In this guide
- Under GDPR you are usually the controller and the hosting vendor a processor. You need a data processing agreement (DPA).
- Ask for the sub-processor list, data locations and the transfer mechanism for any data leaving the EU.
- Keep records and review them yearly.
For an EU company, buying a tracking host is a data protection decision as much as a technical one. This page lists the points that procurement and privacy teams check, and the questions to ask. It is general information, not legal advice. See procurement information, GDPR and server-side tracking, global privacy laws and DORA and tracking vendors.
Roles
| Party | Role |
|---|---|
| Your company | Controller of the visitors' personal data |
| Tracking host | Processor, acting on your instructions |
| Ad and analytics platforms that receive data | Independent controllers or processors, depending on their terms |
| The host's infrastructure providers | Sub-processors |
Orders from your store, back to the ad that earned them
Your store sends the order once. Open Tracked passes it on to each ad platform, cleaned and deduplicated.
The DPA
A data processing agreement sets out what the processor may do with the data, security measures, sub-processor rules, assistance with data subject requests, breach notification and deletion at the end. Read it, and check that it matches how you will use the service.
Sub-processors and location
- Ask for the current list of sub-processors with their locations.
- Ask how you are told about changes and how to object.
- Ask where the tagging server and logs are hosted, and whether you can choose a region.
Ask Ari instead of digging through reports
Ari reads your tracking and ad data and answers in plain words.
Transfers outside the EU
If personal data can leave the EU, you need a valid transfer mechanism, such as an adequacy decision or standard contractual clauses, and, where required, a transfer impact assessment. Ask the vendor which applies. Remember that data you send to ad platforms may also travel.
Consent and minimisation
A host does not decide your lawful basis. You still need consent where required for cookies and for personal data sent to platforms. A server container gives you control over what is sent: transformations to strip fields, the Anonymizer to hide the IP and consent switches on the Enricher. See transformations and cookie banners.
Records you should keep
Questions to put to the vendor
- Where is data processed and stored, and can I choose?
- Who are the sub-processors, and how do you notify changes?
- What is the transfer mechanism for data leaving the EU?
- How do I export and delete my data?
- How do you handle a personal data breach?
A realistic example
A German online retailer is choosing a tracking host. Its privacy officer sends a one-page questionnaire to three vendors: DPA available, sub-processor list, data location, transfer mechanism, retention, export and deletion, breach notification. Two vendors answer in a day with documents. One answers vaguely and cannot say where logs are stored. The retailer drops it, signs the DPA with the vendor that offered a clear sub-processor list, records the host in its record of processing and sets short retention for stored identifiers. The technical comparison was close, and the paperwork decided. The lesson for buyers is that clear, written answers are a feature of the product, and that a vendor who cannot give them will cost you more later.
3 things to remember
Scroll and the points stack up.
Under GDPR you are usually the controller and the hosting vendor a processor. You need a data processing agreement (DPA).
Ask for the sub-processor list, data locations and the transfer mechanism for any data leaving the EU.
Keep records and review them yearly.
Frequently asked questions
Is a tracking host a processor under GDPR?
Usually yes. You are the controller and the host processes data on your instructions, so you need a DPA.
What should a DPA cover?
Processing instructions, security, sub-processors, data subject assistance, breach notification and deletion at the end.
Do I need to know the host's sub-processors?
Yes. Ask for the list and how changes are notified.
What if data leaves the EU?
You need a valid transfer mechanism such as standard contractual clauses, and may need an impact assessment.
Does server-side tracking help with GDPR?
It gives control over what is sent. It does not replace consent, contracts or records.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Guides · 4 min read
