Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Apptus, now Voyado Elevate, is a European e-commerce search, merchandising and personalization engine that tracks onsite behavior to tailor search and product results.
Apptus, now known as Voyado Elevate, is a European e-commerce search, merchandising and personalization platform originating in Sweden. It powers onsite search, product listings and recommendations for online retailers. By observing how visitors search and browse, Elevate ranks products and content to match the most likely intent, improving conversion and relevance.
Because it relies on behavioral signals to personalize the experience, Apptus processes visitor activity data and therefore falls within the scope of European data protection and ePrivacy rules whenever it is deployed on sites serving users in the EU and EEA.
Apptus sets first party cookies to recognize a visitor and a session. The customerKey cookie holds a randomly generated identifier that links activity across visits, while the sessionKey cookie identifies a single session across page requests. These values are pseudonymous and do not, on their own, reveal a person''s identity.
Alongside these identifiers, the platform records search queries, clicks, product views and other onsite interactions. This behavioral data is used to build the personalization profile that drives ranking. Identifier data is typically retained for around one year before automatic removal.
The pseudonymous identifiers tied to a browser qualify as personal data under the GDPR, and the personalization cookies are not strictly necessary to deliver the basic service. Under the ePrivacy Directive, storing or reading such cookies requires prior informed consent from the visitor.
As the site operator you act as controller for the personalization you configure, determining the purposes and means of processing, while the provider acts as processor under a data processing agreement. You must provide transparent information and honor data subject rights.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Personalization cookies should load only after the visitor gives freely given, specific, informed and unambiguous consent through your consent management platform. The cookies must be blocked by default until consent is recorded, and visitors must be able to refuse or withdraw consent as easily as they grant it.
Where consent is declined, the search experience should continue to function in a non personalized mode so that core browsing is never conditioned on accepting tracking.
As a European provider, Voyado hosts company and data servers within the EU and EEA, which limits exposure to third country transfers. In some circumstances the provider may still need to move personal data outside the EEA, in which case appropriate safeguards such as Standard Contractual Clauses apply.
You should confirm the current hosting region and any sub processors in your data processing agreement and reflect transfer mechanisms in your records of processing.
List the customerKey and sessionKey cookies in your cookie policy, classify them as personalization, and gate them behind consent in your consent platform. Sign a data processing agreement with the provider and verify hosting location and retention periods.
Document the processing in your records, run a data protection impact assessment where profiling is significant, and ensure your service desk can fulfill access, portability and erasure requests using the provider GDPR tooling.
Websites using Apptus (Voyado Elevate) must obtain user consent under GDPR regulations.
DPIA considerations
Because Apptus profiles onsite behavior to personalize search and product results, a data protection impact assessment is recommended. Assess the scope of behavioral profiling, the use of pseudonymous identifiers, retention of the customerKey and sessionKey values, and whether personalization could produce effects that are significant for visitors. Document the lawful basis, transparency measures and any transfers outside the EU/EEA.
Sample consent text
We use Apptus (Voyado Elevate) to personalize search results and product recommendations based on your activity on this site. These cookies are set only with your consent. You can accept or decline below and change your choice at any time in our cookie settings.
Third-party domains contacted
apptus.comvoyado.comelevate.voyado.cloudapi.apptus.cloudCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| apptus.customerKey | First party personalization | 1 year | Stores a randomly generated pseudonymous identifier that recognizes a returning visitor across sessions to personalize search and product results. |
| apptus.sessionKey | First party personalization | Session | Stores a randomly generated identifier that links page requests within a single browsing session for personalization. |
| apptus.recommendation | First party personalization | Session | Supports product recommendation logic during the active session based on observed onsite behavior. |
| apptus.functional | First party functional | Session | Maintains basic functional state required for the search component to operate during the visit. |
Apptus (Voyado Elevate) uses cookies for user preferences — inform visitors with a consent banner.
Apptus sets first party cookies, principally customerKey to recognize a returning visitor across sessions and sessionKey to track a single browsing session. Both hold randomly generated, pseudonymous identifiers used to personalize search and product results. They are not strictly necessary and are classified as personalization cookies.
Yes. Because the personalization cookies are not essential to the basic service, the ePrivacy Directive requires prior informed consent before they are set. Configure your consent platform to block these cookies until the visitor agrees, and continue offering a non personalized search experience to those who decline.
For non essential personalization, the lawful basis under the GDPR is the visitor consent obtained under Article 6(1)(a). Any strictly necessary functional processing may rely on legitimate interest, but behavioral profiling for personalization should be grounded in consent that mirrors the ePrivacy requirement.
As a European provider, Voyado hosts its servers within the EU and EEA, so most processing stays in Europe. In limited cases it may transfer personal data outside the EEA, in which case safeguards such as Standard Contractual Clauses apply. Confirm the current arrangements in your data processing agreement.
A data protection impact assessment is advisable where personalization involves systematic profiling of behavior. Evaluate the scale of the profiling, the pseudonymous identifiers, retention periods and any significant effects on visitors. If the residual risk remains high after mitigations, consult your supervisory authority.
List the customerKey and sessionKey cookies in your cookie policy, gate them behind consent, and sign a data processing agreement with the provider. Verify the hosting region and retention periods, document the processing in your records, and ensure access, portability and erasure requests can be fulfilled.
Alternatives include other onsite search and personalization engines such as Algolia, Coveo, Klevu and Searchspring. When comparing them, weigh hosting location, the cookies and identifiers each sets, available data processing terms, and how easily personalization can be disabled for visitors who refuse consent.
Add an entry describing the customerKey and sessionKey cookies, their purpose of personalization, their roughly one year and session durations, and their first party nature. State that they load only after consent, explain how to withdraw consent, and review the entry whenever the integration changes.