CMS

KIT CMS

KIT CMS is a self hosted content management system used by editorial, corporate and e-commerce websites. The core platform writes only strictly necessary session and CSRF cookies, but most production deployments enable optional analytics, social and marketing modules that fall under the ePrivacy consent rule. The privacy posture therefore depends on which modules the controller activates.

Block KIT CMS until consent Scan my site

Overview

What does KIT CMS do?

What KIT CMS is and how it works

KIT CMS is a self hosted content management system that powers editorial, corporate and e-commerce websites. It runs as a server side PHP application installed on infrastructure chosen by the publisher. The core platform handles content modelling, role based authoring, multilingual templates and a plugin marketplace. Because the software is installed on the customer infrastructure, the personal data flows are entirely controlled by the website owner and not by a third party.

Cookies and personal data collected

By default KIT CMS only writes a session cookie (typically PHPSESSID or a renamed equivalent) and a CSRF token cookie used to protect form submissions. These cookies expire when the browser is closed or after a short inactivity window. They do not contain personal data beyond the session identifier, which is meaningless without server side state. When the controller installs comment modules, member areas, analytics widgets or social plugins, additional cookies and identifiers may be written, including third party trackers.

GDPR and ePrivacy implications

The session and CSRF cookies set by KIT CMS are strictly necessary under Article 5(3) of the ePrivacy Directive and recital 66, since they are required to deliver the website service explicitly requested by the user. They can be loaded without consent. The privacy notice should still describe their purpose and lifetime under Articles 13 and 14 GDPR. Any optional module that triggers analytics, advertising, social or personalisation cookies requires consent collected through a Consent Management Platform.

International data transfers

There is no transfer outside the European Economic Area when the application is hosted on EU infrastructure. If you host KIT CMS in Russia or another country without an adequacy decision, you must perform a Transfer Impact Assessment, sign Standard Contractual Clauses with the hosting provider and document supplementary measures. Many editors targeting European audiences therefore choose EU based hosting (OVH, Hetzner, Scaleway) and provide a clear statement in the privacy notice.

Compliance steps for a clean deployment

List every active module in your privacy notice and your record of processing activities. Pin the session cookie to the Secure and HttpOnly flags, set SameSite=Lax and configure short expirations. Block any optional analytics, social or advertising module behind a Consent Management Platform such as FlowConsent. Run regular tag scans to make sure third party scripts are loaded only after consent. Document the hosting region, the backup location and the legal basis of each processing activity.

Compliance

KIT CMS and the GDPR

Legal basis: Strictly necessary technical cookies fall under the exemption of Article 5(3) of the ePrivacy Directive. Session and CSRF cookies are needed to deliver the service explicitly requested by the user. Optional analytics, comments or marketing modules require consent.
Risk level: low
Applicable regulations: GDPR, ePrivacy Directive (2002/58/EC), national ePrivacy implementations (CNIL recommendation in France, TTDSG/TDDDG in Germany, LSSI and LOPDGDD in Spain), EDPB Guidelines 03/2022 on consent, OWASP cookie security recommendations

Impact assessment (DPIA)

KIT CMS used as a content management tool with strictly necessary cookies is generally low risk. A DPIA becomes relevant when the deployment activates large scale member directories, behavioural personalisation, third party advertising integrations or when the hosting infrastructure is located in a country without an adequacy decision. Document the modules enabled, the data flows and the legal basis of each processing activity.

Sample text for your banner

This website is built on KIT CMS. Only strictly necessary cookies are written by default to keep your session active and to protect against forgery attacks. Additional analytics, social or marketing cookies require your explicit consent and can be managed at any time from the cookie preferences link.

