Trackboxx

What Trackboxx is

Trackboxx is a Dutch web analytics platform built as a privacy first alternative to Google Analytics. It targets European SMEs, agencies and public sector websites that want simple traffic measurement without the legal complexity of a US based analytics suite. The platform is developed and operated by Trackboxx B.V. in Amsterdam and runs entirely on EU based infrastructure. The default tracking mode is cookieless: the script counts visitors and page views using truncated IP addresses, User Agent fingerprints and basic page metadata.

What data and cookies Trackboxx collects

In the default cookieless mode Trackboxx does not set any cookie and does not store any persistent identifier on the visitor device. The script captures the truncated IP address, the User Agent string, the page URL, the referrer and the timestamp, and computes a daily hash so that returning visitors can be approximated without persistent identifiers. In the optional cookie mode, a first party cookie is set with a Trackboxx visitor identifier and a session identifier, which improves accuracy at the cost of triggering the ePrivacy consent requirement.

GDPR and ePrivacy implications

Because the default cookieless mode does not store or read information on the visitor device, the ePrivacy Article 5(3) consent requirement does not apply. The processing of the truncated IP and page metadata is justified by the legitimate interest of the operator in measuring traffic, with very limited impact on the visitor. The optional cookie mode does set a first party cookie that goes beyond strictly necessary, so it triggers consent under TTDSG in Germany or its equivalents elsewhere in the EU. In either mode the GDPR transparency obligations of Articles 13 and 14 apply.

Consent requirements and legal basis

The default cookieless mode relies on legitimate interest under Article 6(1)(f) GDPR. The optional cookie mode relies on consent under Article 6(1)(a) GDPR for the cookie storage and on legitimate interest for the analytics processing of the collected data. A data processing agreement with Trackboxx B.V. under Article 28 GDPR is required in both modes because the operator is the controller and Trackboxx is the processor for hosting and processing the analytics data.

Data transfers and hosting

Trackboxx hosts the analytics backend on EU infrastructure (Amsterdam) and uses EU established sub processors. Personal data is not transferred outside the EEA, which removes the entire Schrems II problem and simplifies the privacy notice considerably. This is one of the main reasons European public sector and privacy sensitive operators choose Trackboxx over US based analytics suites.

Practical compliance steps

Choose the cookieless mode whenever possible: it is the simplest path to compliance because no consent is required. Sign the Trackboxx DPA, list Trackboxx B.V. in your privacy notice as a processor and document the EU only hosting model. If you activate the optional cookie mode, integrate the Trackboxx cookie into your CMP under the analytics category and ensure it stays blocked until the visitor opts in.