Appearance

Legitimate Interests Assessment ​

Effective Date: 2026-07-09 · Document ID: LIA-MMA-001 · Contact: info@mapsted.com · Contact UsVersion: 1.0

Plain-language summary (non-binding): This document records Mapsted Corp.'s internal assessment of whether two specific processing activities — (a) server access logs containing IP addresses and user-agent strings, and (b) API-key usage records retained for licence compliance — are lawful under GDPR Article 6(1)(f) and analogous provisions. It concludes that both activities pass the three-part legitimate-interests test (purpose, necessity, and balancing), subject to the safeguards described in §7. This is a Mapsted internal governance document. A summary is available to Licensees upon written request to privacy@mapsted.com.

Table of contents ​

  1. Executive summary
  2. Scope
  3. Processing activities under assessment
  4. Part 1 — Purpose test (legitimate interest identification)
  5. Part 2 — Necessity test
  6. Part 3 — Balancing test
  7. Technical and organisational safeguards
  8. DPIA-lite — Article 35 risk assessment
  9. Jurisdictional annexes
  10. Records of processing (GDPR Art. 30)
  11. Data subject rights and mechanisms
  12. Review schedule
  13. Sign-off and approval
  14. References

1. Executive summary ​

1.1 Legal basis identified ​

Mapsted Corp. and its subsidiaries, affiliates, and related entities (collectively, "Mapsted") operates the Mapsted Maps JavaScript API (the "Software"), comprising the @mapsted/maps-js-api npm package, the mapi.mapsted.com iframe endpoint, and the maps.mapsted.com backend tile-and-routing service. This Legitimate Interests Assessment ("LIA") assesses whether Mapsted may lawfully rely on Article 6(1)(f) GDPR as the legal basis for two controller-mode processing activities:

  • Activity A — IP address and user-agent logging, retained for thirty (30) days to support service routing, fraud prevention, and regional compliance.
  • Activity B — API-key usage records, retained for twelve (12) months to support licence compliance monitoring and future quota-management capabilities.

This LIA covers only processing for which Mapsted acts as a data controller determining its own purposes and means. Where Mapsted processes personal data on behalf of a Licensee under a Commercial Agreement, Mapsted acts as a data processor; that processing is governed by the Data Processing Addendum (DPA-MMA-001) and is outside the scope of this LIA.

1.2 Conclusion ​

Both Activity A and Activity B pass the three-part legitimate-interests test:

  • Activity A is lawful under GDPR Article 6(1)(f) and analogous provisions in all assessed jurisdictions (Canada, United Kingdom, United States, European Economic Area), subject to the safeguards in §7.
  • Activity B is lawful under GDPR Article 6(1)(f) and analogous provisions in all assessed jurisdictions, subject to the safeguards in §7 and the reserved-right framing described in §3.2.

1.3 Key constraints and dependencies ​

This LIA remains valid only while the following conditions hold. A material change in any condition requires re-assessment:

  1. The Software does not transmit end-user navigation event payloads, search queries, names, email addresses, or any other direct personal identifier to Mapsted's backend services (as confirmed by the postMessage architecture documented in PP-MMA-001 §3 and empirically verified against the @mapsted/maps-js-api source at commit af4bb0d).
  2. Retention periods for Activity A (30 days) and Activity B (12 months) remain as stated in PP-MMA-001 §6 and in this LIA.
  3. No new processing activity is added to the Software's backend that is not separately assessed for its legal basis before deployment.
  4. Mapsted's commercial operations remain within the jurisdictional scope described in §9.

2. Scope ​

2.1 In scope ​

This LIA assesses the lawfulness of the following personal data processing activities that arise when the Software is embedded in a Licensee's application and accessed by an end user:

  • HTTP request metadata (IP address, user-agent string, request timestamp, request path) captured in access logs on mapi.mapsted.com, maps.mapsted.com, and associated CDN layers.
  • API-key identifiers (?key= query parameter or authentication header) captured in server access logs and audit records, used to identify the Licensee account associated with a given map session.
  • Server access log metadata from docs.mapsted.com/maps-js-api (IP address, request path, user-agent, referrer, timestamp), as described in PP-MMA-001 §4.

2.2 Out of scope ​

This LIA does not assess:

  • Navigation event data — the Software routes all end-user interactions (entity selections, routing requests, floor changes, search queries, promotion interactions) exclusively through the browser's window.postMessage API between the maps.mapsted.com iframe and the embedding Licensee page. These events are dispatched to a client-side in-memory event emitter and are not transmitted to or stored on Mapsted's backend. No legitimate-interests assessment is required for data that is not processed.
  • Crash telemetry — opt-in error reporting is processed on the basis of consent (Art. 6(1)(a)) and is not assessed in this LIA.
  • Licensee processing of end-user data — the Licensee is an independent data controller for data it collects from its end users; Mapsted is a data processor for that processing.
  • Employment and HR data — governed by separate Mapsted policies.
  • Map tile and building data — the processing of property IDs and building IDs to serve the correct map data is necessary for performance of the service agreement with the Licensee (Art. 6(1)(b)) and does not require reliance on legitimate interests.

