Privacy & GDPR
How XICTRAQ® handles personal data, where it is hosted and what to consider legally.
Questions in this category
- Is the tracking GDPR-compliant? Yes — XICTRAQ® is built privacy-first: cookieless, no cookies, no storage on the device for reach measurement (no localStorage), no transfer to third parties, no IP addresses in the visitor statistics (they are recorded in the access log of the web server as with every request; retention periods: privacy policy, section 3) and hosting is exclusively in the EU. Because no cookies are set, the classic reason for a cookie banner falls away — you measure all visitors, not just those who accept a banner.
- Do I need a data processing agreement? No separate agreement is needed: data processing under Art. 28 GDPR is governed directly in § 9a of our terms and becomes binding upon contract conclusion.
- Is personal data stored? Reach measurement works without a persistent personal identifier; it derives a daily identifier as well as coarse location and network operator from the IP address and does not store the IP address in the visitor statistics; the access log of the web server records it, as with every request, for security and error analysis (retention periods: privacy policy, section 3).
- Where are the servers located? In the EU — on servers controlled by us in data centres in Germany (Nuremberg, Falkenstein) and Finland (Helsinki). This keeps the data within the EU and subject to European data protection law.
- How long is data retained? The retention period depends on the chosen plan and ranges from a few days to several years; older data is then automatically pruned.