SiteManager

The SiteManager platform itself sets a small set of strictly necessary first party cookies: an authenticated session cookie for editor users, a CSRF token, a workspace selector and a preview identifier. On published websites, the runtime adds a session identifier and a small JSON object in local storage for layout state. Anything else (Google Analytics, Meta Pixel, HubSpot, A/B test scripts, chat widgets) is added by the website owner through SiteManager modules or custom HTML blocks, and those tags can collect IP addresses, page views, clicks and form contents.

Consent is not required for the strictly necessary cookies used to authenticate editors and to render published pages, because they fall under the Art. 5(3) ePrivacy exemption. Consent becomes mandatory as soon as the owner activates analytics, advertising, chat, video, A/B testing or social widget modules. In that case a Consent Management Platform must block the relevant scripts until the visitor opts in, and the consent must be granular, freely given, informed and revocable.

For the editor and the strictly necessary publishing infrastructure, the appropriate legal basis is contract (Art. 6(1)(b) GDPR) for the agency or merchant operating the editor, and legitimate interest (Art. 6(1)(f) GDPR) for security cookies. For optional analytics and marketing modules a customer activates on the published site, the legal basis is consent under Art. 6(1)(a) GDPR combined with Art. 5(3) ePrivacy. The website owner is the controller and SiteManager BV the processor under Art. 28 GDPR.

The SiteManager publishing layer runs on Amazon Web Services in Frankfurt (eu-central-1), so the core service does not transfer personal data outside the European Economic Area. Transfers can occur when the owner activates US based modules such as Google Analytics, Meta Pixel or HubSpot. Those transfers must be covered by Standard Contractual Clauses, ideally combined with the EU US Data Privacy Framework when the partner is certified, and a Transfer Impact Assessment that documents supplementary measures.

A formal Data Protection Impact Assessment is usually not required for the SiteManager publishing platform alone, given EU hosting and minimal data processing. A DPIA becomes appropriate when the website processes special categories of data, targets a large audience of children or vulnerable users, runs systematic behavioural advertising, or combines several tracking modules likely to result in a high risk to data subjects under Art. 35 GDPR. Document the screening decision in any case.

Sign a Data Processing Agreement with SiteManager BV, list the platform in your Art. 30 register, publish a clear privacy notice and cookie page, and connect a Consent Management Platform that gates every optional module. Anonymise IP addresses where the module allows it, set short cookie lifetimes, audit active modules quarterly and remove unused tags. Train your editors so they do not paste tracking snippets directly into pages, but always route them through the consent layer.

Alternative EU based visual website builders include Webnode (Czechia), Wix Studio (with EU hosting options), Strapi based stacks combined with a privacy first front end, or Wagtail and Drupal hosted on European clouds such as Scaleway, OVHcloud or Hetzner. None of these eliminate the consent obligation for analytics and marketing modules. The relevant comparison is the location of the publishing infrastructure, the Data Processing Agreement and the granularity of cookie controls offered by the editor.

List the strictly necessary cookies set by SiteManager (session, CSRF, workspace) with their purpose and lifetime, then add a section per optional module enabled by the editor (Google Analytics, Meta Pixel, chat, A/B testing) with the cookies they drop and the third country transfer details. Mention SiteManager BV as processor and the EU hosting location. Re audit the policy whenever an editor adds or removes a module, at least every six months, and store previous versions for accountability.