2.3 Assessment date and basis ​

This LIA was drafted on 2026-04-23 based on:

  • The @mapsted/maps-js-api source at the Gitea-2 fork HEAD af4bb0d, empirically verified to confirm that no quota-enforcement, navigation-event transmission, or additional telemetry code is present.
  • The PP-MMA-001 Privacy Policy (version 1.0), which establishes the retention periods, data categories, and legal bases cross-referenced in this LIA.
  • Applicable GDPR, UK GDPR, PIPEDA, CCPA/CPRA, and related legal frameworks as of the drafting date.
  • The European Data Protection Board (EDPB) Guidelines and Article 29 Working Party opinions referenced in §14.

3. Processing activities under assessment ​

3.1 Activity A — IP address and user-agent logging ​

Description: When an end user loads a Licensee page that embeds the Software, the end user's browser makes HTTP requests to mapi.mapsted.com and maps.mapsted.com to load map tiles, routing data, and the iframe shell. Standard HTTP server access logs record the following data for each request:

FieldSourceExample (illustrative only)
IP addressHTTP connection203.0.113.42
User-agent stringUser-Agent request headerMozilla/5.0 (Windows NT 10.0; Win64; x64) ...
Request pathHTTP request line/tiles/1643/floor/2/12/3412/2109.png
HTTP methodHTTP request lineGET
Response status codeServer response200
TimestampServer clock2026-04-23T14:32:01Z
ReferrerReferer request headerhttps://licensee.example.com/map

Retention: Thirty (30) days from the date of the request, as stated in PP-MMA-001 §6.

Purposes: Service routing; detection and prevention of abuse, denial-of-service attacks, and fraudulent traffic; regional compliance assessment (determining whether requests originate from jurisdictions with specific compliance obligations); diagnostic attribution for infrastructure incidents.

Personal data categories involved: The IP address is personal data under GDPR Article 4(1) and Recital 30 (online identifiers may, in combination with server metadata, be used to identify natural persons). The user-agent string is not directly personal but may contribute to fingerprinting in combination with an IP address. It is processed for the same purposes.

Data subjects: End users of Licensee applications whose browsers make requests to Mapsted's backend; visitors to docs.mapsted.com/maps-js-api.

3.2 Activity B — API-key usage records ​

Description: Licensees authenticate their map sessions by including an API key (?key=…) in requests to mapi.mapsted.com. This key identifies the Licensee account. Server access logs and audit records capture the API key alongside the request metadata described in Activity A.

Current state: As of the drafting date of this LIA, Mapsted does not currently enforce server-side API-key validation or quota limits in the Software's production infrastructure. The API key is passed in requests but is not actively validated against a key registry on each call, and no quota counters are tracked in real time. Mapsted reserves the right to introduce key validation, tiered access controls, and quota enforcement at any time, subject to reasonable advance notice to Licensees. The processing of API-key identifiers in access logs is therefore assessed as a current processing activity (access logs capture the key as a natural artefact of the request) with a forward-looking licence-compliance purpose (auditing, usage trends, and future quota management) that Mapsted has a legitimate interest in maintaining.

Retention: Twelve (12) months from the date of the request, as stated in PP-MMA-001 §6.

Purposes: Licence compliance monitoring; detection of key misuse, unauthorised key sharing, and credential-stuffing attacks; baseline usage data for future tiered access and quota-management features; Mapsted's ability to respond to Licensee disputes about usage.

Personal data categories involved: The API key is a pseudonymous identifier that identifies a Licensee account rather than an individual natural person. However, in the context of a sole-trader or individual developer acting as a Licensee, the key may be linkable to a natural person. This LIA treats API-key records as potentially personal data and assesses them accordingly.

Data subjects: Licensees (and, where applicable, individual developers) whose API keys appear in access logs.

4. Part 1 — Purpose test (legitimate interest identification) ​

Question: Does Mapsted have a legitimate interest in Activity A and Activity B?

4.1 Interest 1 — Service integrity and abuse prevention (supports Activity A) ​

Mapsted has a legitimate interest in maintaining the integrity and availability of its backend services (mapi.mapsted.com, maps.mapsted.com) and in preventing abuse, denial-of-service attacks, fraudulent usage, and traffic patterns that may cause service degradation for lawful users. Server access logs are the standard technical mechanism for detecting, investigating, and responding to such threats.

Strength of interest: Strong. This interest is directly tied to Mapsted's ability to deliver the Software to Licensees and their end users. Without abuse-prevention logging, a single bad actor could degrade service for every Licensee simultaneously. The EDPB and national data protection authorities have consistently recognised network security and fraud prevention as legitimate interests under Art. 6(1)(f); see EDPB Guidelines 06/2020 on legitimate interests.

Recognised basis: The Article 29 Working Party's Opinion 06/2014 on the notion of legitimate interests (WP217) explicitly cites "fraud prevention", "IT security", and "network and information security" as well-established legitimate interests. GDPR Recital 49 separately confirms that "processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security … constitutes a legitimate interest of the data controller concerned."

