server logs, as part of providing their services.

Where third parties process personal data on our behalf, we will establish the necessary contractual safeguards where required by law.

6. International Data Transfers

Depending on the providers and services used, personal data may be processed outside Denmark or the European Economic Area (EEA).

Where required, international transfers will be supported by an appropriate legal mechanism under the GDPR, such as an adequacy decision or Standard Contractual Clauses, together with any additional safeguards required in the circumstances.

7. Cookies and Similar Technologies

Cookies are small text files stored on your device when you visit a website. Similar technologies may also be used to store information or recognise a browser.

7.1 Strictly Necessary Cookies

These cookies support essential Website functionality, such as authentication, secure sessions, and protection against abuse. They are used without consent where permitted by applicable law.

7.2 Analytics Cookies

Analytics cookies may be used to understand how visitors interact with the Website, measure traffic, and identify technical problems. Non-essential analytics cookies will be blocked until consent has been obtained where required by law.

7.3 Functional Cookies

Functional cookies may remember preferences or settings. Where these cookies are not strictly necessary, consent will be obtained where required by applicable law.

7.4 Marketing Cookies

If marketing or advertising technologies are introduced, they will be disclosed and controlled in accordance with applicable consent requirements.

7.5 Managing Cookie Preferences

Where required, a cookie consent mechanism will allow visitors to accept or reject non-essential cookies and manage their preferences. Visitors will be able to change or withdraw consent through the Website's cookie settings.

Disabling certain cookies may affect some Website features.

7.6 Cookie Details

The specific cookies used depend on the Website's configuration and the third-party services enabled. A current cookie inventory should identify each cookie's name, provider, purpose, category, duration, and whether it is first-party or third-party.

This information will be made available through the Website's cookie settings or a dedicated cookie list.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

• Account information: While the account is active and for a reasonable period afterward where necessary for security, disputes, or legal obligations.
• Password hashes and API keys: While required to provide account access, subject to necessary security and recordkeeping requirements.
• API usage logs: For a limited period necessary for security, troubleshooting, abuse prevention, and usage-limit enforcement.
• Contact enquiries: For as long as reasonably necessary to respond and maintain relevant records.
• Payment and accounting records: For the period required by applicable accounting and tax legislation.
• Cookie and consent records: For as long as necessary to manage and demonstrate consent, where applicable.
• Analytics data: According to the retention settings and policies of the analytics service.

Data will be deleted or anonymised when it is no longer necessary, subject to applicable legal obligations.

9. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure, and destruction.

Measures may include access controls, password hashing, API key authentication, secure connections, software updates, and monitoring of suspicious activity.

No system can be guaranteed to be completely secure. If a personal data breach occurs, we will assess our obligations and notify the relevant supervisory authority and affected individuals where required by law.

10. Your Rights Under the GDPR

Subject to applicable legal conditions and exceptions, you may have the right to:

• Access your personal data.
• Request correction of inaccurate or incomplete data.
• Request deletion of personal data.
• Request restriction of certain processing activities.
• Receive certain personal data in a portable format.
• Object to processing based on legitimate interests, where applicable.
• Withdraw consent where processing is based on consent.

To exercise your rights, contact us using the details in Section 2. We may need to verify your identity before fulfilling a request.

You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet): www.datatilsynet.dk .

We encourage you to contact us first if you have concerns about how your personal data is processed.

11. Third-Party Websites and Services

The Website may contain links to third-party websites, documentation, or services. We are not responsible for the privacy practices of external websites.

Third-party services integrated into the Website may process information according to their own privacy policies and applicable contractual arrangements.

12. Children's Privacy

The Website and API services are not specifically designed for children. We do not knowingly collect personal data from children in violation of applicable law.

If you believe that a child has provided personal data inappropriately, please contact us so that we can assess the situation and take appropriate action.

13. Changes to This Policy

We may update this Privacy and Cookie Policy when our services, technical infrastructure, legal requirements, or data processing practices change.

The latest version will be published on this page together with the date of the most recent update. Where required by law, we will provide additional notice or obtain consent before introducing new processing activities.

14. Contact

If you have questions about this policy or wish to exercise your data protection rights, please contact:

• Name: Geospatial Toolbox
• Email: contact@geospatialtoolbox.com
• Address: Læhegnet 85, 7190 Billund, Denmark
• Website: https://geospatialtoolbox.com