Luigi's Box

Luigi's Box sets persistent cookies on the visitor's browser to identify users across sessions. These cookies enable the platform to attribute search queries, product clicks and browsing events to individual visitors, supporting analytics and personalisation features. The specific cookie identifiers and durations may vary; operators should check the Luigi's Box cookies policy at luigisbox.com/cookies/ for the current list.

Yes. Because Luigi's Box cookies are used for analytics and personalisation, they are not strictly necessary for the website to function and therefore require prior informed consent from EU visitors under the ePrivacy Directive. The tracker JavaScript must be blocked until valid consent is obtained. Consent must be freely given, specific, informed and unambiguous.

The legal basis for processing personal data via Luigi's Box is consent under GDPR Article 6(1)(a). This applies to both the cookie-based tracking and the associated analytics and personalisation processing. Operators must ensure a valid consent mechanism is in place and should execute the Data Processing Agreement available from Luigi's Box to satisfy GDPR Article 28.

No. According to Luigi's Box's privacy policy and Data Processing Agreement, personal data is not transferred to countries outside the European Union or EEA. Processing occurs on EU-based infrastructure. This is a significant compliance advantage for EU operators and means no Standard Contractual Clauses or adequacy decisions are required for Luigi's Box data flows.

A Data Protection Impact Assessment should be considered if Luigi's Box is used at scale with its personalisation and behavioural profiling features enabled, particularly on high-traffic e-commerce sites. Key factors include the volume of behavioural data collected, use of persistent identifiers and potential profiling of individual users. The EU data residency reduces risk but does not eliminate the need to assess proportionality of profiling.

Integrate Luigi's Box into your consent management platform so the tracker is only loaded after the visitor consents to analytics and personalisation cookies. Execute the Data Processing Agreement with Luigi's Box. Add Luigi's Box to your cookie policy, listing luigisbox.com, api.luigisbox.com and live.luigisbox.com as associated domains. Document the processing purposes, data categories and retention periods in your records of processing activities.

EU-based search and recommendation alternatives include Findologic and Empathy.co. Some operators implement open-source solutions such as Elasticsearch with a self-hosted personalisation layer to retain full data control. The right choice depends on your search performance requirements, technical resources and privacy compliance strategy. Evaluate alternatives against their data hosting location, consent model and DPA availability.

Add Luigi's Box to your cookie policy under the analytics and personalisation category. Describe that it sets persistent cookies to identify your browser across visits for the purpose of improving search results and product recommendations. List luigisbox.com, api.luigisbox.com and live.luigisbox.com as the associated domains. State that data is processed in the EU, that consent is required and that it can be withdrawn at any time via your cookie preferences.