Data processing terms
Version 2026-11-02. These terms exist in English only.
These terms are part of the terms of service and meet Article 28 of the EU General Data Protection Regulation (GDPR). They apply to the personal data that the ReachZone plugin on your shop sends to our service on a paid plan or trial. You (the shop) are the controller of that data; Mohamed Farag, trading as ReachZone ("we"), is your processor.
1. What we process
| Purpose | finding the position of a delivery address, computing drive-time areas around your shop, checking your licence and, if you turn it on, drawing your unserved-demand map |
|---|---|
| Nature | receiving the request, asking our map-data provider, returning the result, caching it, counting it against your allowance; for the demand map, storing and adding up rounded positions |
| Data | the address text and country code a shopper typed; the position found; for the demand map, positions rounded to about 100 metres, the date and whether they came from the checker or the checkout; your shop's location and drive-time settings |
| People concerned | your shoppers, and you where your shop is run by a person |
| Kept | the address text is not stored: we keep a keyed hash of it with the position found, for 90 days; demand positions 180 days; all of it is deleted within 30 days after your licence ends; nightly backup copies (on our server, and an encrypted copy with Cloudflare in the EU) are kept for 7 days, so deleted data is gone from them 7 days later |
The plugin never sends us shoppers' names, email addresses, phone numbers, IP addresses or orders. We use your data only to provide the service to you: not for our own purposes, not for other customers, and never to sell or advertise. The cache of lookups is kept separately for each licence. We count requests to bill and to plan capacity; those counts contain no personal data.
2. Our obligations
- We process the data only on your documented instructions, which are these terms, the terms of service and the settings you choose in the plugin, including on transfers outside the EU (section 4). If EU or Spanish law requires other processing, we tell you first unless that law forbids it. If we think an instruction breaks data protection law, we tell you.
- Everyone who works on the service is bound to confidentiality.
- We take the security measures in the annex below, and keep them up to date.
- We help you answer requests from the people concerned. Because we keep no address text and no names, we usually cannot find a person's data from their name; we can delete everything for your licence, or the cached result for an exact address you give us. If someone asks us directly about data you control, we pass the request to you without undue delay and don't answer it ourselves.
- We help you with security, breach notification (GDPR articles 32 to 34), and impact assessments and prior consultation (articles 35 and 36), as far as our role and the information we have allow.
- We tell you about a personal data breach affecting your data without undue delay, and within 48 hours of finding it: what happened, the data and people concerned (approximate numbers), how to reach us, the likely effects, and what we did about it. We add what we learn later.
- At the end, we delete the data for your licence within 30 days after it ends, unless the law requires us to keep it. If you ask before then, we first give you an export of your demand map.
- Information and audits. On request we give you the information needed to show that we meet these terms. You, or an auditor you appoint who is bound to confidentiality, may audit us once a year with 30 days' notice, during working hours and at your cost, without access to other customers' data. We first answer in writing and with our providers' certifications; an inspection follows only if that doesn't settle the question or a data protection authority requires it.
3. Sub-processors
You authorise these sub-processors. We tell you by email at least 30 days before adding or replacing one or, if our own supplier gives us less notice, as soon as we hear and at least 10 days before. You can object; if we can't resolve the objection, you can cancel and get back the unused part of a prepaid period. We bind each sub-processor by contract to data protection duties that protect the data as these terms do, and we stay responsible to you for them.
| Sub-processor | What for | Where |
|---|---|---|
| Hetzner Online GmbH | the server that runs the API and its database | Finland (Helsinki) |
| Cloudflare, Inc. | delivering the API and protecting it from attacks (requests pass through Cloudflare's network on the way to our server); storing our encrypted nightly backup for 7 days (R2, EU jurisdiction) | USA and a global network; EU–US Data Privacy Framework, with standard contractual clauses as fallback |
| KEPTAGO LTD (Geoapify) | finding positions for addresses and computing drive-time areas; receives the address text and country, or the shop's position and travel time; keeps request logs for no more than 24 hours | Cyprus; servers in the EU |
Stripe is not a sub-processor for this data: it handles payments and never sees it.
4. Transfers outside the EU
- We don't move your data outside the EU ourselves, except to send results back to you. Requests to our API pass through Cloudflare's network, as section 3 says.
- If your shop is outside the EU and the GDPR does not apply to you, sending results back to you is covered by the European Commission's standard contractual clauses (Decision (EU) 2021/914), Module Four (processor to controller), which are part of these terms. We are the data exporter and you are the data importer. The parties and contact details are those in the terms of service and your billing details; the description of the transfer is section 1; the security measures are the annex; clause 7 (docking) applies; under clauses 17 and 18 the law of Spain applies and the courts of Barcelona are chosen. If the clauses conflict with these terms, the clauses prevail.
- If your shop is in the United Kingdom, the transfer back to you is covered by the European Commission's adequacy decision for the UK. Where UK data protection law applies to you, references to the GDPR include the UK GDPR.
5. US state privacy laws
Where a US state privacy law (such as the California Consumer Privacy Act) applies to you, we act as your service provider or processor: we process the data only for the purposes in section 1, don't sell or share it, don't keep, use or disclose it outside our direct relationship with you, and don't combine it with data from other sources. We tell you if we can no longer meet these duties, and you may then take reasonable steps to stop unauthorised use.
6. Your responsibilities
You confirm that you have a lawful basis for the lookups and, if you turn it on, for the demand map, and that your shop's privacy notice tells shoppers about them (the plugin's readme has text you can use). You make sure only delivery addresses reach the service, never names, contact details or special categories of data. On the Agency plan, if you use the service for your clients' shops and act as their processor, you confirm that they authorised you to use us, and we are then your sub-processor on these same terms.
Annex: security measures
- Encrypted connections (TLS) between the plugin and the API, and between Cloudflare and our server.
- The server is in the EU (Helsinki, Finland). Only Mohamed Farag has access to it, by SSH key; there are no passwords.
- Address text is never stored: only a keyed hash (HMAC-SHA256 with a secret) and the position found. Demand positions are rounded to about 100 metres on our server before they are stored.
- Licence keys are stored only as keyed hashes with their last 4 characters; websites only as keyed hashes of their address. Secrets are kept out of the code and out of the logs.
- Every request is checked: size limits, strict formats and ranges for every field, and errors that reveal nothing about the system. Database queries are parameterised.
- Rate limits against abuse; access is refused for suspended or expired licences.
- Payment notifications from Stripe are accepted only with a valid signature.
- The application logs no request bodies and no addresses. The server log keeps the caller's IP address, the time, the path and the answer code for 14 days.
- Expired data is deleted automatically on the schedule in section 1.
- A backup of the database is made every night on the same server, readable only by the service's own account, and kept for 7 days. A copy is encrypted on the server (age; the key that opens it is not on the server) and stored with Cloudflare R2 in the EU for 7 days.
Version 2026-11-02. Terms of service · Privacy notice · Legal notice