Addrova

GDPR and geocoding: is sending customer addresses to a geocoding API a problem?

Short answer: it can be, and it is manageable. A postal address linked to a customer is personal data under the GDPR (Article 4(1)). Sending it to a geocoding provider is processing, and the provider is usually your processor. This is general information, not legal advice; ask your data protection officer or counsel for your case.

What the GDPR asks of you

  1. A legal basis for the processing and a purpose that geocoding serves (delivery planning, fraud checks, analytics).
  2. A contract with the provider that meets Article 28: a data processing agreement (DPA) covering instructions, security, sub-processors and deletion.
  3. A transfer assessment if the provider or its sub-processors process data outside the European Economic Area (Chapter V, Articles 44 to 46).
  4. Data minimisation and retention: send only what you need, and know how long the provider and you keep it.

Sources: Regulation (EU) 2016/679, articles 4, 28 and 44 to 46, on eur-lex.europa.eu. [À VÉRIFIER : relecture juridique avant publication.]

Questions to ask any geocoding provider

  • Where are requests processed, and by which sub-processors?
  • Are queries logged? For how long, and with which fields?
  • Are my requests reused, for example to improve products or train models?
  • Can I get a DPA, and is it signed online?
  • What happens to batch files after processing?

What Addrova claims, and the evidence

Addrova's zero-log mode is specified as numbered claims, each tied to an automated test. The ones that matter most for a privacy review:

  • No address, coordinate or API key in the logs, on all routes including errors (ZL-10).
  • The access log line has a fixed list of fields and no IP address or user agent (ZL-01).
  • The database holds no request and no result (ZL-21).
  • Batch input files are deleted after processing; results are deleted after one hour by default (ZL-22).
  • No external call is made for the repair fallback (ZL-30).

The full table, with test names, is on the compliance page.

What these claims do not cover

  • Hosting location. The tests prove the application's behaviour, not where the servers are. EU-only hosting is to be confirmed and documented. [À VÉRIFIER]
  • The network edge. A proxy in front of the API can log URLs unless configured not to; that is infrastructure, checked separately. Prefer POST so that addresses are not in URLs.
  • The DPA and the list of sub-processors: to be published before launch. [À VÉRIFIER : DPA signé en ligne, sous-traitants]

A practical checklist

  1. Record geocoding in your register of processing activities.
  2. Choose POST and avoid logging request bodies on your side.
  3. Store only the coordinates you need, with a retention period.
  4. Keep the source attribution returned with the results.
  5. Review the provider's DPA and sub-processors once a year.

FAQ

Are coordinates personal data? Often, when they can be linked to a person, for example a home address. Apply the same care as to the address.

Does zero-log mean zero risk? No. It removes a copy of your data from our logs. You remain responsible for your own storage and legal basis.