4.2 Interest 2 — Regional compliance and operational diagnostics (supports Activity A) ​

Mapsted has a legitimate interest in being able to determine the geographic distribution of requests to its backend services in order to: (a) identify whether processing activities involving data subjects in specific jurisdictions (e.g., EEA, UK, Québec) are occurring, so that jurisdiction-specific legal obligations can be assessed; and (b) diagnose infrastructure incidents by reference to request patterns, including latency anomalies and error rates by region.

Strength of interest: Moderate. This interest is real and operationally necessary, but is secondary to Interest 1. It would not on its own justify retaining IP addresses for 30 days if they were not already being retained for abuse-prevention purposes.

4.3 Interest 3 — Licence compliance and product stewardship (supports Activity B) ​

Mapsted has a legitimate interest in maintaining records of how its API keys are being used in order to: (a) verify that Licensees are using the Software within the permitted scope of their Commercial Agreements; (b) detect misuse of API keys (sharing with unlicensed third parties, use outside permitted properties, use beyond agreed volume tiers); and (c) establish a baseline for future quota-management and tiered-access features that Mapsted intends to introduce as the product matures.

Strength of interest: Moderate-to-strong. Licence compliance monitoring is a recognised legitimate interest for commercial software providers. The interest is not trivial — unlicensed use of the Software erodes the commercial basis on which Mapsted operates and undermines the integrity of the Licensee tier system. The fact that quota enforcement is not yet active does not eliminate Mapsted's legitimate interest in retaining the records that would enable audit and future enforcement.

4.4 Purpose test conclusion ​

All three interests are specific, lawful, and not prohibited by any applicable statute or regulation. None involves sensitive personal data. None involves processing for the purpose of identifying, profiling, or tracking individual end users. The interests are consistent with established commercial software industry practice. The Purpose Test is satisfied for both Activity A and Activity B.

5. Part 2 — Necessity test ​

Question: Is the processing necessary to achieve the legitimate interests identified in §4, and could the interest be achieved through a less privacy-intrusive means?

5.1 Activity A — Necessity ​

Does the processing achieve the interest? Yes. Server access logs are the only mechanism by which Mapsted can detect anomalous traffic patterns, identify the source of abuse or attack traffic, and determine the geographic origin of requests for compliance purposes. Without IP address logging, Mapsted cannot distinguish a legitimate map-tile request from a denial-of-service amplification attack, a credential-stuffing probe, or a bulk-scraping operation.

Considered alternatives:

  • Aggregate-only logging (no IP addresses): An aggregated metrics-only approach (total requests per second, error rates, geographic region codes) would support infrastructure capacity planning but would not enable investigation of specific security incidents, identification of attack traffic, or production of the request-level audit trail required for legal proceedings or regulatory enquiries. This alternative does not achieve the same interest.
  • Shorter retention period: The 30-day retention period is calibrated to the operational requirement of having sufficient historical data to investigate security incidents, which may not be detected on the same day they occur. Industry norms for security-relevant access logs range from 30 to 90 days; Mapsted's 30-day period is at the short end of this range and is appropriate. Reducing retention further (e.g., 7 days) would materially reduce Mapsted's ability to investigate slow-burn attacks or identify patterns that span multiple weeks.
  • Anonymisation of IP addresses after 24 hours: Truncating the last octet of IPv4 addresses (e.g., 203.0.113.0/24) after a short window is a technique sometimes used in web analytics. For security and abuse-prevention purposes, this alternative is not equivalent — host-level IP resolution is required to identify and block specific attackers, and partial anonymisation makes that impossible. For the documentation-site access logs (a lower-security context), Mapsted may consider this approach in a future iteration; it is noted here as a candidate for the next review cycle.

Necessity conclusion for Activity A: The processing is necessary and proportionate. No less privacy-intrusive alternative achieves the same security and compliance objectives.

5.2 Activity B — Necessity ​

Does the processing achieve the interest? Yes. The API key is the only identifier by which a request can be attributed to a specific Licensee. Without retaining API-key usage records, Mapsted cannot audit usage against Commercial Agreement terms, investigate alleged misuse, or build the baseline data required for quota management.

Considered alternatives:

  • Session-level aggregation (counts only, no key in logs): Retaining only aggregate request counts by Licensee (not the key itself in each log line) would support quota management but would not support forensic audit of specific incidents or investigation of key-sharing patterns that vary by property ID or request path. This alternative is partially adopted: quota reporting (if implemented in future) will use aggregated counters rather than raw log lines. However, the raw log record is retained for the audit and security purposes described in §4.3.
  • Shorter retention period: Twelve months is calibrated to the Licensee billing cycle (typically annual Commercial Agreements) and to the applicable limitation period for commercial disputes (which in Ontario is generally two years under the Limitations Act, 2002). Reducing retention to, say, 30 days would prevent Mapsted from resolving a dispute raised by a Licensee three months into their annual contract. Twelve months is proportionate.

Necessity conclusion for Activity B: The processing is necessary and proportionate. No less privacy-intrusive alternative achieves the same licence-compliance and audit objectives.

5.3 Overall necessity conclusion ​

The Necessity Test is satisfied for both Activity A and Activity B. The data categories, retention periods, and processing scope are the minimum necessary to achieve the identified legitimate interests.

