> How to use Mappedin indoor maps in compliance with GDPR, ePrivacy and TDDDG. Covers consent, legal basis, transfers to Canada and the US, cookies and DPIA. > > Canonical: https://www.flowconsent.com/en/services/other/mappedin Other # Mappedin Preferences · [Official website](https://www.mappedin.com) Mappedin is a Canadian indoor mapping platform that provides interactive 3D maps and wayfinding for shopping malls, airports, hospitals, universities and large venues. It is embedded through a JavaScript SDK or REST API that loads map tiles, location data and search functionality. The default operation is largely cookieless, but the SDK fetches resources from third party servers, so Article 5(3) of the ePrivacy Directive still applies in most cases. [Block Mappedin until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Preferences - Prior consent Required - Documented cookies 6 - Third-party domains 7 - Servers Canada (primary) and United States (AWS US East), with global CDN Overview ## What does Mappedin do? ## **What Mappedin is and what it does** Mappedin is a Canadian indoor mapping platform headquartered in Waterloo, Ontario that provides interactive 3D maps and turn by turn wayfinding for indoor venues such as shopping malls, airports, hospitals, universities and large retail stores. The service is embedded through the @mappedin/mappedin-js JavaScript SDK or a REST API, which load vector map tiles, point of interest data, search responses and rendering assets. When a visitor asks for directions from their current location, the SDK can call the browser geolocation API to estimate their position inside the venue. ## **Data and cookies collected by Mappedin** By default Mappedin does not set persistent tracking cookies. The SDK uses session storage and in memory state to remember the current map view, the selected floor and the active route. Optional analytics modes may set session cookies and collect interaction events such as zooms, searches and wayfinding requests. In all cases the service receives the visitor IP address, user agent and venue identifier when it loads tiles and search APIs, plus the geolocation coordinates when the user actively requests a route from their position. ## **GDPR and ePrivacy implications** Although Mappedin is largely cookieless, the SDK is a third party script that stores and reads information from the user terminal (cache entries, session storage, possibly a session cookie) and transmits personal data such as the IP address to Mappedin servers. Article 5(3) of the ePrivacy Directive and the German TDDDG therefore apply, alongside the GDPR obligations of transparency, purpose limitation and data minimisation. Joint controllership questions can arise where analytics features are activated. ## **Consent requirements and legal basis** For maps strictly necessary to deliver a service the user has actively requested (find a shop, get directions inside an airport), the strictly necessary exemption of Article 5(3) ePrivacy can apply and the legal basis is contract performance or legitimate interest. For maps that load automatically on every page, are decorative or are coupled with analytics, prior opt in consent is required. The information notice should name Mappedin, describe the data, mention transfers to Canada and the US and offer a clear refusal option. ## **Cross border data transfers and practical compliance steps** Mappedin processes data in Canada and in AWS US East, with a global CDN. Transfers to Canada are covered by the EU adequacy decision adopted in 2001, limited to organisations subject to PIPEDA. Transfers to the United States rely on Standard Contractual Clauses and, where applicable, on the EU US Data Privacy Framework. Practical steps: sign a Data Processing Agreement, document the transfers in your record of processing, block the SDK behind your consent tool when analytics are enabled, update the privacy policy and disable optional analytics where they are not necessary. Compliance ## Mappedin and the GDPR Mappedin is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Contract performance or legitimate interest for strictly functional indoor maps, consent for any analytics or behavioural tracking layer - Risk level low\_to\_medium - Applicable regulations GDPR, ePrivacy Directive, German TDDDG, PIPEDA (Canada), CCPA ### Impact assessment (DPIA) A formal DPIA is generally not mandatory for a purely functional indoor map. A DPIA should be considered when Mappedin is combined with real time positioning, persistent user accounts, behavioural analytics, geolocation tracking of visitors inside sensitive venues (hospitals, government buildings) or when it processes data about vulnerable users such as patients or minors. ### Sample text for your banner > We use Mappedin to display interactive indoor maps and provide wayfinding inside our venue. The service loads map tiles and search data from Mappedin servers in Canada and the United States and may use your approximate location if you ask for directions from your current position. Do you accept the loading of Mappedin? Cookies and trackers ## What Mappedin sets and contacts - Tracking method JavaScript SDK loading map tiles and search APIs, optional analytics events, browser geolocation API used when wayfinding from current location is requested - Server location Canada (primary) and United States (AWS US East), with global CDN - Cookieless mode available Yes - Data transferred outside the EU Data transfers occur to Canada (covered by the EU adequacy decision since 2001 for organisations subject to PIPEDA) and to the United States (under Standard Contractual Clauses or the EU US Data Privacy Framework). ### Cookies set (6) | Name | Type | Duration | Purpose | | ----------------- | ------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | mappedin\_session | first\_party | session | Session cookie used by some analytics configurations to group map interactions within a single visit. Not set in the default cookieless mode. | | mi\_visitor | third\_party | 1 year | Optional