MangoMap Limited ("we", "us", "our") are committed to protecting and respecting your privacy and keeping your Personal Information secure.

This policy, together with our Terms of Service and any other documents that they refer to, sets out the Personal Information we may collect from you, how we use it, where we store it, who we may disclose it to, and the rights you have over it.

Please read this policy carefully to understand our views and practices regarding your personal data and how we will treat it. Any capitalized terms used herein without definition shall have the meaning given to them in the Terms of Service.

Who Is the Data Controller

MangoMap Limited, of 1 Victoria Street, Bristol, BS1 6AA, England (registered at Companies House with company number 08388830, and trading as Mangomap and Mango), is the data controller for the account, billing, support, usage and log data described in this policy: the information we need in order to run the Service and our business.

For the geospatial and business data you upload to MangoMap ("User Data"), the position is different: you are the data controller and MangoMap is the data processor. We process that data only on your instructions, and only to provide the Service to you. If your User Data contains personal information about your own customers, employees or members of the public, you remain responsible for it as its controller. A Data Processing Agreement covering our role as your processor is available on request; contact support@mangomap.com.

Information We May Collect From You

Information you provide us directly

While using our Service, we may ask you to provide certain personally identifiable information that can be used to contact or identify you. This may include:

• Email address
• Name
• Credit card or billing information (when you register for a trial Account, check out of a paid plan, or register as a Partner). Card details are collected and stored by our billing provider, Recurly. MangoMap does not store card data
• Any opinions or complaints you raise regarding the Service
• Details of actions you carry out while using the Service

Information from websites that use our Services

We collect information when you visit or use third-party websites and apps that use our Services (such as an embedded map). This includes information about the websites you visit, your usage patterns of our Services on those websites, and information provided by the developer or publisher of the website, such as usage statistics and user feedback.

Information we may receive from third parties

We may receive information about you from third parties, including our business partners (for example, information on potential leads or customers), third-party suppliers, and customers (for example, feedback or user data from organizations using our Service).

Log data

We may also collect information that your browser sends whenever you visit our Service ("Log Data"). This may include:

• IP address: your computer's Internet Protocol address
• Operating system: information about your operating system
• Browser details: browser type, version, and language
• Time zone: your time zone setting
• Page visits: the pages of our Service that you visit
• Visit details: the time and date of your visit, the time spent on those pages, and other related statistics

Approximate location

We do not operate our own visitor geolocation service. The IP address received by our analytics and advertising providers (listed under Sub-processors below) may be used by those providers to infer an approximate location (for example a country, region or city) as part of their standard functionality.

Precise location

Where a map owner has enabled the geolocation tool on a map, an end user can choose to show their own position on that map. If they do, the browser requests their precise device location (via GPS, Bluetooth, or WiFi-based positioning, depending on the device) through a standard browser permission prompt. This is not derived, collected, or stored by MangoMap unless and until the user takes that action and grants permission.

Session recordings

One of our website analytics providers, Microsoft Clarity, records interactions on our marketing site, including mouse movement, heatmaps and session replays. It is configured with masking enabled: passwords, payment information and customer-uploaded data viewers are excluded from these recordings.

Cookies and similar technologies

Cookies are small files stored on your device by your browser. We and our third-party partners use cookies and similar technologies (including browser local storage) to operate the Service, understand how you interact with it, remember your preferences, and measure our marketing.

The categories we use are:

• Essential: necessary for the operation of our Service
• Performance: help us understand how you use our Service, so we can improve it
• Functional: remember your preferences and enhance your experience
• Targeting: used to deliver relevant advertisements to you

When you first visit mangomap.com we show you a cookie notice. Google's analytics and advertising tags are governed by that notice: they are set to denied until you accept. Other analytics and testing providers listed under Sub-processors below may set cookies or use local storage when the page loads.

You can instruct your browser to refuse all cookies, to tell you when a cookie is being sent, or to delete cookies already stored. If you do not accept cookies, certain portions of the Service may not function properly.

