Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Upsales is a Swedish B2B CRM and marketing automation platform that combines sales pipeline management with website visitor tracking, lead scoring, and email marketing. Built by Upsales Technology AB in Stockholm, it places tracking and marketing cookies on visitor browsers to identify accounts and measure engagement. Because it processes behavioural data for marketing purposes, it requires prior consent under the ePrivacy Directive and the GDPR.
Upsales is a business to business CRM and marketing automation platform developed by Upsales Technology AB in Stockholm, Sweden. It brings together sales pipeline management, website visitor tracking, lead scoring, and email marketing in a single tool aimed at revenue teams. On your website it works by loading a tracking script that places cookies to recognise returning visitors and connect their behaviour to company and contact records.
Upsales sets marketing and visitor tracking cookies that record page views, visit frequency, and engagement signals, alongside functional cookies that keep sessions working and analytics cookies that aggregate usage. This information feeds lead scoring, which ranks prospects by their level of interest. Because these cookies build a behavioural profile tied to identifiable visitors, they are treated as personal data under the GDPR.
The ePrivacy Directive requires prior consent before storing or reading non essential cookies on a user device, and visitor tracking and marketing cookies fall squarely in that category. Under the GDPR the lawful basis for this tracking is consent, while the underlying CRM processing of customer data may rely on contract or legitimate interest. You remain the controller for the personal data you collect through Upsales and must document these purposes in your records of processing.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You should load the Upsales tracking script only after the visitor has given explicit, informed consent through a consent management platform. The consent banner must let users accept or reject marketing cookies freely, and the script must stay blocked until a positive choice is recorded. Keep a log of consents and make withdrawal as easy as granting it.
Upsales processes data within the European Union, with hosting in Sweden, which removes most international transfer concerns for the core platform. That said, an EU hosted provider does not automatically eliminate transfer questions, because subprocessors for email delivery, support, or analytics may operate elsewhere. Review the data processing agreement and the subprocessor list to confirm where data actually flows.
Block the Upsales script until consent is captured, declare its cookies in your cookie policy with names, purposes, and durations, and sign a data processing agreement with Upsales. Add the platform to your records of processing, review subprocessors periodically, and run a privacy assessment if you combine tracking with extensive profiling. These measures keep your marketing operations aligned with the GDPR and the ePrivacy Directive.
Websites using Upsales must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment is advisable where Upsales is used for systematic visitor tracking and lead scoring. Consider (1) the scope and intrusiveness of behavioural tracking that links website activity to identifiable contacts and companies; (2) the legal basis, ensuring consent is obtained for marketing cookies while contract or legitimate interest covers core CRM processing; (3) the profiling and scoring logic, since lead scoring evaluates individuals and may influence how they are contacted; (4) data location and subprocessors, confirming that EU hosting in Sweden is not undermined by subprocessors outside the EEA; and (5) data subject rights, retention periods, and security measures, including how consent is recorded and withdrawn and how long behavioural data is kept.
Sample consent text
We use Upsales marketing and visitor tracking cookies to recognise your visits and measure engagement. These cookies load only with your consent. Accept to enable tracking, or reject to browse without it. You can change your choice at any time.
Third-party domains contacted
upsales.comapp.upsales.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _upsales_visitor | Marketing | 1 year | Tracks website visitors across sessions to identify accounts and measure engagement for marketing. |
| upsales_session | Functional | Session | Maintains the user session and keeps core platform functionality working during a visit. |
| _upsales_analytics | Analytics | 2 years | Aggregates usage statistics such as page views and visit frequency to measure performance. |
| upsales_lead_score | Marketing | 1 year | Supports lead scoring by recording visitor behaviour used to rank prospects by interest. |
Upsales places tracking cookies for advertising — comply with GDPR using FlowConsent.
Upsales sets visitor tracking and marketing cookies to recognise returning visitors, plus functional cookies for sessions, analytics cookies for usage measurement, and a lead scoring cookie that supports prospect ranking. The tracking and marketing cookies build a behavioural profile and are not strictly necessary. You should list each cookie with its name, purpose, and duration in your cookie policy.
Yes. The Upsales visitor tracking and marketing cookies are non essential, so the ePrivacy Directive requires prior consent before they load. You must keep the tracking script blocked until the visitor actively accepts, and provide an equally easy way to refuse or withdraw consent.
For the website tracking and marketing cookies, the lawful basis is consent under GDPR Article 6(1)(a) together with ePrivacy Article 5(3). The core CRM processing of customer records may instead rely on contract or legitimate interest. You should document each purpose and its basis in your records of processing.
Upsales processes data within the European Union, with hosting in Sweden, so the core platform does not rely on transfers to the United States. However, EU hosting does not automatically remove all transfer questions, since subprocessors for email, support, or analytics may operate elsewhere. Review the data processing agreement and subprocessor list to confirm where data actually flows.
A data protection impact assessment is advisable where Upsales is used for systematic visitor tracking and lead scoring, because that combines behavioural profiling with identifiable contacts. Assess the intrusiveness of tracking, the scoring logic, retention periods, and how consent is captured and withdrawn. If the profiling is large scale or high impact, a DPIA may be required rather than merely recommended.
Integrate the Upsales tracking script with a consent management platform so it stays blocked until marketing consent is given. Declare all cookies in your cookie policy, sign a data processing agreement with Upsales, and add the platform to your records of processing. Set retention limits and review subprocessors periodically.
Yes, other B2B CRM and marketing automation tools such as HubSpot, Pipedrive with marketing add ons, or ActiveCampaign offer comparable visitor tracking and lead scoring. Each still relies on tracking cookies, so the same consent obligations apply. Compare hosting location, subprocessor lists, and data transfer practices when choosing.
List the Upsales tracking, marketing, functional, analytics, and lead scoring cookies by name, with their purpose and retention period. Explain that marketing and tracking cookies load only after consent and describe how users can withdraw it. Keep the policy current whenever Upsales changes its cookies.