6. Part 3 — Balancing test ​

Question: Do the fundamental rights and freedoms of data subjects override the legitimate interests identified in §4?

6.1 Data subjects' interests and expectations ​

6.1.1 Privacy expectation — end users of Licensee applications ​

An end user who loads a Licensee web page containing an embedded map has a reasonable expectation that: (a) their browser's HTTP requests will reach the map provider's servers (this is technically necessary to display the map and is an expected feature of all web-based services); and (b) standard server-side request metadata, including IP addresses, will be logged by infrastructure operators for security and operational purposes.

The expectation that HTTP requests are logged by the recipient server is well established. GDPR Recital 47 requires that the data subject "can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place." Server-side security logging is ubiquitous across the internet; a technically-informed end user has a reasonable expectation that making an HTTP request results in the recipient's server recording the request.

This expectation is further grounded by the fact that the Software does not capture, transmit, or store end-user navigation behaviour, search queries, personal identifiers, or any data beyond standard HTTP request metadata. The data footprint is materially less invasive than a typical advertising-supported web service.

6.1.2 Freedom from profiling and automated decision-making ​

Data subjects have an interest in not being profiled or subjected to automated decisions producing legal or similarly significant effects (GDPR Art. 22). Mapsted does not use Activity A or Activity B data to profile end users, build individual behavioural profiles, make automated decisions about individuals, or share data with advertising platforms. IP address logs are used solely for security and operational purposes. This interest is not implicated.

6.1.3 Freedom from commercial exploitation of personal data ​

Data subjects have an interest in their personal data not being sold or used for targeted advertising without their consent. Mapsted does not sell, trade, or disclose server access log data to third parties for commercial purposes. The data is used only for the purposes identified in §4. This interest is not implicated.

6.1.4 Freedom of movement and location privacy ​

IP addresses may, in some circumstances, reveal approximate geographic location (city or region level). End users may have an interest in not revealing their location to third parties. In the context of the Software, the Licensee's page is already communicating with Mapsted's backend to display the map; the end user has made an implicit decision to load the map, which necessarily involves a network request to Mapsted's infrastructure. The geographic precision of IP-to-location mapping is typically city-level at most and does not constitute detailed location tracking. Mapsted does not perform real-time IP geolocation of end users or associate IP-to-location data with any individual profile.

6.2 Mapsted's interests ​

Mapsted's legitimate interests (§4) are significant. The integrity of the mapi.mapsted.com and maps.mapsted.com services is essential for Mapsted to deliver map sessions to Licensees and their end users. A successful denial-of-service attack or large-scale credential-stuffing campaign could render the Software unavailable for all Licensees simultaneously. The commercial interest in licence compliance monitoring is also substantial: Mapsted's revenue model depends on Licensees using the Software within the agreed terms.

Mapsted's Licensees also have an interest in the security and integrity of the backend services they rely on; a service degradation affects them directly. End users of Licensee applications likewise have an interest in the map service being available.

6.3 Weighing the interests ​

The balancing test weighs the data subjects' rights (§6.1) against Mapsted's interests (§6.2). The relevant factors are:

FactorAssessment
Sensitivity of dataLow. IP address and user-agent are standard HTTP metadata. No sensitive categories (Art. 9). No special category data. No children's data specifically.
Likely harm if processing continuesMinimal. No profiling, no sale, no automated decisions. The data is used only for security and licence purposes.
Likely harm if processing ceasesSignificant. Loss of ability to detect and respond to security incidents; inability to audit Licensee usage; exposure to service degradation attacks.
Data subjects' reasonable expectationsHigh expectation that HTTP infrastructure logs are maintained. Low expectation that Mapsted would not log standard request metadata.
Mitigations in placeStrong. 30-day retention cap; no third-party sale or sharing; right to object honoured; opt-in crash telemetry is the only additional telemetry.
Public benefitModerate. Secure and available map services benefit the Licensees and end users who rely on them, including members of the public using indoor navigation in airports, hospitals, and commercial venues.

The balance favours Mapsted's legitimate interests over the data subjects' interests for both Activity A and Activity B in all assessed jurisdictions. The data is minimally sensitive, the harm is low, the mitigations are strong, and the expectations are consistent with how internet infrastructure routinely operates.

6.4 Balancing test conclusion ​

The data subjects' fundamental rights and freedoms do not override the legitimate interests identified in §4. The Balancing Test is satisfied for both Activity A and Activity B.

7. Technical and organisational safeguards ​

The following safeguards are in place to protect data subjects' interests and reduce the privacy impact of the processing:

7.1 Data minimisation ​

The Software is architecturally designed to minimise the personal data that reaches Mapsted's backend:

  • Navigation events (entity selections, floor changes, routing requests, search terms, promotion interactions) travel exclusively via window.postMessage between the maps.mapsted.com iframe and the embedding Licensee page and are not transmitted to Mapsted's backend services.
  • The Software does not request or transmit end-user names, email addresses, passwords, or payment information.
  • The Software does not integrate any third-party advertising, analytics, or tracking network in the backend data path.
  • No cookies are set by the Software in the embedding Licensee page's origin. The maps.mapsted.com iframe may use session-scoped storage within its own origin as described in CP-MMA-001.

