GDPR and privacy checklist for your website

Understand the roles and agreement

For your website analytics and customer payment data, your business generally decides the purposes and acts as controller. Attriboo processes that data on your instructions under its Data Processing Addendum. Attriboo acts separately as controller for its own account administration, billing, security and support.

Review the DPA and your obligations before sending personal data. If you operate for another business, confirm who is authorized to give instructions.

• Review Attriboo's Data Processing Addendum
• EDPB explanation of controller and processor responsibilities

Review collection and your privacy notice

• Document why you need analytics and payment matching, and the lawful basis for each purpose. Assess cookie/device-access rules separately and obtain consent where required.
• Explain the information your installation actually collects, including persistent browser IDs, identity features and payment matching when used. Identify recipients, retention criteria, applicable transfers, rights and a contact route.
• Limit collection to what is needed. Disable unnecessary automatic email capture and keep personal information out of campaign labels and custom metadata.
• Keep the notice accurate when you add a payment provider, identity integration, custom event or new use of the reports. A privacy notice does not replace a required consent choice.

• Review the data your tracker can collect
• European Commission explanation of GDPR principles

Check access, providers and retention

Give teammates access only to the websites and reports they need. Review API keys and connected AI tools as routes to report access too.

Review Attriboo's subprocessor list and request the processing locations and transfer documentation relevant to your account. Do not assume every record stays in the EU or that a provider's public privacy page establishes the safeguards for your configuration.

Set retention requirements for your purpose and confirm how they will be carried out. A dashboard reporting window, a cookie's expiry, subscription cancellation and server-data deletion are separate things. The DPA describes return/deletion requests and protected backup copies; arrange necessary exports and deletion details through support.

• Review subprocessors and service providers
• Set website and team permissions
• Request account-specific retention or transfer information

Request access, correction or deletion

1. 1
   Identify which business controls the record.

   For a visit or purchase on an Attriboo customer's website, contact that business first. For your Attriboo account or Attriboo's own website, use Attriboo's privacy support form.

2. 2
   Describe the request and scope.

   Choose Privacy or data request. Include the relevant website or workspace, whether you want access, correction, deletion or another action, and enough context to locate the record. Do not attach passwords, API keys, card details or identity documents to the initial message.

3. 3
   If you manage the website, request processor assistance.

   Use the form to explain the authorized instruction and arrange a secure way to identify the relevant records. Verify the requester's authority proportionately before disclosing or deleting information.

4. 4
   Confirm the outcome and any remaining records.

   Agree the method and timing through support. Check payment-provider systems, exports and other copies you control separately. A browser opt-out does not erase server records, and deleting analytics does not automatically erase records held by a payment provider.

• Submit a privacy or data request without signing in
• Read privacy rights and contact information

Use the website privacy controls

Website admins can open Settings → Privacy & data to preview matching records by exact email or visitor ID, verify the request, download the complete JSON export or confirm permanent erasure. The tools cover known linked visitors, activity, imported payments and provider-customer links. They do not find arbitrary personal information inside free-text metadata or remove files and records in other services.

Erasure creates protected keyed fingerprints of known identifiers to prevent those records being restored by later imports or retries. A person using new identifiers may still be recorded under a later lawful setup. Retention is separate: choose a period, preview affected records and confirm cleanup. A new period has seven days before cleanup begins; turn it off during that period if needed. Cookieless daily totals and privacy-operation receipts follow separate handling.

Keep a record of your review

Record your decisions, the tested consent behavior, who can access the reports and how requests will be handled. Review them when your setup or applicable rules change. Ask support for missing account-specific facts before making promises about storage locations, deletion schedules or compliance.