Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Luigi's Box is a Slovak (EU-based) SaaS platform offering site search, autocomplete, search analytics and product recommendation for e-commerce. Its JavaScript tracker records search queries, clicks and browsing behaviour, and sets persistent cookies for analytics and personalisation. All data is processed within the EU. Consent is required under ePrivacy before the tracker activates, and a GDPR-compliant Data Processing Agreement is available.
Luigi's Box is a SaaS platform founded in Slovakia and operating within the European Union that provides advanced site search, autocomplete, search analytics and product recommendation capabilities for e-commerce websites. It helps online retailers improve product discoverability and conversion rates by delivering relevant search results and personalised recommendations. The platform integrates via a JavaScript snippet that is loaded on the merchant's website and communicates with Luigi's Box API endpoints including api.luigisbox.com and live.luigisbox.com.
Luigi's Box sets persistent cookies on the visitor's browser to identify returning users across sessions. These cookies enable the platform to record search queries, product clicks and browsing behaviour, which are used to power analytics dashboards and personalise search results and recommendations. Because these cookies track individual behaviour and are used for profiling and analytics purposes, they are not exempt from consent requirements and must only be activated after the visitor has provided valid consent.
Under the ePrivacy Directive, cookies used for analytics and personalisation require prior informed consent from EU website visitors. Luigi's Box falls squarely into this category. The legal basis for processing under GDPR is consent as defined in Article 6(1)(a). Operators must integrate Luigi's Box into their consent management platform and ensure that the JavaScript tracker is blocked until the visitor has actively agreed to analytics and personalisation cookies. Luigi's Box provides a Data Processing Agreement to satisfy GDPR Article 28 requirements.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
One of the key compliance advantages of Luigi's Box is that it does not transfer personal data to countries outside the European Union or EEA, as stated in its privacy policy and data processing agreement. Processing occurs on EU infrastructure, which significantly reduces the data transfer risk compared to US-based alternatives. Operators do not need to rely on Standard Contractual Clauses or other third-country transfer mechanisms for Luigi's Box data flows.
To use Luigi's Box compliantly, block the JS tracker until the user consents to analytics and personalisation cookies. Add Luigi's Box to your cookie policy and consent banner. Execute the Data Processing Agreement available from Luigi's Box. Document the purpose of data collection, the categories of data processed and the retention periods in your records of processing activities. Consider whether a DPIA is needed if personalisation is used at scale on high-traffic sites.
Your cookie policy should describe Luigi's Box as an analytics and personalisation service that sets persistent cookies to identify visitors across sessions for the purpose of improving search results and product recommendations. List luigisbox.com, api.luigisbox.com and live.luigisbox.com as the associated domains. State that data is processed within the EU and that visitors can withdraw consent at any time via your cookie management tool.
Websites using Luigi's Box must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA should be considered for Luigi's Box where the personalisation and behavioural profiling features are used at scale, particularly in high-traffic e-commerce environments. Key factors include the scope of behavioural data collected, use of persistent identifiers across sessions and potential profiling of users. Data remains within the EU which reduces transfer risk. Document processing purposes, retention periods and the Data Processing Agreement.
Sample consent text
We use Luigi's Box (luigisbox.com) to power our site search, product recommendations and search analytics. This service sets cookies to identify your browser across visits in order to personalise search results and improve your shopping experience. Data is processed within the European Union. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
luigisbox.comapi.luigisbox.comlive.luigisbox.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| Luigi's Box visitor identifier | analytics | Persistent (duration set by Luigi's Box, typically up to 2 years) | Identifies the visitor's browser across sessions to attribute search queries, clicks and browsing behaviour for site search analytics and personalised product recommendations. Consent required under ePrivacy. |
Luigi's Box collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Luigi's Box sets persistent cookies on the visitor's browser to identify users across sessions. These cookies enable the platform to attribute search queries, product clicks and browsing events to individual visitors, supporting analytics and personalisation features. The specific cookie identifiers and durations may vary; operators should check the Luigi's Box cookies policy at luigisbox.com/cookies/ for the current list.
Yes. Because Luigi's Box cookies are used for analytics and personalisation, they are not strictly necessary for the website to function and therefore require prior informed consent from EU visitors under the ePrivacy Directive. The tracker JavaScript must be blocked until valid consent is obtained. Consent must be freely given, specific, informed and unambiguous.
The legal basis for processing personal data via Luigi's Box is consent under GDPR Article 6(1)(a). This applies to both the cookie-based tracking and the associated analytics and personalisation processing. Operators must ensure a valid consent mechanism is in place and should execute the Data Processing Agreement available from Luigi's Box to satisfy GDPR Article 28.
No. According to Luigi's Box's privacy policy and Data Processing Agreement, personal data is not transferred to countries outside the European Union or EEA. Processing occurs on EU-based infrastructure. This is a significant compliance advantage for EU operators and means no Standard Contractual Clauses or adequacy decisions are required for Luigi's Box data flows.
A Data Protection Impact Assessment should be considered if Luigi's Box is used at scale with its personalisation and behavioural profiling features enabled, particularly on high-traffic e-commerce sites. Key factors include the volume of behavioural data collected, use of persistent identifiers and potential profiling of individual users. The EU data residency reduces risk but does not eliminate the need to assess proportionality of profiling.
Integrate Luigi's Box into your consent management platform so the tracker is only loaded after the visitor consents to analytics and personalisation cookies. Execute the Data Processing Agreement with Luigi's Box. Add Luigi's Box to your cookie policy, listing luigisbox.com, api.luigisbox.com and live.luigisbox.com as associated domains. Document the processing purposes, data categories and retention periods in your records of processing activities.
EU-based search and recommendation alternatives include Findologic and Empathy.co. Some operators implement open-source solutions such as Elasticsearch with a self-hosted personalisation layer to retain full data control. The right choice depends on your search performance requirements, technical resources and privacy compliance strategy. Evaluate alternatives against their data hosting location, consent model and DPA availability.
Add Luigi's Box to your cookie policy under the analytics and personalisation category. Describe that it sets persistent cookies to identify your browser across visits for the purpose of improving search results and product recommendations. List luigisbox.com, api.luigisbox.com and live.luigisbox.com as the associated domains. State that data is processed in the EU, that consent is required and that it can be withdrawn at any time via your cookie preferences.