7.2 Retention limits ​

Data categoryRetention periodBasis
Server access logs (IP address, user-agent, Activity A)Thirty (30) daysOperational minimum for security investigation; PP-MMA-001 §6
API-key audit logs (Activity B)Twelve (12) monthsLicence-cycle alignment; PP-MMA-001 §6

Logs beyond these retention limits are automatically purged. Mapsted will implement automated deletion controls to enforce these limits and will document any technical constraints that prevent complete deletion in its response to any data subject request that covers these records.

7.3 Access controls ​

Access to server access logs and API-key audit records is restricted to authorised Mapsted personnel (engineering, security, and privacy operations roles) on a need-to-know basis. Access is granted via principal-based controls and logged. Mapsted maintains an audit trail of access to these records.

7.4 Encryption ​

All data in transit between end users' browsers and Mapsted's backend services is encrypted using TLS 1.3 preferred; TLS 1.2 minimum. TLS 1.0 and 1.1 are not supported. Data at rest on Mapsted-operated infrastructure is encrypted using AES-256 via the Google Cloud Platform default encryption service.

7.5 No third-party disclosure for commercial purposes ​

Mapsted does not sell, trade, or otherwise disclose Activity A or Activity B data to any third party for commercial purposes. The only disclosures are:

  • To cloud infrastructure subprocessors who process data on Mapsted's behalf under written agreements requiring privacy controls equivalent to Mapsted's own (see the Subprocessor List, SL-MMA-001).
  • To law enforcement or regulators where required by a valid legal order, subpoena, or applicable law.
  • In connection with a corporate transaction (merger, acquisition, reorganisation) where the successor entity agrees in writing to honour this LIA and the associated Privacy Policy.

7.6 Right to object ​

Data subjects have the right to object to processing based on legitimate interests under GDPR Article 21. Mapsted honours such objections as described in §11. The practical effect of an objection to Activity A is limited by the technical reality that an HTTP request's IP address is an inherent property of the connection rather than a datum that can be prospectively withheld by Mapsted; however, Mapsted will not use the IP address in any way beyond the purposes identified in §4 and will delete the record upon a valid, verified objection.

7.7 Privacy by design ​

The Software's core privacy design — routing all end-user interaction data through the client-side postMessage architecture rather than through Mapsted's backend — is the primary privacy safeguard. This design was a deliberate architectural choice that eliminates the most sensitive category of potential personal data (navigation and behavioural data) from Mapsted's server-side processing entirely.

8. DPIA-lite — Article 35 risk assessment ​

A full Data Protection Impact Assessment (DPIA) under GDPR Article 35 is required when processing is "likely to result in a high risk to the rights and freedoms of natural persons." This section performs a lite assessment.

8.1 Does this processing require a full DPIA? ​

The EDPB's WP248 rev.01 guidelines set out nine criteria; processing meeting two or more typically warrants a DPIA. Applying these to Activity A and Activity B:

CriterionActivity AActivity B
Evaluation or scoringNoNo
Automated decision-making with legal effectNoNo
Systematic monitoring of a publicly accessible areaPartial — server logs of publicly-accessible endpointsNo
Sensitive or special category data (Art. 9)NoNo
Data processed on a large scalePotentially — across multiple Licensees' end-user populationsNo (Licensee-only identifier)
Matching or combining datasetsNoNo
Data concerning vulnerable subjectsNoNo
Innovative use or new technical solutionsNo — server access logging is standard practiceNo
Prevents exercise of a right or use of a serviceNoNo

Activity A meets one criterion clearly (potentially large scale) and one partially (systematic monitoring). This combination is at the threshold. However, the data involved is standard HTTP metadata with no sensitive categories, the retention is short (30 days), the processing is not used for profiling or automated decisions, and the risk to data subjects is assessed as low. Mapsted's position is that Activity A does not require a full DPIA under the totality of the circumstances, and that this LIA constitutes sufficient documented risk assessment for the processing as currently scoped.

Activity B meets zero criteria. No DPIA is required.

If the scale of Activity A increases substantially (e.g., Mapsted introduces real-time IP geolocation, cross-Licensee analytics, or aggregated user-behaviour analysis), this assessment must be revised and a full DPIA conducted.

8.2 Risk assessment for Activity A ​

RiskLikelihoodSeverityMitigation
Unauthorised access to server access logs leaks IP addressesLowMedium — IPs linkable to individuals in combination with other dataEncryption at rest; access controls; 30-day retention cap limits exposure window
IP address used for individual profiling beyond stated purposesLowHigh — would exceed stated legitimate interest basisPurpose-limitation policy; no third-party sharing; audit trail of access
Data subject unaware of IP loggingMedium — most users are not aware of server log practicesLow — expectation is reasonable given internet norms; no harm materialises from the logging itself in the absence of a breachPrivacy Policy PP-MMA-001 §3 discloses the processing; this LIA is available on request
Law enforcement request for logs within retention windowLowMediumLegal response protocol; judicial review where applicable

8.3 DPIA-lite conclusion ​

The processing presents low-to-moderate risk to data subjects, adequately mitigated by the safeguards in §7. No full DPIA is required at the current scale and scope of processing. A full DPIA should be conducted if Mapsted introduces real-time IP geolocation, cross-Licensee analytics, or any processing not covered by this LIA before deployment.

