Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Zoho is a global SaaS suite that bundles a CRM, marketing automation, project management, mail, finance, HR and customer service applications. On a public website, Zoho most commonly appears as the SalesIQ live chat widget, embedded Zoho Forms or Bookings widgets, and PageSense behavioural analytics. Zoho lets customers choose between EU, US, India, Australia and China data centres, which makes regional residency more achievable than for many SaaS competitors.
Zoho is one of the largest global SaaS suites, with more than 55 cloud applications covering CRM, marketing automation, project management, helpdesk, ecommerce, finance, HR, mail and productivity. On the visitor facing side of a website, Zoho most commonly shows up as Zoho SalesIQ live chat, an embedded Zoho Forms widget, a Zoho Bookings calendar, the Zoho PageSense analytics tracker or a Zoho Campaigns subscription form. Behind the scenes, Zoho CRM, Zoho Desk, Zoho Recruit and other tools store customer data accessed by sales, support and HR teams.
Zoho SalesIQ sets cookies (siqlsdb, siq_*, visitor_lat) to track chat sessions, returning visitors and operator engagement. Zoho PageSense sets analytics cookies for funnel tracking, heatmaps and session recording. Zoho Forms and Zoho Campaigns process the data submitted by the visitor. Zoho CRM stores contact, lead, account, deal and activity records. The platform also collects IP addresses, User Agents, geolocation, referrer and behavioural events.
Zoho is a third party SaaS that sets analytics and marketing cookies that fall outside strict necessity, triggering the ePrivacy consent requirement when SalesIQ, PageSense or campaign cookies are loaded on public pages. The merchant remains the controller for CRM, Campaigns and HR data while Zoho acts as processor. Zoho offers granular consent integration and an ePrivacy compliance mode that delays cookie placement until consent is recorded.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Customers choose a regional data centre. zoho.eu hosts customer data in Amsterdam and Dublin and is the recommended option for EU customers. zoho.com is hosted in the United States and zoho.in in India. Even with the EU data centre, R&D, support and observability functions can be operated by Zoho Corporation Pvt. Ltd. from India. Transfers rely on the Zoho Data Processing Addendum, the EU Standard Contractual Clauses under Article 46(2)(c) GDPR and the EU US Data Privacy Framework for US flows.
Sign up for the EU data centre (zoho.eu) when starting your Zoho account, sign the Zoho Data Processing Addendum, enable the ePrivacy compliance mode in SalesIQ and PageSense, and integrate the widgets with your consent management platform so that the cookies only load after consent. Document Zoho Corporation Pvt. Ltd. as a processor in your record of processing activities and mention the EU and US data centres in the privacy notice.
Websites using Zoho must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended when Zoho CRM, Zoho Campaigns or Zoho Marketing Automation hold large volumes of EU contact data, when Zoho PageSense performs session recording or heatmaps with personal data, when Zoho People processes HR data of European employees or when sensitive sectors (health, finance, public administration) are involved.
Sample consent text
We use Zoho services (Zoho Corporation Pvt. Ltd., India). The Zoho SalesIQ chat, Zoho Forms and PageSense analytics widgets on this site set cookies and may transfer your data to Zoho data centres, including Amsterdam, Dublin, the United States and India. By accepting, you allow this transfer under EU Standard Contractual Clauses and the EU US Data Privacy Framework for US flows.
Third-party domains contacted
zoho.comzoho.euzoho.insalesiq.zoho.comsalesiq.zoho.eupagesense.zoho.compagesense.zoho.euzohopublic.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| siqlsdb | Functional (SalesIQ) | Persistent | Stores the local SalesIQ session database that powers the live chat widget, including the visitor identifier and chat state. |
| visitor_lat | Functional (SalesIQ) | 1 year | Stores the visitor's last activity timestamp so SalesIQ can resume the same chat session if the visitor returns within the inactivity window. |
| zps-tgr-dts | Analytics (PageSense) | 1 year | PageSense visitor identifier used to track funnel progression, A/B tests and heatmaps. |
| zsa_chksh | Analytics (PageSense) | 1 year | PageSense session cookie that stores fingerprint information for the session recording feature. |
| _zcsr_tmp | Strictly necessary | Session | Zoho CSRF token used to protect authenticated Zoho actions, for example during a form submission from an embedded Zoho widget. |
Zoho uses cookies for user preferences — inform visitors with a consent banner.
The most common ones are SalesIQ cookies (siqlsdb, siq_*, visitor_lat) for the live chat widget and PageSense cookies (zps-tgr-dts, zsa_chksh) for analytics, heatmaps and session recording. CRM and Campaigns cookies appear when visitors interact with embedded forms or click on tracked email links.
Yes for SalesIQ, PageSense, Campaigns and any marketing widget that sets analytics or marketing cookies. No consent is required for the strictly necessary cookies of an authenticated Zoho account used internally by employees. Zoho provides a built in ePrivacy compliance mode and consent integration.
Customer relationship and support workflows in Zoho CRM, Desk and Recruit rely on the performance of a contract under Article 6(1)(b) GDPR. Marketing automation, chat widgets and analytics rely on consent under Article 6(1)(a) GDPR collected through a consent management platform.
Choosing zoho.eu keeps customer data in Amsterdam and Dublin. For US flows (zoho.com), Zoho signs the EU Standard Contractual Clauses under Article 46(2)(c) GDPR via its Data Processing Addendum and confirms participation in the EU US Data Privacy Framework. Indian back office access is covered by the same SCCs.
A DPIA is recommended for large CRM databases of EU prospects and customers, for HR data managed in Zoho People, for sensitive helpdesk data managed in Zoho Desk and when PageSense performs session recording on pages that may capture sensitive information.
Sign up on zoho.eu, sign the Zoho Data Processing Addendum, configure SAML SSO with granular roles, enable the ePrivacy compliance mode on SalesIQ and PageSense, gate widgets behind a consent management platform and document Zoho Corporation Pvt. Ltd. as a processor with EU and US data centres in your record of processing activities.
European alternatives include CentralStation CRM (Germany), TeamLeader (Belgium), Pipedrive (Estonia), Salesforce Hyperforce EU regions, HubSpot with EU data residency, Brevo (France) and OdooSH (Belgium). The right choice depends on application breadth, integrations and total cost of ownership.
List Zoho Corporation Pvt. Ltd. as a processor, identify which Zoho applications are used (SalesIQ, PageSense, Campaigns, Forms, CRM), describe the corresponding cookies and durations, mention the data centre (zoho.eu, zoho.com) and the SCC plus DPF safeguards where applicable, and link to the Zoho Privacy Policy.