‍Mapbox Privacy Policy

This privacy policy describes the personal data Mapbox and/or its affiliates (hereinafter collectively referred to as “Mapbox”) may receive and why such personal data may be received in its capacity as a data controller, how such personal data may be used (including whom it may be shared with and for what purposes), and choices about such personal data.    

‍

See Section 9 for "California Notice At Collection"

‍

This privacy policy applies to the extent Mapbox processes personal data in its capacity as a data controller under the GDPR (or “business” under the CCPA) when an individual: (a) visits and engages with any of Mapbox’s websites, (b) attends a virtual or in-person Mapbox event, (c) provides contact information for the purposes of Mapbox contacting about Mapbox products/services, (d) uses third-party websites or applications that cite this privacy policy, (e) provide billing information for Mapbox products/services account administration, or (f) apply to or are contacted about possible employment with Mapbox. Personal data is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined in the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. and its implementing regulations (“CCPA”), or relating to an identified or identifiable natural person (hereinafter referred to as "personal data").

This Privacy Policy does not apply when Mapbox acts as a data processor.  Most Mapbox customer personal data is not governed by this policy. Mapbox operates in the capacity of a data processor (and not a data controller) for customer personal data when operating Mapbox’s  products/services that are purchased by developers and businesses to develop their own licensed applications. As such, customers/prospective customers should read Mapbox’s data processing addendum (“DPA”): https://www.mapbox.com/legal/dpa which governs personal data that may be processed through use of Mapbox products/services including creation of a Mapbox products/services account. 

Corporate Accounts: If any account created with Mapbox lists a corporate email address for a company with which an individual is currently (or was formerly) employed (a “Corporate Email”), then the corporate entity to whom the Corporate Email pertains is responsible for privacy practices relating to use of Corporate Email. If Corporate Email is used within the scope of this privacy policy (as described at the top of this privacy policy), then this privacy policy applies.  For clarification, commonly known personal email account services (e.g., Gmail, Yahoo, Outlook) are not Corporate Email.  

‍

Personal Data Mapbox May Receive     

• ‍Identifiers: Such as, name, address, email, phone number, Mapbox account username.

• Commercial information: Such as, transaction data including billing contact’s name, work phone number, work email, work address, professional title, and company name. 

• Financial data: Such as, credit card data is not processed by Mapbox. Instead, credit card data is processed by Stripe, a third-party PCI-certified payment service provider, in accordance with its Privacy Policy.

• Internet or other network or device activity: When visiting any Mapbox websites, Mapbox automatically receives certain information such as: (a) browser and device type, (b) operating system, and (c) referring web pages including the pages visited on such sites. And information such as, IP address, data collected via strictly necessary and accepted website cookies / similar technologies. For information about cookies on Mapbox’s website, settings, and how to change browser cookie settings, please visit Mapbox’s website here.

• Employment data: Such as, education and employment history and other relevant personal data provided in an employment application submitted to Mapbox, information from a background check including information provided from reference checks.

• Location information: Such as, the location of an event where an individual signed up to receive communication or interact with Mapbox.

• User-generated content: Such as, a public comment provided by an individual in a Mapbox hosted webinar, Mapbox blog, or like Mapbox forum. For avoidance of doubt, an individual’s Mapbox product/service feedback does not constitute user-generated content. 

• Inference data about an individual: Such as, services Mapbox thinks an individual may be interested in based on prior purchases or website browsing, subject to the Mapbox cookie policy. 

• Other information that identifies or can be reasonably associated with an individual: Such as, contents of correspondence with: 1) a Mapbox service provider in order to bill for items that may have been shipped upon an individual’s request as a result of the individual’s engagement with a Mapbox marketing campaign in person or virtually. 2) Mapbox, whether received through a form submitted on its website, conversation (in person, virtual, or phone call) with its staff, or via an email sent to an [at]mapbox email account. 3) And such as, personal data from entities who provide personal data about individuals, their job functions, and the companies they work for. Such entities attests to Mapbox that they have obtained all necessary consents and have lawful grounds to share such personal data with Mapbox.

‍

How Mapbox Uses Personal Data      

Mapbox uses personal data to:       

• Provide, test, maintain/support, secure and improve Mapbox’s websites, to prevent fraud, misuse and cyberattacks, to calculate de-identified aggregate statistics, and for account administration/ billing purposes. 
• Send marketing information, product recommendations and other non-transactional communications (e.g., marketing newsletters, telemarketing calls, SMS or push notifications, information about Mapbox products, news or events) about Mapbox, its affiliates and partners.
• Plan or host virtual or in person events, contests, or other programs.
• Create and manage the recruitment system, job applications and a database of interested individuals and leads (including verifying the information provided to Mapbox) and assess and evaluate applicants skills and qualifications against the position(s) applied for.
• Cooperate with public and government authorities, courts or regulators in accordance with Mapbox’s legal obligations.  
• Comply with applicable law.

