Sirge

What Sirge is

Sirge is a marketing attribution and ad tracking app based in the United States. It is built mainly for Shopify stores that run paid campaigns on platforms such as Facebook and TikTok. By following the customer journey from the first ad click to the final purchase, Sirge tells merchants which campaigns actually drive revenue. This makes it a powerful tool, but also one that processes a large amount of personal data about shoppers.

Data and cookies

Sirge relies on first party cookies, click identifiers and UTM parameters to recognise visitors and connect them to specific campaigns. It uses server side tracking to send conversion events back to the advertising platforms, which improves measurement even when browsers block scripts. The data involved includes online identifiers, browsing behaviour on the store and purchase information. Under the GDPR this is personal data, so it must be handled with a clear legal basis and proper transparency.

GDPR and ePrivacy

The cookies and identifiers that Sirge stores or reads on a visitor device fall under article 5(3) of the ePrivacy Directive, which requires prior consent for any non essential storage. The processing of the collected data is then governed by the GDPR. Because attribution and advertising are not strictly necessary to deliver the store, the appropriate legal basis is consent under article 6(1)(a). Merchants in the European Union therefore cannot activate Sirge by default before a visitor has agreed.

Consent

Valid consent must be freely given, specific, informed and unambiguous, and it must be as easy to refuse as to accept. A compliant setup keeps Sirge inactive until the visitor opts in through a consent banner, and it blocks both the cookies and the server side events until that moment. The consent record should show what the visitor agreed to and when. Visitors must also be able to withdraw their consent later without difficulty.

International transfers

Sirge is a United States company, and it shares attribution data with advertising platforms that also operate there. This means personal data leaves the European Union and reaches a third country. Transfers should rely on the EU US Data Privacy Framework where the recipient is certified, or on the Standard Contractual Clauses backed by a transfer impact assessment. Merchants should document these safeguards and inform visitors that their data may be processed outside the European Economic Area.

Practical compliance

To use Sirge lawfully, connect it to a consent management platform so that tracking only starts after opt in. Document the cookies in your cookie policy, name Sirge in your privacy notice, and sign a data processing agreement that covers the international transfers. Keep a record of consent and review the configuration whenever Sirge adds new features or destinations. With these measures in place, merchants can benefit from accurate attribution while respecting the rights of their visitors.