GDPR Compliance Guide

GDPR governs the processing of personal data. IP addresses and information linked to a pseudonymous visitor can fall within its scope even when a report ultimately shows aggregate numbers.

Pseudonymisation is a safeguard, not the same as anonymisation. A hash or rotating identifier does not automatically remove a record from GDPR. Consent rules for device access also need a separate assessment under the applicable ePrivacy rules.

The visitor tracker uses no cookies or local storage and does not probe canvas, installed fonts or device hardware. It sends the page URL, referrer, viewport width, an interaction flag and any custom event payload you configure.

The server processes the request IP for the country lookup, IP exclusion rules, rate limits and site-scoped visitor pseudonyms, and the User-Agent for device details, the bot score and the same pseudonyms. A daily salt supports unique-visitor reports; a separate pseudonym uses fixed 90-day rotation windows for funnels. Raw visitor IPs are not stored in analytics records.

These identifiers are pseudonymous. Do not send names, email addresses or other personal details in URLs, event names or properties. Automated scrubbing reduces accidental collection but cannot replace control of the payloads your site sends.

Cookie-free operation does not establish a universal consent exemption. Rules can cover other forms of device access, and national audience-measurement exemptions have conditions. Assess your actual use, jurisdiction and the other tools on your website.

Choose and document an appropriate lawful basis for personal-data processing. If you rely on legitimate interests, assess necessity, proportionality and the interests and rights of visitors. Article 6(1)(f) is not a statement that no personal data is processed.

Explain the analytics processing in your privacy notice, set permitted event payloads and retention, and provide the rights and choices required for your deployment. Removing another analytics tag does not by itself justify removing every consent control on your site.

OpenMetrica visitor analytics infrastructure is hosted in the EU. Account, payment and email processing have separate providers and arrangements described in our DPA.

Tracked dashboard aggregates are retained for 25 months. The raw event log for goals and funnels is retained for 12 months, per-pageview buffer rows for 7 days, and supported imported history for 5 years. The daily salt expires within 48 hours. Funnel queries accept a date range of up to 90 days.

Published retention is a data lifecycle, rather than a promise that every report supports every date range or dataset. You can export supported retained statistics or delete a site to start erasure.

EU hosting reduces the need to move visitor analytics abroad, but does not settle every transfer question for your organization. Review the service providers, categories of data and safeguards in the DPA.

The 2020 Schrems II judgment invalidated the earlier Privacy Shield. The European Commission adopted a new EU-US Data Privacy Framework adequacy decision in 2023 for transfers to participating US organizations. Current transfer assessments must account for the recipient and the applicable legal mechanism.

A blanket claim that Google Analytics is banned throughout EU countries, or that another analytics tool automatically eliminates every legal risk, is not a sound basis for choosing a service.

• Review the events and URLs your site sends, including query parameters and custom properties
• Install your site-specific OpenMetrica snippet and verify the domain when an account is available
• Enable scroll tracking only if needed, and account for its custom-event usage
• Import a supported historical file if needed; a new successful import replaces the previous active import
• Update your privacy notice, processor documentation and any consent rules to reflect the actual setup
• Test that your chosen configuration records the intended events and respects visitor choices

This guide explains the product and relevant privacy distinctions. It does not certify a particular website deployment. Review our Privacy Policy and DPA, and obtain advice suited to your jurisdiction where needed.