GDPR
Personalize your site, and keep GDPR in your hands.
You decide what Personyze collects and how long it keeps it, and you can answer a visitor’s access or deletion request in minutes, with a record of it. Here is how it works, what is yours to do and what is ours.
Who does what
You are the controller. Personyze is your processor.
On your site, you decide why visitor data is collected and what it is used for. Personyze processes it on your behalf, only to run the campaigns, recommendations and tests you set up.
Your part
The site operator
- Choose the lawful basis — for personalization in the EU and UK, usually consent through your cookie banner.
- Tell visitors in your privacy notice that you use Personyze. A sample clause is below.
- Decide what you send beyond behavior: CRM fields, form answers, purchases.
- Answer visitors’ requests, with the tools in Settings › Data & privacy.
Our part
Personyze
- Processes visitor data only on your instructions, and never sells it.
- Signs a Data Processing Agreement with you — it is part of our Terms.
- Uses only sub-processors bound by the same data-protection duties, listed on our Security page.
- Tells you without undue delay if a security incident affects your data.
What Personyze collects
Behavior, not identity — unless you add it.
A standard setup recognizes a returning visitor by a random ID in a first-party cookie. Personal details join the profile only when you choose to send them.
A pseudonymous, first-party cookie
One random visitor ID, set on your own domain. You choose its lifetime, from 30 days to 2 years.
What visitors do on your site
Pages viewed, time on page, clicks, the referring page and campaign, and the events you define.
Country and city, from the IP address
The IP is used when a visit arrives to find the location, is held only while the visit is active, and is not stored in visitor profiles.
Device and browser
Browser, operating system, screen size and language, so a campaign can target them.
What you choose to send
CRM fields, form answers, purchases or a login ID, through an integration, a form or the API. None of it is required.
What not to send
Special-category data — health, religion, politics and the like. Personalization doesn’t need it, so keep it out of Personyze.
Consent and collection
Tracking waits for your cookie banner.
Settings › Data & privacy › Collection decides what the tracking code does before and after a visitor chooses. The settings, step by step.
Consent mode
Personyze waits for your cookie banner before it tracks, with ready-made instructions for Cookiebot, OneTrust, Usercentrics, IAB TCF and Google Consent Mode. How it works.
Global Privacy Control
Turn it on and a browser that sends the GPC signal is not tracked.
Clean page addresses
Emails and tokens are kept out of the page addresses Personyze records — for example ?email= in a link from a newsletter.
Cookie lifetime
From 30 days to 2 years. The privacy advisor suggests 13 months where the French regulator recommends it.
Visitor rights
A visitor’s request, answered in minutes.
Settings › Data & privacy › Requests finds one person across Personyze — profile, visits, forms, survey answers, chats, meetings and email activity — and every request is logged.
Find the person and export everything Personyze holds on them as JSON.
Delete the person across Personyze — profile, visits, forms, survey answers, chats, meetings and email activity — and keep the receipt of what was removed and what was kept, and why.
Correct the data at its source — your CRM, your forms or the API — and the profile updates from there.
The same JSON export: structured, machine-readable, ready to hand over.
Let your cookie banner switch tracking off for that visitor, honor the Global Privacy Control signal, or opt a visitor out with the JavaScript API.
Personyze chooses which content, product or message a visitor sees. It is not built for decisions with legal or similarly significant effects on a person.
Removed
- Visitor profile 1
- Visits 38
- Form submissions 2
- Chat transcripts 1
- Email activity 146
Kept, and why
- Email on the suppression list so they are never emailed again
- Report totals no longer linked to a person
Copies you sent to other tools, such as your CRM, are deleted there. An illustration, not a real request.
Retention
A period for every kind of data, set by you.
Each kind of data has its own setting. Make any period shorter than our defaults — down to 30 days for known profiles — and give one to the data we keep until you do.
Privacy advisor
Suggestions for your countries, with their sources.
The advisor looks at where your visitors actually come from and what kind of site you run, and suggests retention periods, consent and cookie settings. Each suggestion links to the regulator’s own page, and you apply them in one click. Suggestions, not legal advice.
- CNILFrance
- European CommissionEU
- ICOUK
- CPPACalifornia
- CAIQuebec
- ANPDBrazil
- FTCUS
Security and transfers
Where the data lives, and who can reach it.
The full picture — testing, access, incidents and sub-processors — is on our Security page.
Hosted on AWS
Personyze data is hosted on Amazon Web Services infrastructure, and nowhere else.
Encrypted in transit, access by role
Connections use TLS. Access to our systems is role-based, with the least privilege each person needs.
International transfers
Where GDPR or UK GDPR applies, transfers rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum; for Swiss data, the FDPIC’s changes. Details in the privacy policy.
The DPA
Our Data Processing Agreement is part of the Terms & Conditions. Ask for a copy or a countersigned version.
For your privacy notice
A clause you can start from.
Your privacy notice should say that you use Personyze. Adapt this to your setup — fill in the highlighted parts.
We use Personyze to personalize our website: to show content, products and offers that fit what you have looked at. Personyze sets a first-party cookie with a random identifier to recognize your browser when you return, and records the pages you view and how you interact with them. It uses your IP address to find your country and city, and does not store the IP address in your profile. [If you send other data, such as your customer details, say so here.]
Personyze processes this data on our behalf and does not sell it. The data is kept for [your retention period]. You can withdraw your consent at any time in [link to your cookie settings], and ask us for a copy of your data or for its deletion at [your privacy contact].
A starting point, not legal advice. Have your own counsel check the final wording.
Questions
What privacy teams ask us.
Is Personyze GDPR compliant?
Compliance belongs to whoever decides why data is collected — on your site, that is you. Personyze acts as your processor under a Data Processing Agreement and gives you the tools GDPR asks for: consent mode, retention periods, and finding, exporting and deleting one person’s data with a record of each request.
Do we need consent before Personyze runs?
In the EU and the UK, cookies that are not strictly necessary usually need consent. Turn on consent mode and Personyze waits for your cookie banner before it tracks; there are ready-made instructions for Cookiebot, OneTrust, Usercentrics, IAB TCF and Google Consent Mode. How consent mode works.
Where is the data hosted?
On Amazon Web Services infrastructure, and nowhere else. Transfers outside the EEA, the UK or Switzerland rely on the EU Standard Contractual Clauses, the UK addendum and the Swiss FDPIC’s changes.
How long do you keep visitor data?
As long as the period you set for each kind of data, never longer than our defaults: 366 days for a profile with an email or CRM ID, 61 days for a profile known only by its cookie, 90 days for chat transcripts and 365 days for meeting bookings.
Can we delete one visitor’s data?
Yes. Search for them, delete, and keep the receipt. It covers everything in Personyze; copies you have already sent to other tools, such as your CRM or email provider, are deleted there.
Do you honor the Global Privacy Control signal?
Yes, when you turn it on in Settings › Data & privacy. A browser sending the signal is then not tracked.
Does Personyze sell visitor data?
No. Personyze never sells visitor data and uses it only to run the campaigns you set up.
How do we get the DPA?
It is part of our Terms & Conditions. Write to support@personyze.com for a copy, a countersigned version, or the current sub-processor list.
Talk to us
A question from your DPO or legal team?
Send it, with your vendor questionnaire if you have one. We answer every question ourselves.