Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Zadarma is a European cloud telephony platform that supplies virtual phone numbers in over 100 countries, a cloud PBX, a CRM, click to call widgets and WebRTC softphones. On a publisher's website it usually appears as a small callback widget that prompts a visitor to leave their phone number; Zadarma then immediately rings the visitor and the call centre. Because the widget collects a phone number and may also enable call recording, it sits at the intersection of the GDPR, the ePrivacy Directive and national telecom rules.
Zadarma is a cloud telephony platform headquartered in Estonia with subsidiaries in Cyprus. It offers virtual phone numbers in more than 100 countries, a free cloud PBX, a built in CRM, click to call widgets and softphone applications. On a publisher website it usually surfaces as a small callback widget that lets visitors request an immediate phone call back from sales or support.
The widget sets zd_session for the current widget instance, zd_visitor for cross visit recognition, zd_lang for the language and zd_cta for conversion analytics. Zadarma processes the phone number entered, the visitor IP, the User Agent, the timestamps of the request and the resulting call, the call duration and, if enabled, the audio recording. Call metadata is retained for billing for several years; recordings are retained as configured by the merchant.
The callback widget cookies require prior consent under Article 5(3) ePrivacy. The outbound call relies on Article 6(1)(b) GDPR for the contract requested. Call recording is regulated separately and most EU jurisdictions require the consent of all parties, although Germany and France allow specific legitimate interest cases for B2B with a prior verbal notice at the beginning of the call. The widget is also subject to ePrivacy Article 13 marketing rules whenever the callback is used to push a sales pitch the visitor did not request.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Zadarma''s control plane runs on EU infrastructure but call media may transit Zadarma points of presence in Asia or the US for non EEA legs. Every international call therefore introduces a chain of carriers that can process the calling party number, the called number and the call duration as telecom metadata. Document this in the privacy notice especially for support lines that receive calls from outside the EEA.
Gate the widget cookies behind the CMP. If call recording is enabled, play a clear opt in notice at the start of every call. Sign the Zadarma DPA. List Zadarma OU and the call routing carriers in the privacy notice. Limit retention to what billing requires. Train your agents to flag any sensitive information disclosed by the caller and to never store it outside the CRM''s expected fields.
Websites using Zadarma must obtain user consent under GDPR regulations.
DPIA considerations
Zadarma processes phone numbers, call metadata (caller, callee, duration, time, route), optional call recordings, IP address of the web caller and a persistent widget cookie. Key DPIA considerations: (1) phone number is a direct identifier and call recordings can contain special categories of data (health, opinions); (2) Zadarma defaults to EU data centres but international call routing transits carriers in third countries; (3) call recording requires consent from all parties in most EU jurisdictions (two party consent in France, Germany, Spain; legitimate interest exceptions exist for B2B with prior notice); (4) the callback widget triggers an outbound call that must respect ePrivacy Article 13 for direct marketing; (5) integration with the Zadarma CRM creates a unified profile across calls, emails and tickets that the publisher should expose under the right of access. A DPIA is recommended whenever call recording is on, when the callback widget is used at scale or when the integration feeds a CRM with profiles.
Sample consent text
Our callback widget is powered by Zadarma (Zadarma OU, Estonia). When you enter your phone number, Zadarma rings you and us at the same time so we can talk. Your number, the time of the request, your IP address and the call metadata are processed by Zadarma in the European Union. If we record the call, you will hear a notice at the beginning and you can refuse to be recorded. You can also refuse the widget cookies in the cookie banner; the form will still work but we will not remember your number on a return visit.
Third-party domains contacted
zadarma.commy.zadarma.comapi.zadarma.comcallback.zadarma.comwebphone.zadarma.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| zd_session | Strictly necessary | Session | Identifies the active callback widget session so that the visitor's input is matched with the right outbound call request. |
| zd_visitor | Marketing | 1 year | Persistent visitor identifier that lets the callback widget remember a returning visitor and pre, fill the phone number field. |
| zd_lang | Functional | 6 months | Stores the preferred display language for the callback widget. |
| zd_cta | Analytics | 90 days | Aggregated analytics on which call to action triggered the widget, used to compute conversion rates. |
Zadarma uses cookies for user preferences — inform visitors with a consent banner.
zd_session (strictly necessary, session), zd_visitor (marketing, 1 year, persistent visitor identifier), zd_lang (functional, 6 months, language) and zd_cta (analytics, 90 days, conversion attribution). All on Zadarma domains.
Yes for zd_visitor and zd_cta. zd_session and zd_lang can be loaded as strictly necessary or functional. Call recording, when enabled, requires its own consent independent of the cookies.
Contract performance (Article 6(1)(b) GDPR) for the callback the user requested, consent (Article 6(1)(a)) for marketing cookies and call recording, legitimate interest (Article 6(1)(f)) for fraud prevention and quality monitoring in specific B2B contexts.
The control plane stays in the EU but international call media may transit Zadarma points of presence in Asia or the US for non EEA legs. Telecom metadata is processed by every carrier on the path.
Recommended whenever call recording is on, the callback widget is used at scale, or the CRM integration aggregates call records with other personal data.
Block marketing and analytics cookies behind the CMP. Play a clear recording opt in notice. Sign the Zadarma DPA. Limit retention. List Zadarma OU and the routing carriers in the privacy notice. Train agents on sensitive data handling.
Yes : Aircall (France), Ringover (France), Nfon (Germany), 3CX (Cyprus), Sipgate (Germany), Wildix (Italy). Most offer EU only data residency and EU based call recording.
List zd_session, zd_visitor, zd_lang and zd_cta with domain, duration and purpose. Add Zadarma OU as a processor based in Estonia. Mention any non EEA routing carriers in the wider privacy notice.