Cookies and trackers

What KIT CMS sets and contacts

Tracking method: Server side PHP application that writes session and CSRF cookies on the visitor browser. Tracking depends on the modules enabled by the site owner.
Server location: Defined by the customer hosting choice. Most KIT CMS deployments run on shared or dedicated hosting in Russia and the CIS, and increasingly in the European Union for editors targeting EU audiences.
Cookieless mode available: Yes

Cookies set (3)

Name	Type	Duration	Purpose
PHPSESSID	first_party	Session	Stores the session identifier so that visitor server side state (cart, login status, language) is preserved across requests.
csrf_token	first_party	Session	Stores a per session token used to validate form submissions and protect against Cross Site Request Forgery attacks.
kit_lang	first_party	1 year	Stores the language preference selected by the visitor so that subsequent visits load the correct localised version.

Third-party domains contacted (2)

kit-cms.ru
kit-cms.com

Questions

Frequently asked questions about KIT CMS

Can't find your question? Write to us, we answer fast.

Write to us

Which cookies does KIT CMS write by default?

By default the platform writes one session cookie (typically PHPSESSID or a renamed equivalent) and one CSRF token cookie. Both are first party, expire when the browser closes or after short inactivity, and only contain a random server side identifier with no personal data.

Do I need consent for the default KIT CMS cookies?

No. The session and CSRF cookies fall under the strictly necessary exemption of Article 5(3) of the ePrivacy Directive and recital 66, since they are required to deliver the website service explicitly requested by the user. Optional analytics, advertising or social modules require consent.

What is the legal basis for processing personal data through KIT CMS?

Authentication, session management and content delivery rely on contract performance under Article 6(1)(b) GDPR or legitimate interest under Article 6(1)(f). Member registration and account management use contractual or legitimate interest grounds, while marketing modules require consent under Article 6(1)(a).

Are data transferred to the United States or Russia when I use KIT CMS?

KIT CMS is self hosted, so the controller chooses the hosting region. There is no built in transfer to the United States. If the application is hosted in Russia or another country without an adequacy decision, you must rely on Standard Contractual Clauses and a Transfer Impact Assessment.

Do I need a DPIA for KIT CMS?

For a basic deployment a DPIA is rarely mandatory. However, if you enable large scale member directories, behavioural personalisation or advertising integrations, or if data is hosted outside the EEA, the threshold of Article 35 GDPR is often met. Document the criteria of the Article 29 Working Party guidelines.

How do I implement KIT CMS in a fully compliant way?

Pin every cookie to Secure and HttpOnly with SameSite=Lax, host on EU infrastructure when possible, list active modules in your privacy notice, block optional trackers behind a Consent Management Platform such as FlowConsent and audit your tags regularly. Sign Data Processing Agreements with every plugin vendor.

What are the alternatives to KIT CMS?

Common open source alternatives include WordPress, Drupal, TYPO3 (very popular in Germany), Joomla and Strapi for headless deployments. Each has different cookie behaviours and module ecosystems, so review their default privacy posture before migrating.

How should I update my cookie policy when I deploy KIT CMS?

List the session and CSRF cookies as strictly necessary, document the hosting region, and add a separate entry for every optional module that writes additional cookies. Provide a clear consent management link in the footer and document the proof of consent retention.

Simple Machines Forum

Simple Machines Forum is a community forum platform that enables organizations to build engaging online discussion spaces for their users, customers, or members. It provides threaded discussions, user profiles, moderation tools, and notification systems. Simple Machines Forum supports categories, tags, and search functionality to organize conversations. With gamification features, reputation systems, and SEO-optimized content, Simple Machines Forum helps build vibrant communities that drive engagement and loyalty.

CMS

iMotor

i-motor is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. i-motor supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, i-motor ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

Art Schema

Art Schema is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Art Schema supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Art Schema enables informed decisions that improve experience and drive results.

Analytics

Octopress

Octopress is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Octopress supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Octopress ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

Scissor Themes Writee

Scissor Themes Writee is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Scissor Themes Writee integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Scissor Themes Writee helps organizations maintain robust websites that meet user.

CMS

Telescope

Telescope is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Telescope supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Telescope ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my banner Scan my site