This Data Processing Agreement describes how we process personal data on your behalf when you use our services. It applies automatically to every customer — there is nothing to sign.
We provide the same service to every customer on the same infrastructure, so this Agreement comes with its annexes already completed, and we offer the same terms to everyone rather than negotiating individual amendments. If your organisation requires a countersigned copy for its records, contact us and we will sign this document as it stands.
1.1 This Agreement is between Gravitystorm Limited, registered in England and Wales under company number 7126880 (“we”, “us”), and the customer identified on the relevant Thunderforest account (“you”).
1.2 In this Agreement:
1.3 This Agreement forms part of, and is incorporated into, our Terms of Service. By accepting those Terms you accept this Agreement, and no separate signature is required.
1.4 Where this Agreement conflicts with the Terms, this Agreement prevails in respect of the processing of personal data.
2.1 This Agreement applies to Service Data.
2.2 It does not apply to Account Data — your name, email address, billing address, tax details and payment information. In respect of Account Data we act as a controller in our own right, and our processing is described in our Privacy Policy.
2.3 In respect of Service Data we act as your processor for the purpose of delivering the Services in response to requests originating from your website or application. We act as a controller in respect of the same data for the limited purposes of preventing fraud and abuse, maintaining the security and integrity of the Services, and producing aggregated usage statistics for billing and capacity planning.
2.4 You are the controller of Service Data. You are responsible for ensuring you have a lawful basis for the processing, and for providing any notice or obtaining any consent required from the data subjects described in Annex 1.
2.5 The Services are not intended to receive personal data beyond that described in Annex 1. You must not transmit special category data under Article 9, or criminal offence data under Article 10, to the Services, whether in request parameters or otherwise.
We will:
3.1 Process only on your instructions, including in relation to international transfers, unless required otherwise by law — in which case we will inform you first, unless that law prohibits us from doing so. Your instructions are constituted by this Agreement, the Terms, and your configuration and use of the Services.
3.2 Tell you if an instruction is unlawful, where in our opinion it infringes the GDPR or other data protection law.
3.3 Impose confidentiality on everyone we authorise to process Service Data, and ensure those obligations survive the end of their engagement.
3.4 Keep the data secure, implementing and maintaining the measures in Annex 2 as required by Article 32.
3.5 Assist with data subject rights, so far as possible and taking into account the nature of the processing. We will notify you promptly of any request we receive directly, and will not respond to it ourselves other than to direct the person to you. Note that we are ordinarily unable to identify a data subject from Service Data without further information from you, and are not required to acquire additional data in order to do so.
3.6 Assist with your wider obligations under Articles 32 to 36, taking into account the nature of the processing and the information available to us.
3.7 Notify you of breaches without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Service Data, and provide the information you reasonably require to meet your own notification obligations. See clause 6.
3.8 Delete the data in accordance with clause 5. We will not retain Service Data beyond those periods after your account is closed, and will confirm deletion in writing on request. For the purposes of Article 28(3)(g), you instruct us to delete Service Data rather than return it. We do not provide raw request logs to customers, in order to protect the privacy of the end users they relate to.
3.9 Demonstrate compliance, making available the information necessary to show compliance with Article 28, as set out in clause 8.
4.1 You give us general authorisation to engage sub-processors.
4.2 Our current sub-processors are listed at thunderforest.com/subprocessors/.
4.3 We will give at least 30 days’ notice before adding or replacing a sub-processor by updating that page, which is how we inform you of such changes for the purposes of Article 28(2). You may additionally ask us to send changes to you by email, using the address on that page.
4.4 Where a change is necessary at shorter notice to maintain the security or availability of the Services, we may make it immediately and will update that page as soon as reasonably practicable. Your right to object under clause 4.5 still applies.
4.5 You may object to a new sub-processor on reasonable data protection grounds within 30 days of the change being published. We will work with you in good faith to find a resolution, and if none is available you may terminate your subscription without penalty and receive a pro-rata refund of any prepaid fees for the unused remainder of the term.
4.6 We impose on each sub-processor obligations no less protective than those in this Agreement, and remain fully liable to you for their performance.
5.1 We retain request logs, including IP addresses, for 45 days, after which they are deleted. This applies to our central logging cluster in Germany.
5.2 Transient copies written on the individual servers handling a request are deleted after 7 days.
5.3 We retain aggregated usage data beyond these periods for billing and capacity planning. That data consists solely of an API key together with counts of requests by service type and time period. It contains no IP addresses and no information relating to any individual, and is therefore not personal data. Producing it is the final processing performed on the underlying request logs, which are deleted on the schedule above.
