Apptus (Voyado Elevate)

What Apptus (Voyado Elevate) is

Apptus, now known as Voyado Elevate, is a European e-commerce search, merchandising and personalization platform originating in Sweden. It powers onsite search, product listings and recommendations for online retailers. By observing how visitors search and browse, Elevate ranks products and content to match the most likely intent, improving conversion and relevance.

Because it relies on behavioral signals to personalize the experience, Apptus processes visitor activity data and therefore falls within the scope of European data protection and ePrivacy rules whenever it is deployed on sites serving users in the EU and EEA.

What data and cookies it collects

Apptus sets first party cookies to recognize a visitor and a session. The customerKey cookie holds a randomly generated identifier that links activity across visits, while the sessionKey cookie identifies a single session across page requests. These values are pseudonymous and do not, on their own, reveal a person's identity.

Alongside these identifiers, the platform records search queries, clicks, product views and other onsite interactions. This behavioral data is used to build the personalization profile that drives ranking. Identifier data is typically retained for around one year before automatic removal.

GDPR and ePrivacy implications

The pseudonymous identifiers tied to a browser qualify as personal data under the GDPR, and the personalization cookies are not strictly necessary to deliver the basic service. Under the ePrivacy Directive, storing or reading such cookies requires prior informed consent from the visitor.

As the site operator you act as controller for the personalization you configure, determining the purposes and means of processing, while the provider acts as processor under a data processing agreement. You must provide transparent information and honor data subject rights.

Consent requirements

Personalization cookies should load only after the visitor gives freely given, specific, informed and unambiguous consent through your consent management platform. The cookies must be blocked by default until consent is recorded, and visitors must be able to refuse or withdraw consent as easily as they grant it.

Where consent is declined, the search experience should continue to function in a non personalized mode so that core browsing is never conditioned on accepting tracking.

International data transfers

As a European provider, Voyado hosts company and data servers within the EU and EEA, which limits exposure to third country transfers. In some circumstances the provider may still need to move personal data outside the EEA, in which case appropriate safeguards such as Standard Contractual Clauses apply.

You should confirm the current hosting region and any sub processors in your data processing agreement and reflect transfer mechanisms in your records of processing.

Practical compliance steps

List the customerKey and sessionKey cookies in your cookie policy, classify them as personalization, and gate them behind consent in your consent platform. Sign a data processing agreement with the provider and verify hosting location and retention periods.

Document the processing in your records, run a data protection impact assessment where profiling is significant, and ensure your service desk can fulfill access, portability and erasure requests using the provider GDPR tooling.