GDPR compliance

GDPR distinguishes between a controller (the party that decides why and how personal data is processed) and a processor (the party that processes data on the controller's behalf, following their instructions). Datrika plays both roles, depending on whose data is involved.

Because Datrika acts as a processor for your website's visitor data, our Data Processing Agreement applies automatically as soon as you use the service - there is nothing separate to sign.

As a Datrika account holder, you have the following rights over your own account data:

For your website's visitors, these rights work differently - see Handling visitor data requests below.

Datrika is built so that using it doesn't create new GDPR obligations for your site. Here's what we handle automatically, and what's still on you:

Because we never store IP addresses or any other identifier that persists across days, most sites can rely on legitimate interest (Art. 6(1)(f) GDPR) as the legal basis for using Datrika, without needing visitor consent. This is a general pointer, not legal advice for your specific situation.

Consent isn't tied to the word cookie. It's tied to whether a tool stores information on the visitor's device, or reads information from it and builds an identifier for a person out of that. The European Data Protection Board spelled this out in Guidelines 2/2023, adopted on 16 October 2024: browser fingerprinting, tracking pixels, tracking links, and some cases of recognising a visitor by IP address alone all fall under the same rule.

So "we don't use cookies" is not the argument on its own. What decides it is five conditions under which analytics counts as necessary and needs no consent. Here is how we meet them:

This is our assessment, not a stamp from a regulator. Supervisory authorities don't certify individual tools and expect each case to be assessed on its own. That's why we describe the mechanics in enough detail for you to check the conclusion yourself: exactly what our script reads from the browser is on our data page. Where the conditions come from and what the Czech office says about them is on when analytics does not need consent.

If your site runs other tools that store data in the browser - chat, embedded video, maps, ad pixels - the banner stays for their sake. Analytics simply drops out of it.

If someone asks you, as the site owner, to access or delete "their" data, forward the request to us at support@datrika.app or handle it directly from your dashboard.

Because Datrika never stores IP addresses and the daily salt used in our hashing formula isn't retained either, we cannot identify which visitor is which - there is no way to look up or delete a single visitor's record on request. In practice, a visitor data request is fulfilled by deleting the analytics for the site they visited, which removes all visitor records at once. This is a deliberate trade-off: not storing IP addresses is what makes Datrika privacy-first in the first place.

• Pseudonymization by design. Visitor identity is computed as a keyed one-way hash (HMAC-SHA256) of a truncated IP address, user agent, and site ID, keyed with a random salt that rotates every 24 hours. The original IP and user agent are never written to disk, and the same visitor can't be linked across different days.
• EU-only hosting. All analytics data is hosted on servers in Frankfurt, Germany (Hetzner), and never leaves the EU.
• Encryption in transit. All traffic to our collector and dashboard is served over TLS/HTTPS.
• Minimal access. Only Datrika's operator has access to production databases.
• Vetted sub-processors. We use a short list of sub-processors - Hetzner (EU hosting), MaxMind (local GeoIP lookup, no visitor data leaves your infrastructure), Resend (transactional email for account holders) and Stripe (billing) - each covered by Standard Contractual Clauses and/or EU-US Data Privacy Framework certification where data leaves the EU.
• Immediate, permanent deletion. When you delete a site or your account, the corresponding analytics data is erased right away - there's no waiting period, and no way to recover it afterwards.
• No ad-tech, no resale. We don't sell or share your data, and we don't use it for advertising or profiling of any kind.

Using Datrika responsibly under GDPR mostly comes down to a few things on your side:

• Don't send personal data through custom events. Custom events accept arbitrary key/value metadata that you define - Datrika doesn't inspect their content, so it's on you to keep names, emails, phone numbers, and similar personal data out of them.
• Confirm your own legal basis. We believe legitimate interest is sufficient for most sites given how Datrika processes data, but you're responsible for confirming that's right for your use case.
• Keep your privacy notice current. Mention Datrika as your analytics processor if your own privacy policy lists the tools you use.
• Handle consent for anything else. If you run other cookie-based tools alongside Datrika, their consent requirements are separate from ours.

For anything about GDPR compliance, our sub-processors, or a data request, reach out at support@datrika.app. For the technical detail on what we collect and how it's stored, see our Data policy.