6.1 Notification under clause 3.7 will be sent to the contact details held on your account. It is your responsibility to keep those details accurate.
6.2 An unsuccessful attempt does not constitute a personal data breach and is not notifiable under clause 3.7. An attempt is unsuccessful where it results in no accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, Service Data. Unsuccessful attempts typically include port scans, failed authentication attempts and denial of service attacks.
6.3 Our notification of, or response to, a personal data breach is not an admission of fault or liability.
7.1 Service Data is processed on infrastructure in Germany and the United States, as described in Annex 1 and in the sub-processor list. Requests are routed by latency and are not pinned to a single location, so a request originating in the European Economic Area may be handled in the United States.
7.2 Where a request is handled in the United States, the resulting log data is transferred to our central logging cluster in Germany and the copy in the United States is deleted in accordance with clause 5.2.
7.3 We are established in the United Kingdom. Transfers of personal data from the European Economic Area to the United Kingdom are covered by the European Commission’s adequacy decision for the United Kingdom, so no Article 46 transfer mechanism is required for that transfer.
7.4 Our onward transfers to our sub-processors in the United States are made under the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, incorporated into our agreements with those sub-processors together with the UK International Data Transfer Addendum. Where a sub-processor is additionally self-certified under the EU–U.S. Data Privacy Framework and its UK Extension, that certification provides a second and independent basis for the transfer; the sub-processor list notes where this applies.
7.5 We have assessed the circumstances of these transfers — including the limited categories of data involved, the short period for which it is present in the United States under clause 5.2, and the safeguards described in clause 7.4 — and consider that the protection provided is essentially equivalent to that guaranteed within the European Economic Area.
7.6 If the adequacy decision in clause 7.3, or the mechanisms in clause 7.4, are invalidated or cease to be available, the parties will without undue delay put in place an alternative mechanism valid under Chapter V of the GDPR. The Standard Contractual Clauses will apply between us in the interim, with Annex 1 completing their Annex I and Annex 2 completing their Annex II.
8.1 We will make available the information reasonably necessary to demonstrate compliance with Article 28, including this Agreement, our security documentation and our sub-processor arrangements.
8.2 Because our infrastructure is shared across all customers, we do not permit on-site inspection by individual customers, as doing so would compromise the security of other customers’ data. Audits under Article 28(3)(h) are accordingly conducted by review of the information provided under clause 8.1.
8.3 If that information is not sufficient for you to demonstrate compliance to your supervisory authority, contact us and we will work with you in good faith to find an appropriate alternative, which may include responding to a written security questionnaire.
8.4 You may exercise your rights under this clause once in any twelve-month period, unless a personal data breach has occurred or your supervisory authority requires otherwise.
9.1 This Agreement applies for as long as we process Service Data on your behalf, and terminates automatically when your account is closed and the retention periods in clause 5 have elapsed.
9.2 Each party’s liability under this Agreement is subject to the limitations and exclusions of liability in the Terms. Nothing in this Agreement limits either party’s liability to a data subject under Article 82, or any liability that cannot lawfully be limited.
9.3 This Agreement is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction. This does not affect the right of a data subject to bring proceedings under Article 79 before the courts of the Member State in which they reside.
9.4 Where the Standard Contractual Clauses apply between us under clause 7.6, those Clauses are governed by the law of the Member State in which you are established, or where you are not established in the European Economic Area, by Irish law.
Subject matter. Delivery of the Services in response to requests made from your website or application.
Duration. For the term of your subscription, plus the retention periods in clause 5.
Nature and purpose. Receiving, authenticating, routing and responding to API requests; enforcing usage quotas; preventing fraud and abuse; maintaining the security and integrity of the Services; monitoring availability and performance; and capacity planning.
Categories of data subject. End users of your websites and applications — the people whose devices request the Services.
Categories of personal data.
No special category data under Article 9 or criminal offence data under Article 10 — see clause 2.5.
Frequency. Continuous, for the duration of your subscription.
Locations of processing. Germany and the United States. See clause 7 and the sub-processor list.
Retention. As set out in clause 5.
Maintained in line with Article 32, and reviewed as the Services evolve.
This Agreement was last updated on 18 August 2026. Changes are published on this page. If you would
like to be told about them by email, email
support (at) thunderforest (dot) com and we will
add you to the notification list.