visitor identifier set when the analytics layer is enabled, used to recognise returning visitors and measure repeat usage of the map. | | mi\_consent | first\_party | 6 months | Stores the visitor consent choice for the Mappedin analytics layer when the embedding website uses the Mappedin consent helper. | | mi\_locale | first\_party | 1 year | Stores the language preference selected inside the indoor map UI so the interface and search reopen in the same language. | | mi\_map\_state | first\_party | session | Session storage entry remembering the current floor, zoom level and selected point of interest, used to keep map state across page reloads. | | AWSALB | third\_party | 7 days | AWS Application Load Balancer cookie used by Mappedin infrastructure for sticky session routing to backend servers. Exact names depend on the venue configuration. | ### Third-party domains contacted (7) - `mappedin.com` - `cdn.mappedin.com` - `api.mappedin.com` - `tiles.mappedin.com` - `assets.mappedin.com` - `web.mappedin.com` - `app.mappedin.com` Questions ## Frequently asked questions about Mappedin Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies or identifiers does Mappedin set? By default Mappedin does not set persistent tracking cookies. The SDK uses session storage and in memory state for the map view and active route. Optional analytics modes may add a session cookie and a visitor ID. Exact names depend on the configuration chosen by the venue operator. ### Is consent required before loading Mappedin? For functional indoor maps requested by the user (find a shop, get directions) consent is usually not required and the strictly necessary exemption of Article 5(3) ePrivacy applies. For maps that load automatically, are decorative or are paired with analytics, prior opt in consent is required. ### What is the legal basis for processing under the GDPR? For strictly functional maps, the legal basis is contract performance (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)). When optional analytics are activated, the legal basis is consent (Art. 6(1)(a)) combined with consent under Article 5(3) of the ePrivacy Directive. ### Does Mappedin transfer personal data outside the EU? Yes. Mappedin processes data in Canada and in AWS US East with a global CDN. Transfers to Canada are covered by the EU adequacy decision adopted in 2001 (limited to organisations subject to PIPEDA). Transfers to the United States rely on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework. ### Do I need to run a DPIA for Mappedin? A formal DPIA is generally not mandatory for a purely functional indoor map. It is recommended when Mappedin is paired with real time positioning, persistent user accounts, behavioural analytics, geolocation in sensitive venues (hospitals, government) or processes data of vulnerable users such as patients or minors. ### How do I implement Mappedin compliantly? Disable optional analytics when not strictly required, block the SDK behind your consent tool if analytics are enabled, sign a DPA with Mappedin, include the service in your record of processing, document the transfers to Canada and the US and provide a clear notice on the page where the map is loaded. ### Are there alternatives to Mappedin? Yes. Functional alternatives include Google Maps Indoor, Apple Indoor Maps, Esri ArcGIS Indoors and Pointr. EU based alternatives include MazeMap (Norway), Situm (Spain) and Indoor Atlas (Finland), which may simplify cross border data transfer questions inside the EEA. ### How do I update my cookie policy for Mappedin? Add a Mappedin entry naming the provider (Mappedin Inc., Canada), the purpose (interactive indoor maps and wayfinding), the data categories (IP address, user agent, optional geolocation), the retention, the third country transfers (Canada, US) and the legal basis (contract or legitimate interest for functional maps, consent for analytics). Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [Recop](https://www.flowconsent.com/en/services/other/recop) [Recop is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Recop integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Recop helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/recop) [Preferences](https://www.flowconsent.com/en/services/other/recop) · ### [Nextcloud](https://www.flowconsent.com/en/services/other/nextcloud) [Nextcloud is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Nextcloud supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Nextcloud ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/nextcloud) [Preferences](https://www.flowconsent.com/en/services/other/nextcloud) · ### [Mintox](https://www.flowconsent.com/en/services/other/mintox) [Mintox is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Mintox provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Mintox helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/other/mintox) [Marketing](https://www.flowconsent.com/en/services/other/mintox) · ### [Allyant](https://www.flowconsent.com/en/services/other/allyant) [Allyant is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Allyant supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Allyant ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/allyant) [Other](https://www.flowconsent.com/en/services/other/allyant) · ### [Crypto-Loot](https://www.flowconsent.com/en/services/other/crypto-loot) [Crypto-Loot is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Crypto-Loot is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Crypto-Loot offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/other/crypto-loot) [Essential](https://www.flowconsent.com/en/services/other/crypto-loot) · ### [Fullbay](https://www.flowconsent.com/en/services/other/fullbay) [Fullbay is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Fullbay enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Fullbay empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/other/fullbay) [Marketing](https://www.flowconsent.com/en/services/other/fullbay) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)