Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
ExtraWatch is a real time visitor analytics extension for Joomla and WordPress that logs visits, clicks, country, referrers and live activity directly into the host site database. Because everything is stored on the customer server, ExtraWatch can be operated without third country transfers, but it captures full IP addresses and click coordinates by default and therefore needs careful configuration to remain compatible with the GDPR and the ePrivacy Directive.
ExtraWatch is a server side analytics extension distributed as a Joomla and WordPress plugin. It logs every request hitting the site, builds a real time visitor view, computes country statistics from a local GeoIP database and renders click heatmaps. All data is stored in the host site database, no SaaS dashboard is involved.
By default ExtraWatch records the full IP address, user agent, language, referrer, screen resolution, country, page URL, time on page, click coordinates and form interactions. The optional JavaScript ping for the live view stores a short lived first party cookie so that returning visits can be linked across the same session. None of this data is anonymised at source.
Full IP addresses and click level data are personal data under Article 4(1) GDPR. Click heatmaps qualify as behavioural analytics and exceed the strict audience measurement scope tolerated by the CNIL exemption. The first party cookie used by the live view falls under Article 5(3) ePrivacy. Without anonymisation, ExtraWatch therefore requires a clear opt in cookie banner.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
To rely on legitimate interest without consent, configure ExtraWatch to truncate the last octet of the IP, disable click heatmaps, disable form recording, set a short retention period (13 months maximum) and limit the data to aggregated audience statistics. Any deviation, especially the heatmap module or detailed visitor profiles, switches the legal basis back to consent.
ExtraWatch does not transfer visitor data to a SaaS provider. Data stays in the customer database. License validation pings reach the publisher domain (Slovakia, EU). Customers must verify that the site host itself is located in the EU/EEA and document this in the record of processing.
Enable IP truncation, disable click heatmaps and form tracking unless covered by consent, set retention to 13 months and document in your record of processing why ExtraWatch is used, where the database is hosted and which fields are anonymised. Add ExtraWatch to the privacy policy and cookie policy, with the legal basis (legitimate interest in anonymised mode, consent otherwise) and the contact details for data subject requests.
Websites using ExtraWatch must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended when ExtraWatch is deployed in its default configuration on a high traffic site, because it logs full IP addresses, click coordinates, fingerprintable user agent strings and behavioural patterns at scale. A DPIA may not be necessary in a fully anonymised configuration with truncated IPs, no click heatmap and short retention.
Sample consent text
This site uses ExtraWatch to measure audience and improve the user experience. ExtraWatch collects your IP address, browser, country and click coordinates and stores them on our own servers. Click Accept to allow detailed analytics or Reject to keep only anonymous statistics.
Third-party domains contacted
extrawatch.comweb357.euCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| extrawatch_session | session | Session | First party session cookie used by the ExtraWatch live visitor view to link page views originating from the same browser within a single session. |
| extrawatch_visitor | persistent | 30 days | Optional persistent identifier set when the configuration includes returning visitor recognition. |
ExtraWatch collects user analytics data — you legally need a consent banner. Try FlowConsent free.
ExtraWatch sets a short lived first party session cookie used by the live visitor view to link page views from the same browser. It does not set advertising cookies. Visitor logs are stored server side in the host database, not in cookies.
In its default configuration with full IP logging, click heatmaps and detailed visitor profiles, prior consent is required under Article 5(3) ePrivacy and Article 6(1)(a) GDPR. With IP truncation, no heatmaps and short retention, ExtraWatch can be operated under legitimate interest and is closer to the CNIL exemption regime.
Legitimate interest (Art. 6(1)(f) GDPR) when properly anonymised, with a documented Legitimate Interest Assessment. Consent (Art. 6(1)(a) GDPR) in any setup that records full IPs, click heatmaps or persistent visitor profiles.
No. ExtraWatch stores everything in the customer database. As long as the host server is located in the EU/EEA, no third country transfer occurs. License validation pings reach the publisher in Slovakia, an EU member state.
A DPIA is recommended when the default configuration with click heatmaps, full IP logging and detailed profiles is used at scale. A DPIA can be avoided in a tightly anonymised configuration with truncated IPs, no heatmaps and short retention.
Enable IP truncation in the settings, disable click heatmaps and form tracking, set retention to 13 months maximum, restrict admin access to the dashboard, host the site in the EU/EEA and document the configuration in the record of processing.
For privacy first analytics on Joomla and WordPress, the main alternatives are Matomo (self hosted in cookieless mode), Plausible (EU hosted, no cookies), Fathom (EU hosted, no cookies) and Umami (self hosted). These tools are designed to be deployed without consent banners under the CNIL guidelines.
List ExtraWatch with the publisher (Web357), the purpose (audience measurement), the legal basis (legitimate interest in anonymised mode, consent otherwise), the storage location (your own server), the cookies set (the live view session cookie) and the retention period applied to the visitor logs.