Nimbata

Nimbata sets first party and third party cookies plus localStorage entries on every page where the script is active. They identify the visitor (a nimbata_visitor id), persist the attribution parameters (utm, gclid, fbclid, referrer) and reserve a tracking phone number for the session. Some flows also load Google Analytics and Facebook pixels triggered by Nimbata. All of these are non essential cookies and require prior opt in consent.

Yes. The tracking cookies are not strictly necessary because they exist for advertising attribution, not for delivering the requested service. Article 5(3) of the ePrivacy Directive and Article 7 GDPR require prior opt in consent before any value is written to the visitor browser. Gate the snippet behind a Consent Management Platform and only load it after a clear opt in.

Two stacked bases usually apply. Consent (Article 6(1)(a) GDPR) covers the cookies and the analytics. Legitimate interest (Article 6(1)(f) GDPR) can cover the underlying marketing measurement once consent has been obtained, but it does not replace the consent requirement for cookies and call recording. The call recording itself often requires its own explicit consent or strict legitimate interest with a clear announcement, depending on the Member State.

Yes. Nimbata is a US company and hosts call recordings, transcripts and tracking data on AWS US regions. The EEA to US transfer must be covered by a valid Article 46 GDPR safeguard, either the EU US Data Privacy Framework (if Nimbata is certified) or the EU Standard Contractual Clauses combined with a documented transfer impact assessment. The transfer must be disclosed in the privacy notice.

Yes, a DPIA is strongly recommended. Nimbata combines large scale online tracking, call recording and automated transcription, three operations the EDPB places on the list of high risk processing. Document the recording purpose, the retention period, the access controls inside Nimbata, the announcement message to the caller and the US transfer chain.

Block the Nimbata snippet by default and only load it after granular opt in. Add a pre call announcement (recorded or live) and offer a no recording path. Sign a Data Processing Agreement with Nimbata, list it in the record of processing as a US processor, document the transfer safeguard. Restrict back office access to specifically named users, set a 6 to 12 month retention period for recordings and purge older calls automatically.

EU oriented alternatives include CallTrackingMetrics with EU residency, Dialogtech, AdCalls (Netherlands), Adversitement, Aircall (France), Sipgate and Salesmsg with EU hosting. They reduce transfer risk but do not remove the consent and announcement requirements. Server side call attribution with anonymised number pools is another option for low risk use cases.

Add a Nimbata section to the cookie policy that lists each cookie (name, purpose, duration, third party), explains the call recording, names the US processor and references the transfer safeguard. Map the lawful basis (consent for the cookies and the recording), the retention period and the data subject rights. Update the privacy notice and the record of processing activities in the same release and rerun your cookie scanner to confirm the inventory.