‍

To Whom Mapbox May Disclose Personal Data    

Mapbox may disclose personal data to:

• Mapbox service providers who need to access such personal data in order to provide any of the services, or related services to those, outlined in Section 2 of this privacy policy. However, prior to sharing personal data with such parties, Mapbox will have a written agreement consistent with the obligations outlined in applicable data protection laws and regulations.                                                                           
• Advertising and analytics partners. Any secondary use or sharing of personal data obtained through the use of third party cookies by these third parties is subject to their respective privacy policies. For information about cookies on Mapbox’s website and how to change browser cookie settings, please visit Mapbox’s website here.

• In response to a request so long as Mapbox believes disclosure is in accordance with, or required by, any applicable law, regulation or legal process. 
• If Mapbox has a good-faith belief that access, use, preservation, or disclosure of the personal data is reasonably necessary to enforce its terms of service, detect, prevent, or otherwise address threats to its platform, or protect against harm to the rights, property or safety of Mapbox, its users, or the public as required or permitted by law. 
• In connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of Mapbox’s business by another company. 

‍‍

International Transfers

Personal data may be processed by one or more of Mapbox’s affiliates, processors, or service providers in order to operate Mapbox’s business. Therefore, personal data may be processed outside of the location(s) where an individual engaged with Mapbox within the scope of this privacy policy. Personal data may also be processed at Mapbox’s select affiliates' locations and in the United States for account administration and billing.  

Mapbox ensures that the transfer of personal data offers an adequate level of protection and security, for instance by entering into the appropriate agreements that continuously ensure the same level of protective measures as set forth in applicable data protection laws and regulations and, if required, standard contractual clauses or an alternative mechanism for the transfer of data as approved by the European Commission (Art. 46 GDPR) or other applicable regulators or legislators. 

ADDITIONAL INFORMATION FOR INDIVIDUALS OUTSIDE THE UNITED STATES

4.1 Legal bases for processing personal data: 

Some countries require that companies only process personal data if they have a “legal basis” (or justifiable need) to process personal data. To the extent those laws apply, Mapbox’s legal bases for processing personal data are as follows:

• To perform a contract between the individual and Mapbox, or to take steps at the individual’s request prior to entering into a contract.
• To comply with a legal obligation to which Mapbox, as a controller, is subject.
• To protect the vital interests of an individual or of another natural person.
• For the purposes of the legitimate interests pursued by Mapbox as the controller or by a third party, except where the individual’s interests or fundamental rights and freedoms override such interests.

‍

Retention 

Mapbox stores personal data for so long as it is needed to fulfill the purposes for which it was collected, as described in Section 2 of this privacy policy.

‍

Security

Mapbox takes steps designed to secure personal data in accordance with this privacy policy.  Unfortunately, no system is 100% secure, and Mapbox cannot ensure or warrant the security of any personal data it receives.  To the fullest extent permitted by applicable law, Mapbox does not accept liability for unintentional or accidental destruction, loss, alteration, unauthorized disclosure or access.

‍‍

Children

Mapbox products/services, websites, events, and other communications are not intended or directed to children under the age of 18 (or other age of majority as required by local law), and Mapbox does not knowingly collect personal data from children. If the parent or legal guardian learns that their child has provided Mapbox with personal data without their consent, then they should contact Mapbox as set forth below in the Contact Mapbox section of this privacy policy. If Mapbox learns that it has collected personal data in violation of applicable law, it will promptly take steps to delete such personal data.

‍

Choices About Personal Data

An individual may opt-out of processing of their personal data within the scope of this privacy policy at any time and prevent further Mapbox processing by contacting Mapbox as described below. 

• Email and Telephone Communications:

Click the unsubscribe link found at the bottom of the email received from Mapbox to opt out of receiving future commercial emails. Note that for current customers, Mapbox will continue to send non-promotional communications which may not be opted out of (e.g., communications regarding products/services or updates to Mapbox Terms or this privacy policy). Mapbox processes requests to be placed on do-not-mail, do-not-phone, and do-not-contact lists as required by applicable law.

• Website logs and cookies:

Devices have settings to delete stored cookies and most browsers have the option to decline cookies. However, certain parts of Mapbox’s website (including pages that require login) will not be accessible if Mapbox cookies (first party cookies) are not accepted. In contrast, third-party cookies set by third parties for marketing and analytics purposes on Mapbox’s website can be disabled, in principle, without affecting access. For information about cookies on Mapbox’s website and how to change browser cookie settings, please visit the Mapbox website here. 

• In accordance with applicable law, the individual to whom the personal data pertains may have the following rights regarding their personal data:

• Access/view personal data  
• Portability of personal data in a commonly machine readable format 
• Correct personal data where it is inaccurate or incomplete
• Deletion of personal data
• Restrict or object to processing of personal data
• Opt-out of the sale of personal data, if applicable, where such requests are permitted by law and as defined in the CCPA.

