Privacy & GDPR
How XICTRAQ handles personal data, where it is hosted and what to consider legally.
Questions in this category
- Is the tracking GDPR-compliant? Yes — XICTRAQ is built privacy-first: cookieless, no cookies, no storage on the device for reach measurement (no localStorage), no transfer to third parties, IP addresses are not stored in clear text and hosting is exclusively in the EU. Because no cookies are set, the classic reason for a cookie banner falls away — you measure all visitors, not just those who accept a banner.
- Do I need a data processing agreement? No separate agreement is needed: data processing under Art. 28 GDPR is governed directly in § 9a of our terms and becomes binding upon contract conclusion.
- Is personal data stored? Reach measurement works without a persistent personal identifier; IP addresses are only processed for coarse location and network derivation, not stored as a profiling attribute.
- Where are the servers located? In the EU — on servers controlled by us in data centres in Germany (Nuremberg, Falkenstein) and Finland (Helsinki). This keeps the data within the EU and subject to European data protection law.
- How long is data retained? The retention period depends on the chosen plan and ranges from a few days to several years; older data is then automatically pruned.