Data Processing Agreement

For personal data the Client submits to the Service or that the Service collects for the Client (users, brand material, conversation content, measurement about the Client's brand), the Client is the controller and New Map is the processor. For its own purposes (website operation, accounting, its own outreach) New Map is an independent controller under its Privacy Policy. Terms used here have the meaning given in Article 4 GDPR.

New Map processes personal data only on the Client's documented instructions, which are the Terms, this DPA and the Client's use of the Service's functions, including as to transfers to third countries, unless Union or Member State law requires otherwise; in that case New Map informs the Client of the requirement before processing, unless the law prohibits it. New Map informs the Client without delay if it considers an instruction to infringe data protection law. Instructions beyond the Service's functions must be given in text form and may be charged at cost where they cause material extra work. The Client instructs New Map to derive aggregated, de-identified statistics from use of the Service and from measurement data as described in the Terms; those statistics contain no personal data, are never used to train a third-party AI model, and the Client's identifiable data is used for that Client only.

New Map: (a) ensures that persons authorised to process the data are bound by confidentiality; (b) implements the measures in Annex 2; (c) engages sub-processors only under section 6; (d) assists the Client, taking account of the nature of the processing, in responding to data subject requests under Chapter III GDPR, by forwarding any request it receives within 3 business days and by providing the functions and information needed; (e) assists the Client with Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation, to the extent the information is available to New Map; (f) deletes or returns the data under section 9; (g) provides the information needed to demonstrate compliance with Article 28 and allows audits under section 8; (h) maintains a record of processing activities under Article 30(2) GDPR.

New Map notifies the Client without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the Client's data, at the email address of the Client's account owner. The notice contains the information in Article 33(3) GDPR to the extent known, and is supplemented as facts emerge. New Map documents breaches and cooperates in the Client's notifications to the supervisory authority and to data subjects. New Map does not notify authorities or data subjects on the Client's behalf unless instructed.

The Client gives general authorisation for the sub-processors below. Each is engaged under a written contract that imposes data protection obligations no less protective than this DPA, and New Map remains fully liable to the Client for their performance. New Map gives at least 30 days' notice by email to the account owner before adding or replacing a sub-processor; the Client may object on reasonable data protection grounds within that period, the parties will seek a solution in good faith, and if none is found the Client may terminate the affected Service at the end of the notice period without penalty. Providers marked as independent controllers are not sub-processors and are listed for completeness. "DPF" is the EU-US Data Privacy Framework; "unverified" means New Map has not yet checked the vendor's current certification and relies on the Standard Contractual Clauses until it has.

Prompts and content we send to AI providers are processed under their business API terms. Anthropic, OpenAI, Perplexity and xAI do not use API inputs or outputs to train their models, and Google applies its paid-tier data terms to the Gemini API for developers established in the EEA, under which prompts and responses are not used to improve Google's products. We do not permit any provider to train a public model on your data.

The Client's data is stored in the EU (Annex 1, storage location). Where a sub-processor is outside the European Economic Area and no adequacy decision applies, the transfer is made under the EU-US Data Privacy Framework for certified US providers (checked against the official list on 13 October 2026; Annex 3 names the safeguard for every sub-processor), and for sub-processors that are not certified under the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914, Modules 2 and 3), supplemented by a transfer impact assessment and the measures in Annex 2. For UK data the UK International Data Transfer Addendum applies; for Swiss data the FADP adaptations apply. The Client authorises New Map to enter into these clauses with sub-processors on its behalf where required.

New Map provides, on request and at most once in 12 months, the information reasonably necessary to demonstrate compliance with Article 28: this DPA, the current Annex 2, and the certifications and audit reports of its infrastructure providers (for example SOC 2 reports held by Vercel and Supabase). Where that is insufficient, the Client or an independent auditor bound by confidentiality may audit New Map's relevant systems and records on 30 days' notice, during business hours, without disrupting operations, at the Client's cost; after a confirmed breach affecting the Client, at New Map's cost and without the 12-month limit.

On termination of the Service, or on the Client's earlier written request, New Map returns the Client's data in a common machine-readable format and deletes it, including copies at sub-processors, within 30 days, and confirms deletion in text form on request. Encrypted backups are overwritten within the backup rotation of at most 30 days. Data that Union or Member State law requires New Map to retain is kept only for that purpose and period.

• Confidentiality, access control: access to production systems only for named staff with individual accounts and multi-factor authentication; two-factor authentication required for every New Map admin and team login and available to every Client user; least privilege; access reviewed when roles change; secrets kept in the hosting provider's encrypted environment store, never in code.
• Confidentiality, data separation: row-level security in the database so that each Client's records are readable only by that Client's users and by the Service acting for them; per-client scoping in every agent tool.
• Confidentiality, pseudonymisation and encryption: TLS 1.2+ in transit; encryption at rest at the database and storage providers; integration tokens encrypted with AES-256-GCM under a key held only in the environment store; passwords stored as salted hashes by the authentication provider.
• Integrity: signed and rate-limited API routes; a bot check on the public login, signup and contact forms where enabled; audit fields (who, when) on records; agent actions logged; a security log of logins and sessions that each Client can see on its Security tab; automated verification of generated content against the Client's data before it is shown.
• Availability and resilience: managed infrastructure with redundancy; the database and authentication hosted on AWS in Ireland (EU); automated encrypted database backups with point-in-time recovery at the provider, rotated within 30 days; rate limiting against abuse; monitoring and alerting on failures.
• Incident management: documented response procedure, breach assessment, notice under section 5, post-incident review.
• Processes: a record of processing activities; data protection review of new features and providers; staff instructed in data protection; sub-processor contracts under Article 28(4).

New Map may update these measures provided the level of protection is not reduced. The current measures are also described on the security page.

Liability under this DPA follows the Terms, subject to Article 82 GDPR. This DPA is governed by the law and jurisdiction stated in the Terms. In case of conflict, this DPA prevails over the Terms for the processing of personal data, and the Standard Contractual Clauses prevail over this DPA where they apply.

Data subject requests, breach reports, audit requests and sub-processor objections: privacy@thenewmap.ai.