9. Jurisdictional annexes ​

9.1 United States — CCPA/CPRA and state privacy laws ​

Applicable law: CCPA/CPRA (California, Cal. Civ. Code §§1798.100 et seq.); state-level privacy laws (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, others); FTC Act §5 (unfair and deceptive practices); federal sectoral laws (HIPAA not applicable; COPPA not applicable to this processing).

Legal basis: CCPA/CPRA does not use the GDPR "legitimate interests" concept. Processing for abuse prevention, network security, fraud detection, and operational purposes falls within the "business purposes" definition under Cal. Civ. Code §1798.140(e)(1) ("auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards") and §1798.140(e)(5) ("performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business"). Server security logging and API-key audit logging are squarely within "business purposes."

Opt-out rights: Mapsted does not sell or share personal information (as defined under CCPA/CPRA) and has no CCPA sale/sharing opt-out obligation with respect to Activity A or Activity B. California residents may submit privacy requests as described in §11 and in PP-MMA-001 §12.

Conclusion: Both Activity A and Activity B are lawful in the United States under applicable federal and state law.

9.2 Canada — PIPEDA and provincial privacy legislation ​

Applicable law: PIPEDA (SC 2000, c.5), particularly Schedule 1 Principle 4.3.4 (consent) and Principle 4.4 (limiting collection); Québec Act Respecting the Protection of Personal Information in the Private Sector (Law 25); Alberta PIPA; British Columbia PIPA.

Legal basis: PIPEDA Section 7(2)(c) permits collection of personal information without consent where obtaining consent would not be reasonably practicable. Collecting IP addresses from HTTP requests made by end users to a publicly-accessible web service is a case where it is not reasonably practicable to obtain prior consent for each request — the connection necessarily conveys the IP address before any consent mechanism could be presented. Mapsted relies on this provision for Activity A. For Activity B, the Licensee is a party to a Commercial Agreement and is on notice of API-key usage monitoring as part of the contractual relationship.

Québec Law 25: Law 25 applies to processing of personal information of Québec residents. Mapsted's processing under this LIA is proportionate to the commercial and operational purposes identified, and does not involve sensitive categories of information. The short retention periods (30 days and 12 months) are consistent with the minimisation principles of Law 25.

Privacy Officer: Mapsted has designated, or will designate, an individual responsible for privacy compliance under PIPEDA. Contact: privacy@mapsted.com.

Conclusion: Both Activity A and Activity B are lawful in Canada under PIPEDA and applicable provincial legislation.

9.3 United Kingdom — UK GDPR ​

Applicable law: UK GDPR (Data Protection Act 2018); ICO Codes of Practice.

Legal basis: UK GDPR Article 6(1)(f) is identical in structure to EU GDPR Article 6(1)(f). The ICO's "Legitimate interests" guidance (published at ico.org.uk) explicitly cites network security and fraud prevention as recognised legitimate interests. The three-part test in §§4–6 applies equally under UK GDPR.

UK-specific considerations: The ICO has historically taken a measured approach to enforcement of Article 6(1)(f) for standard infrastructure logging and licence compliance activities. The ICO's guidance distinguishes between high-risk processing (profiling, large-scale special category data, tracking) and routine operational processing (server logs, audit trails), treating the latter as generally proportionate when appropriate safeguards are in place. This LIA's processing falls in the latter category.

Data subject rights: Full UK GDPR rights apply as described in §11. UK residents may contact privacy@mapsted.com. Complaints may be directed to the Information Commissioner's Office (ico.org.uk).

Conclusion: Both Activity A and Activity B are lawful in the United Kingdom under UK GDPR.

9.4 European Economic Area — EU GDPR ​

Applicable law: GDPR (Regulation (EU) 2016/679); ePrivacy Directive (2002/58/EC, as amended); Member State implementing laws.

Legal basis: GDPR Article 6(1)(f). The three-part test in §§4–6 has been conducted in accordance with EDPB and Article 29 Working Party guidance.

GDPR Recital 49: Recital 49 provides specific recognition that "the processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, including preventing unauthorised access to electronic communications networks and malicious code distribution and stopping 'denial of service' attacks and damage to computer and electronic communication systems, constitutes a legitimate interest of the data controller concerned." Activity A falls squarely within Recital 49.

Jurisdictional variation within the EU: Enforcement posture varies by Member State. Germany (BDSG and decentralised DPAs) and France (CNIL) tend toward stricter enforcement. However, server-side security logging for abuse prevention and licence compliance audit is not an activity that any EU supervisory authority has prohibited; it is a routine and expected practice for commercial web services. The safeguards in §7 (short retention, no third-party sharing, no profiling, right to object) bring this processing well within the proportionality expected of Article 6(1)(f) reliance.