Advertising and A/B testing tags run on our public marketing site only. They do not run inside the authenticated MangoMap application, so end users viewing or editing maps are not subject to advertising tracking.

Our Lawful Bases for Processing

Where the EU or UK GDPR applies, we rely on the following lawful bases:

• Performance of a contract: creating and administering your account, providing and supporting the Service, and billing you for it
• Legitimate interests: securing the Service and preventing fraud and abuse, understanding how the Service is used so we can improve it, and contacting business customers about products relevant to them. We balance these interests against your rights, and you can object at any time
• Consent: non-essential cookies, advertising, and marketing communications where consent is required. You can withdraw consent at any time
• Legal obligation: meeting our tax, accounting and other statutory duties, and responding to lawful requests from authorities

Where we act as your processor for User Data, we process it on your instructions and you are responsible for establishing the lawful basis for that processing.

How We Use Your Information

We use Personal Information to operate, maintain and provide you with the features and functionality of the Service. This includes:

• Service delivery: identification, authentication, and billing
• Service-related messages: account verification, invoices, confirmations, changes or updates to features, and technical and security announcements
• Support: responding to your questions and resolving issues you raise
• Improvement: analysing usage patterns to improve the Service and develop new features

We may also contact you with newsletters, marketing or promotional materials, and other information that may be of interest to you, with the option to opt out at any time.

How We Store Your Information

Personal Information collected by MangoMap Limited is stored on our servers and is accessible only to authorized employees, or to the sub-processors listed below for the purposes set out in this policy. We encrypt data at rest and in transit and apply role-based access controls.

For detail on how we do this, see our Data Security, Processing, and Storage policy.

Where We Store Your Information, and International Transfers

Your data is stored and processed in the United States, in the Amazon Web Services US East region (us-east-1, Northern Virginia). The majority of our sub-processors are also based in the United States. MangoMap Limited is a UK company, so this is a cross-border transfer of personal data.

Regional data residency in other jurisdictions is not currently available; all customers are hosted in the same region.

The safeguards we rely on are:

• EU and UK personal data (GDPR). Transfers to our US-based sub-processors are governed by Standard Contractual Clauses, incorporated into each sub-processor's standard Data Processing Addendum.
• Australia (Australian Privacy Principle 8). Our use of US-based infrastructure is a cross-border disclosure. The reasonable steps we take to ensure overseas recipients handle your information consistently with the APPs are: using sub-processors that hold relevant security and privacy certifications; relying on their standard contractual commitments; disclosing the cross-border processing here; and, in the case of our infrastructure provider, its IRAP assessment.
• Canada (PIPEDA), New Zealand (IPP 12), and California (CCPA/CPRA). We rely on our sub-processors' security certifications and standard contractual commitments, together with the disclosure of cross-border processing in this policy.
• India (DPDP Act 2023). We act as a Data Processor for customer-uploaded personal data. Processing in the United States is permitted under the DPDP Act framework, as the United States is not subject to a restriction notification by the Indian government.

Sub-processors

We use the third parties below to provide the Service. They have access to Personal Information only to perform tasks on our behalf, and are contractually obliged not to disclose or use it for any other purpose.

Core service

These are involved in operating and delivering MangoMap itself.

Analytics

These collect behavioural and usage data. No customer-uploaded geospatial data is processed by them.

Marketing

These operate via tracking pixels on our marketing pages only, and do not run inside the authenticated application.

Internal business operations

These process our own business data. They do not process customer account or customer-uploaded data.

If you sign a Data Processing Agreement with us, this list is attached to it as a contractually binding document, and we will notify you of additions or material changes to it.

Marketing and Communications

We may use your Personal Information to contact you with newsletters, marketing or promotional materials, and other information that may be of interest to you. You can opt out of any or all of these communications by following the unsubscribe link in any email we send, or by contacting us directly.

We also use remarketing services to advertise on third-party websites after you have visited our Service. We and our third-party vendors use cookies to inform, optimize and serve ads based on your previous interactions with our marketing site.

