Developers
Location Data and GDPR: Concepts for Developers
A concept-level overview of privacy considerations for precise location data: minimisation, purpose, retention, security and user rights. Not legal advice.
Updated 14 October 2026 · 3 min read
This page is not legal advice. It lists concepts that developers commonly consider when handling precise location data, under GDPR-style privacy frameworks and similar rules elsewhere. Your actual obligations depend on your jurisdiction and circumstances, so involve a qualified adviser.
Why location is sensitive
A 3 m by 3 m cell can pinpoint a front door. Combined with a name, phone number or order history, it identifies where a person lives or works. Even without a name, repeated locations can reveal habits. Treat precise location as data that deserves care.
Concepts to apply
Purpose. Collect a location for a defined reason, such as delivering an order, and state that reason in your privacy notice.
Minimisation. Collect only what you need. If a courier needs the code, you may not need to store the coordinates, because a lookup returns them when required. Make the location optional where possible.
Retention. Decide how long location data is kept, and delete or anonymise afterwards. Storing it in its own table makes scheduled deletion simple; see saving the code with an order.
Access control. Only the people who need the code (dispatch, the driver) should see it. Be careful when pasting share links into chats and tickets.
Security. Keep API keys on the server, encrypt at rest and in transit as appropriate, and avoid putting codes or coordinates in URLs that end up in logs. See securing your UPCS API key.
User rights. Be ready to export or delete a person's data on request. A clear schema makes this realistic.
Practical checklist
- Explain in the form why you ask for a location.
- Do not require it unless delivery truly depends on it.
- Keep it out of analytics events and error trackers.
- Mask or omit it in logs; see monitoring and logging API usage.
- Delete it when the order no longer needs it.
What UPCS provides
UPCS generates a code for a location chosen on a map and exposes endpoints you call with your key. How you store and share the results is your responsibility as the integrator. For technical storage choices, see storing coordinates in a database.
Frequently asked questions
Is a UPCS code personal data?
A code points to a precise 3 m by 3 m cell. Linked to an order, a name or a household, a precise location can identify a person, so it is wise to treat it as personal data. Ask your legal adviser for your situation.
Is this legal advice?
No. It is a developer-oriented overview of concepts. Consult a qualified professional for your obligations.