Mapsted Corp. has not appointed a Union representative under GDPR Art. 27; Mapsted's EU market offering is currently B2B to Licensees who are themselves EU-established data controllers. Should direct-to-EU-data-subject processing be introduced, Mapsted will appoint an Article 27 representative and publish the appointment in this Assessment.

Conclusion: Both Activity A and Activity B are lawful in the European Economic Area under EU GDPR, subject to the safeguards in §7 and the jurisdictional annotation above.

9.5 Other jurisdictions ​

Mapsted's current commercial operations are primarily in Canada, the United States, the United Kingdom, and the EEA. This LIA does not authorise reliance on legitimate interests in jurisdictions not covered by §§9.1–9.4. Mapsted will complete jurisdiction-specific annexes before expanding commercial operations to other territories.

10. Records of processing (GDPR Art. 30) ​

GDPR Article 30 requires data controllers to maintain a record of processing activities. The following records correspond to the processing covered by this LIA.

10.1 Controller identity ​

  • Name and contact details of the controller: Mapsted Corp. and its subsidiaries, affiliates, and related entities — info@mapsted.com
  • Data Protection Officer / Privacy Lead: Designated or to be designated; contact privacy@mapsted.com
  • EU / UK representative: To be designated before or upon commencement of commercial operations requiring a representative under GDPR Art. 27 or UK GDPR Art. 27.

10.2 Purposes of processing ​

  • Activity A: Service security, abuse prevention, fraud detection, regional compliance assessment, infrastructure diagnostics.
  • Activity B: Licence compliance monitoring, API-key misuse detection, usage baseline for future quota management.

10.3 Categories of data subjects ​

  • End users of Licensee applications whose browsers make HTTP requests to mapi.mapsted.com or maps.mapsted.com (Activity A).
  • Visitors to docs.mapsted.com/maps-js-api (Activity A, documentation-site logs).
  • Licensees and individual developers whose API keys appear in access logs (Activity B).

10.4 Categories of personal data ​

  • IP addresses (Activity A).
  • User-agent strings (Activity A).
  • Request metadata (path, timestamp, referrer, status code) (Activity A).
  • API-key identifiers (Activity B).

10.5 Categories of recipients ​

  • Google Cloud Platform (cloud infrastructure subprocessor — see SL-MMA-001).
  • Mapsted security and engineering personnel with documented need-to-know access.
  • Law enforcement or regulators, upon valid legal order only.

10.6 International data transfers ​

Personal data may be processed on infrastructure operated by Mapsted or its subprocessors in Canada, the United States, or other jurisdictions. Where data originates in the EEA or UK:

  • EEA: Mapsted relies on Standard Contractual Clauses (EU Commission Decision 2021/914, Module 2 (Controller-to-Processor)) for transfers to subprocessors in countries without an adequacy decision.
  • UK: Mapsted relies on the UK International Data Transfer Addendum (IDTA), version B1.0 (ICO-approved).

A full subprocessor list and Transfer Impact Assessment are available to Licensees upon written request to privacy@mapsted.com.

10.7 Retention periods ​

Data categoryRetention period
Server access logs (IP address, user-agent) — Activity AThirty (30) days
API-key audit logs — Activity BTwelve (12) months

10.8 Technical and organisational measures ​

See §7 of this LIA.

11. Data subject rights and mechanisms ​

11.1 Right of access (Art. 15) ​

A data subject may request confirmation that Mapsted holds personal data about them. For Activity A, Mapsted will search server access logs within the retention window using the IP address(es) provided by the data subject and will produce the records found, subject to the 30-day retention limit and to any overriding interests (e.g., concealing investigation-in-progress data). For Activity B, a data subject who is an individual Licensee may request their API-key usage records.

11.2 Right to rectification (Art. 16) ​

Server access logs are immutable audit records. Mapsted will note any correction in a supplementary record rather than altering the original log, consistent with standard audit-trail practice.

11.3 Right to erasure (Art. 17) ​

Data subjects may request deletion of personal data Mapsted holds about them. For Activity A, the 30-day automatic deletion cycle means that the data will in most cases already have been purged by the time a request is received. Where records remain within the retention window, Mapsted will delete the relevant records unless retention is required for a legal obligation (e.g., an active security investigation, a law enforcement hold, or a pending legal proceeding). For Activity B, Mapsted will assess each erasure request against its licence-compliance and audit obligations.

11.4 Right to restriction (Art. 18) ​

Data subjects may request restriction of processing while a dispute is resolved. Mapsted will flag the relevant records as restricted and limit further processing to storage only while the dispute is pending.

11.5 Right to object (Art. 21) ​

Data subjects may object to Mapsted's processing based on legitimate interests. Mapsted will cease the processing unless it can demonstrate compelling legitimate grounds that override the data subject's interests. Given the nature of Activity A (server logs of HTTP connections already made), an objection operates prospectively rather than retroactively; Mapsted will not use the data subject's IP address for purposes beyond those identified in §4 following receipt of a valid objection. For Activity B, Mapsted will assess each objection against its licence-compliance obligations.

