CMS

Goope

Goope is a hosted website builder for small and mid sized Japanese businesses, operated by GMO Pepabo, Inc. It targets local shops, restaurants, salons and cultural venues with templates, a domain service and a basic content management interface. Hosting is in Japan, which benefits from an EU adequacy decision, but European customers must still address the cookie consent obligations for any analytics or third party scripts they enable on top of the platform.

Block Goope until consent Scan my site

Overview

What does Goope do?

What Goope is

Goope is a hosted website builder operated by GMO Pepabo, Inc., part of the GMO Internet Group. It is targeted at small and mid sized Japanese businesses such as restaurants, hair salons, dental practices and cultural venues. The product packages templates, a domain service, basic CMS, image hosting and a contact form module.

What data Goope handles

Out of the box, Goope sets functional first party cookies for the editor login (goope_session) and the language preference. Visitor IP addresses, user agents and request metadata reach the GMO data centres in Japan. The site owner can plug in Google Analytics, Yahoo! Japan ad tags, social widgets and other scripts via the custom code feature.

GDPR and ePrivacy implications

The base Goope cookies qualify as strictly necessary and are exempt from consent under Article 5(3) ePrivacy. Any analytics tag or third party integration added by the site owner is not exempt and triggers the consent requirement. The IP processing in Japan is personal data processing under Article 4(1) GDPR and requires a clear legal basis and transfer mechanism.

Adequacy and data transfers

In January 2019 the European Commission adopted a mutual adequacy decision with Japan covering personal data transferred to private commercial operators that comply with the supplementary rules of the APPI. Goope is in scope as long as GMO Pepabo handles EU personal data under those rules. Standard Contractual Clauses are therefore not strictly required, but a transfer impact assessment is recommended.

Consent and configuration

A vanilla Goope site with no analytics, no embedded video and no third party fonts can in many cases run with only a privacy notice. Activating Google Analytics, Yahoo! Japan tags, Instagram embeds or Google Fonts loaded dynamically requires an opt in cookie banner. Goope does not include a built in CMP, so the site owner must inject one via the custom code feature.

Practical compliance steps

Sign the GMO Pepabo Goope DPA, document Goope as a Japanese sub processor under the EU/Japan adequacy decision, mention GMO and the supplementary APPI rules in the privacy notice, prefer privacy aware embeds, install a CMP via custom code if you enable analytics, and review the site after each Goope template release for new third party scripts.

Compliance

Goope and the GDPR

Goope is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) for the strictly necessary functional cookies used by the editor and the published site. Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy Directive) for any analytics or third party integration the site owner activates (Google Analytics, Yahoo! Japan tags, embedded social widgets).
Risk level: medium
Applicable regulations: GDPR, ePrivacy Directive, EU/Japan adequacy decision, Japanese Act on the Protection of Personal Information (APPI), French CNIL guidelines, German TTDSG, Spanish LSSI, Italian Garante guidelines

Impact assessment (DPIA)

A DPIA is generally not required for a Goope site that uses only the platform with strictly necessary cookies. It can become relevant if Google Analytics, Yahoo! Japan tags, embedded social widgets or password protected sections handling special categories of personal data are added.

Sample text for your banner

This site is built on Goope, hosted in Japan by GMO Pepabo. Functional cookies are required to keep the experience working. We also use Google Analytics for audience measurement, which sets analytics cookies. We only enable analytics after you click Accept.

Cookies and trackers

What Goope sets and contacts

Tracking method: Hosted website builder for Japanese SMBs operated by GMO Pepabo. Pages are served from goope.jp and customer custom domains, with first party functional cookies (login session, language preference) and an optional integration with Google Analytics or other Japanese analytics products. The platform itself does not include cross site advertising profiling.
Server location: Goope is operated by GMO Pepabo, Inc., headquartered in Tokyo. Production hosting infrastructure is located in Japan, mainly in the Tokyo and Osaka regions of GMO Internet Group data centres.
Data transferred outside the EU: Visitor IP addresses, user agents and request metadata are processed in Japan. Japan benefits from a European Commission adequacy decision (mutual adequacy with Japan, January 2019), which provides essentially equivalent protection for transfers to commercial operators handling EU personal data. Sub processors are listed by GMO Pepabo on the Goope policy page.

Cookies set (2)

Name	Type	Duration	Purpose
goope_session	session	Session	Strictly necessary functional cookie used to maintain the editor login session in the Goope back office.
goope_locale	persistent	1 year	Stores the visitor language preference for the published Goope site.

Third-party domains contacted (3)

goope.jp
static.goope.jp
pepabo.com

Questions

Frequently asked questions about Goope

Can't find your question? Write to us, we answer fast.

Write to us

What cookies does Goope set?

Goope sets functional first party cookies for the editor session (goope_session) and the language preference. The platform itself does not set advertising cookies. Third party tracking cookies appear only if the site owner adds them via integrations or custom code.

Do I need consent to publish a Goope site?

Not for the strictly necessary functional cookies. As soon as Google Analytics, Yahoo! Japan tags, Instagram embeds or dynamic Google Fonts is enabled, prior consent under Article 5(3) ePrivacy is required.

What is the legal basis for Goope?

Legitimate interest (Art. 6(1)(f) GDPR) for the strictly necessary functional cookies and the page delivery. Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy) for any third party integration that drops cookies or transfers data abroad.

Does Goope transfer data to Japan?

Yes. GMO Pepabo, Inc. is a Japanese company and hosting is in Japan. Japan benefits from the EU/Japan mutual adequacy decision, with supplementary APPI rules for personal data received from the EEA. Standard Contractual Clauses are not strictly required when the deployment is in scope.

Do I need a DPIA for a Goope site?

Generally no for a small business site with only strictly necessary cookies. A DPIA can be relevant if the site enables Google Analytics at scale, embeds many third party trackers, password protects sections handling special category data or hosts editorial content with sensitive personal data.

How do I implement Goope compliantly?

Sign the GMO Pepabo Goope DPA, document Goope as a Japanese sub processor under the EU adequacy decision and APPI supplementary rules, write a privacy notice that names the company and the transfer, prefer privacy aware embeds and add a cookie banner only if you enable analytics or third party trackers.

What are the alternatives to Goope?

For privacy first website builders in Europe, alternatives include Webflow, Framer, Cargo, Pixpa, Format, Squarespace and Shopify with EU regions. For strict EU residency, the safest path is a static site generator (Astro, Hugo) hosted on EU providers (OVHcloud, Scaleway, Hetzner).

How do I update the cookie policy for Goope?

List GMO Pepabo, Inc. as a Japanese sub processor with the purpose (website hosting and content delivery), the cookies (goope_session, goope_locale), the legal basis (legitimate interest for functional cookies, consent for any third party tracker you enable), the transfer destination (Japan) and the safeguard (EU/Japan adequacy decision plus APPI supplementary rules).

ReadMe

ReadMe is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ReadMe integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ReadMe helps organizations maintain robust websites that meet user expectations and technical requirements.

CMS

SDL Tridion

SDL Tridion is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. SDL Tridion integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, SDL Tridion helps organizations maintain robust websites that meet user expectations and technical requirements.

CMS

Polylang

Polylang is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Polylang supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Polylang remains a leading web development choice.

Essential

Pimcore

Pimcore is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Pimcore supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Pimcore ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

B12

B12 is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. B12 supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, B12 enables informed decisions that improve experience and drive results.

Analytics

Super Builder

Super Builder is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Super Builder supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Super Builder enables informed decisions that improve experience and drive results.