To exercise your right to deletion of personal data, please complete the form here. For any other rights, please contact Mapbox at privacy@mapbox.com. In your email include  name, and request or question. To protect privacy, Mapbox will take steps to verify the identity of the requestor before fulfilling the request. Mapbox will process such requests in accordance with applicable laws. Although we encourage you to contact us if you have questions or complaints, you also have the right to lodge a complaint in the EU and UK with the appropriate supervisory authority in your jurisdiction. In some cases, these rights may be subject to exceptions, as permitted by applicable law. 

‍

‍

Additional Information For California Residents

9.1 California Notice At Collection:

Personal Data Mapbox May Receive

• ‍Identifiers: Such as, name, address, email, phone number, Mapbox account username.

• Commercial information: Such as, transaction data including billing contact’s name, work phone number, work email, work address, professional title, and company name. 

• Financial data: Such as, credit card data is not processed by Mapbox. Instead, credit card data is processed by Stripe, a third-party PCI-certified payment service provider, in accordance with its Privacy Policy.

• Internet or other network or device activity: When visiting any Mapbox websites, Mapbox automatically receives certain information such as: (a) browser and device type, (b) operating system, and (c) referring web pages including the pages visited on such sites. And information such as, IP address, data collected via strictly necessary and accepted website cookies / similar technologies. For information about cookies on Mapbox’s website, settings, and how to change browser cookie settings, please visit Mapbox’s website here.

• Employment data: Such as, education and employment history and other relevant personal data provided in an employment application submitted to Mapbox, information from a background check including information provided from reference checks.

• Location information: Such as, the location of an event where an individual signed up to receive communication or interact with Mapbox.

• User-generated content: Such as, a public comment provided by an individual in a Mapbox hosted webinar, Mapbox blog, or like Mapbox forum. For avoidance of doubt, an individual’s Mapbox product/service feedback does not constitute user-generated content. 

• Inference data about an individual: Such as, services Mapbox thinks an individual may be interested in based on prior purchases or website browsing, subject to the Mapbox cookie policy. 

• Other information that identifies or can be reasonably associated with an individual: Such as, contents of correspondence with: 1) a Mapbox service provider in order to bill for items that may have been shipped upon an individual’s request as a result of the individual’s engagement with a Mapbox marketing campaign in person or virtually. 2) Mapbox, whether received through a form submitted on its website, conversation (in person, virtual, or phone call) with its staff, or via an email sent to an [at]mapbox email account. 3) And such as, personal data from entities who provide personal data about individuals, their job functions, and the companies they work for. Such entities attests to Mapbox that they have obtained all necessary consents and have lawful grounds to share such personal data with Mapbox.

‍

How Mapbox Uses Personal Data 

• Provide, test, maintain/support, secure and improve Mapbox’s websites, to prevent fraud, misuse and cyberattacks, to calculate de-identified aggregate statistics, and for account administration/ billing purposes. 
• Send marketing information, product recommendations and other non-transactional communications (e.g., marketing newsletters, telemarketing calls, SMS or push notifications, information about Mapbox products, news or events) about Mapbox, its affiliates and partners.
• Plan or host virtual or in person events, contests, or other programs.
• Create and manage the recruitment system, job applications and a database of interested individuals and leads (including verifying the information provided to Mapbox) and assess and evaluate applicants skills and qualifications against the position(s) applied for.
• Cooperate with public and government authorities, courts or regulators in accordance with Mapbox’s legal obligations.  
• Comply with applicable law.

‍

To Whom Mapbox May Disclose Personal Data  

• Mapbox service providers who need to access such personal data in order to provide any of the services, or related services to those, outlined in Section 2 of this privacy policy. However, prior to sharing personal data with such parties, Mapbox will have a written agreement consistent with the obligations outlined in applicable data protection laws and regulations.                                                                           
• Advertising and analytics partners. Any secondary use or sharing of personal data obtained through the use of third party cookies by these third parties is subject to their respective privacy policies. For information about cookies on Mapbox’s website and how to change browser cookie settings, please visit Mapbox’s website here.

• In response to a request so long as Mapbox believes disclosure is in accordance with, or required by, any applicable law, regulation or legal process. 
• If Mapbox has a good-faith belief that access, use, preservation, or disclosure of the personal data is reasonably necessary to enforce its terms of service, detect, prevent, or otherwise address threats to its platform, or protect against harm to the rights, property or safety of Mapbox, its users, or the public as required or permitted by law. 
• In connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of Mapbox’s business by another company. 

‍

Data Retention

• Only for so long as Mapbox has a business purpose to retain and process such personal data.        

Changes To This Privacy Policy

Mapbox will update this privacy policy at its own discretion from time to time to reflect changes in Mapbox’s practices, technologies, legal requirements, and other factors. 

‍‍

Contact Mapbox 

Mapbox would love to hear any questions, concerns, or feedback about this privacy policy or Mapbox’s data protection practices. Please contact Mapbox at privacy@mapbox.com.

‍