How Long We Keep Your Information

We retain your account information and User Data for as long as your account is active, both during a free trial and for the life of a paid subscription.

Following cancellation, the expiry of a trial, or the closure of your account, we delete your maps, layers, datasets and remaining Personal Information. We aim to complete this within 30 days of closure. Once deleted from our live systems, copies may persist in our encrypted backups until those backups age out on their normal retention cycle. See Data Security for those periods.

Deleting your account from within the product removes your account and profile information and your login credentials. If you also want your maps, layers and datasets deleted, contact support@mangomap.com.

We may retain a limited amount of information for longer where we are required to for legal, tax, accounting or audit purposes, or to establish, exercise or defend legal claims.

Disclosure and Compliance with Laws

We may disclose your Personal Information to selected third parties in these circumstances:

• Business transactions: if we sell or buy any business or assets, we may disclose your Personal Information to the prospective seller or buyer
• Acquisition: if MangoMap Limited or substantially all of its assets are acquired by a third party, your Personal Information may be transferred to the acquiring party
• Sub-processors: as listed above, for the purposes of providing the Service
• Legal compliance: where required to do so by law or subpoena, or where we believe it necessary to comply with the law and reasonable requests of law enforcement, or to protect the security or integrity of our Service

Your Rights

Where the EU or UK GDPR applies, you have the following rights over your Personal Information. Equivalent or comparable rights apply under other privacy laws; see Regional rights below.

• Access: obtain a copy of the Personal Information we hold about you
• Rectification: have inaccurate or incomplete information corrected
• Erasure: have your Personal Information deleted where it is no longer necessary for the purpose it was collected for, or where you withdraw your consent
• Restriction: ask us to limit how we process your information while a query about it is resolved
• Portability: receive the information you provided to us in a structured, commonly used, machine-readable format. In practice, your spatial data can be exported from the product at any time as GeoJSON, CSV or Shapefile; any other personal data is provided on request
• Objection: object to processing based on our legitimate interests, and to direct marketing at any time
• Withdraw consent: where we rely on consent, withdraw it at any time. This does not affect processing carried out before you withdrew it
• Complain to a regulator: lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EU it is the authority in your country of residence

How to exercise them. Send your request to support@mangomap.com. We will respond within 30 days. We verify identity by confirming that the request comes from, or that you otherwise control, the email address associated with the account. There is no charge for making a request.

We will comply with your request unless we are required to retain the information to meet a legal obligation, or for the establishment, exercise or defence of legal claims.

Regional rights

• Australia. We handle Personal Information in line with the Australian Privacy Principles, including APP 1 (open and transparent management), APP 5 (notification of collection), APP 6 (use and disclosure), APP 8 (cross-border disclosure), APP 11 (security), APP 12 (access) and APP 13 (correction). You may complain to the Office of the Australian Information Commissioner.
• California. Under the CCPA/CPRA you have the right to know what personal information we collect and how we use and disclose it, the right to request deletion and correction, and the right not to be discriminated against for exercising those rights. We do not sell your personal information.
• Canada. We handle Personal Information consistently with PIPEDA, including its accountability principle for information processed on our behalf by third parties.
• New Zealand. We handle Personal Information consistently with the Privacy Act 2020, including Information Privacy Principle 12 on overseas disclosure.
• India. Under the DPDP Act 2023 we act as a Data Processor for customer-uploaded personal data, with the customer organisation acting as the Data Fiduciary. We support Data Fiduciaries in handling data principal rights requests.

Contacting Us About Privacy

For data subject requests, and for any question about this policy, contact support@mangomap.com.

For data protection and security enquiries, including anything relating to a Data Processing Agreement, our sub-processors, or a security review, contact security@mangomap.com.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, and we review it at least annually. We will notify you of any changes by posting the new policy on this page and updating the date at the top. Changes are effective when they are posted.

How can you contact us about this notice?

Any comments, questions, or requests regarding this Privacy Policy can be made by contacting support@mangomap.com.

support@mangomap.com
1 Victoria Street
Bristol, BS1 6AA
United Kingdom