11.6 DSR contact and response times ​

  • Email: privacy@mapsted.com
  • Web: https://www.mapsted.com/contact-us
  • Response times: GDPR — one month (extendable by a further two months for complex or numerous requests); CCPA — forty-five (45) days (extendable by a further forty-five (45) days with notice); PIPEDA — thirty (30) days (extendable by a further thirty (30) days with notice).
  • Identity verification: Mapsted will verify the identity of the requestor before disclosing, deleting, or restricting records. For Activity A, Mapsted may request the IP address and approximate date/time of the requests at issue to locate the relevant records.

12. Review schedule ​

12.1 Mandatory review triggers ​

This LIA must be reviewed and updated:

  • Annually, at a minimum, by Mapsted's Privacy Lead or designated Data Protection Officer.
  • Upon any material change in the Software's data-collection scope (new data categories, new backend endpoints, new telemetry).
  • Upon any material change in applicable law — including new GDPR guidance from the EDPB, new state privacy laws in the US, new Canadian federal or provincial legislation, or ICO guidance relevant to network security logging.
  • Upon any material security incident (data breach, regulatory investigation, or civil proceeding) affecting Activity A or Activity B data.
  • Upon material scale changes — if the volume of Activity A processing increases substantially (e.g., Mapsted onboards Licensees serving tens of millions of end users per day), a full DPIA should be conducted.
  • Upon expansion to new jurisdictions not covered by §9.

12.2 Change log ​

DateVersionAuthorChanges
2026-04-231.0Mapsted engineering teamInitial draft

13. Sign-off and approval ​

13.1 Mapsted Privacy Lead / Data Protection Officer ​

Name: _________________________________________________ Date: _________________________________________________

Mapsted's designated Privacy Lead (or, where required under GDPR Art. 37, a formal Data Protection Officer) must review this LIA and confirm that the analysis is consistent with Mapsted's privacy risk tolerance and current operational practices.

13.2 Mapsted Legal Team ​

Reviewer: _________________________________________________ Date: _________________________________________________

Mapsted Legal must review this entire LIA, including the jurisdictional annexes, and confirm that the analysis is consistent with applicable law and Mapsted's legal risk tolerance. Specifically, Mapsted Legal should confirm or amend:

  1. Whether an EU representative under GDPR Art. 27 should be designated before the LIA is finalised (§9.4).
  2. Whether the 30-day retention period for Activity A and the 12-month retention period for Activity B are consistent with Mapsted's operational infrastructure capabilities and records policies.
  3. Whether the "reserved-right" framing for Activity B (API-key validation not currently enforced) accurately reflects Mapsted's product roadmap and commercial agreements.
  4. Whether any Member State-specific DPIA or supervisory authority engagement is required before the Software is commercially operated in any EU Member State.

13.3 Mapsted Owner / Authorised Signatory ​

Name: _________________________________________________ Date: _________________________________________________

Mapsted's authorised operational signatory must confirm that this LIA accurately reflects Mapsted's current processing activities and that the safeguards described in §7 are in place or will be in place before any new processing described in this LIA commences.

14. References ​

14.1 Primary legal authorities ​

  • GDPR (Regulation (EU) 2016/679), particularly Articles 5, 6, 13, 14, 15–22, 30, 32, 35–36, and Recitals 47, 49, 50.
  • UK GDPR (Data Protection Act 2018, as retained and amended in UK law).
  • PIPEDA (Personal Information Protection and Electronic Documents Act, SC 2000, c.5), particularly Schedule 1 and Section 7.
  • Québec Act Respecting the Protection of Personal Information in the Private Sector (Law 25 / Bill 64).
  • CCPA/CPRA (California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020), Cal. Civ. Code §§1798.100 et seq.
  • Ontario Limitations Act, 2002, SO 2002, c.24 Sch.B (for retention period analysis in §5.2).

14.2 Regulatory guidance ​

  • EDPB Guidelines 06/2020 on the notions of controller and processor in the GDPR (EDPB 2021), relevant to dual-role analysis in §2.
  • EDPB WP248 rev.01 — Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is "likely to result in a high risk" (cited in §8).
  • Article 29 Working Party Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC (WP217) (cited in §4).
  • GDPR Recital 49 — network and information security as a legitimate interest (cited in §4.1 and §9.4).
  • UK ICO — "Legitimate interests" guidance, ico.org.uk (cited in §9.3).
  • Office of the Privacy Commissioner of Canada — guidance on privacy in commercial internet services (cited in §9.2).

14.3 Supporting Mapsted documents ​

  • Privacy Policy — PP-MMA-001 · §5 cites this LIA as the documented Art. 6(1)(f) basis for IP logging and API-key telemetry; §3 confirms the postMessage architecture that keeps navigation data client-side only.
  • Cookie Policy — CP-MMA-001 · documents the minimal storage footprint of the Software.
  • Subprocessor List — SL-MMA-001 · identifies cloud infrastructure subprocessors who may handle Activity A and Activity B data.
  • Security Policy — SP-MMA-001 · documents the technical security controls relevant to the safeguards in §7.
  • Data Processing Addendum — DPA-MMA-001 · governs Mapsted's processor-role processing on behalf of Licensees.