> How the Checkfront booking widget processes customer and payment data, which cookies and trackers it uses, and how to deploy it under GDPR and ePrivacy. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/checkfront E-commerce # Checkfront Preferences · [Official website](https://www.checkfront.com) Online booking and reservation management platform for tours, rentals and activities, with an embeddable booking widget and payments. [Block Checkfront until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Required - Documented cookies 6 - Third-party domains 6 - Servers Canada and European Union (AWS Canada and AWS European Sovereign Cloud), operated by Checkfront Bookings, Inc. Overview ## What does Checkfront do? ## **What Checkfront Is** Checkfront is an online booking and reservation management platform used by tour, rental and activity operators to take reservations and payments. Businesses embed a booking widget or iframe on their website, and the engine handles availability, customer details and checkout. Checkfront is operated by Checkfront Bookings, Inc. in Canada, with data hosted on AWS Canada and the AWS European Sovereign Cloud. ## **Data and Cookies Collected** The booking flow collects customer names, contact details, booking dates and payment information, with card data handled by Stripe. Session cookies maintain the booking basket and the logged in account, while optional Google Analytics cross domain tracking can follow a visitor from the host site into the Checkfront checkout. The embeddable widget can therefore set cookies in the context of your own domain. ## **GDPR and ePrivacy Implications** Processing a booking and payment relies on the contract legal basis under Article 6(1)(b), so consent is not needed for the core reservation. However, analytics and other non essential cookies require prior consent under Article 5(3) of the ePrivacy Directive and the GDPR. Operators remain the controller for the customer data they collect and should sign a data processing agreement with Checkfront. ## **Consent and Data Transfers** Canada benefits from an EU adequacy decision for commercial organisations, which lowers the transfer risk for the core hosting. Optional integrations are different: Google Analytics and Stripe may route data to the United States, so those flows need appropriate safeguards such as Standard Contractual Clauses. Analytics cookies should only load after the visitor consents through your cookie banner. ## **Practical Compliance Steps** Disclose Checkfront, Stripe and any analytics in your privacy and cookie policies, and gate analytics behind consent. Sign a data processing agreement with Checkfront, keep payment handling within Stripe to stay inside PCI DSS scope, and set retention limits for completed bookings. Choose EU hosting where appropriate and document the transfer position for any United States integrations. Compliance ## Checkfront and the GDPR Checkfront is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Contract under Article 6(1)(b) GDPR for processing bookings and payments, and consent under Article 6(1)(a) and Article 5(3) ePrivacy for analytics and non essential cookies - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, Canadian PIPEDA; PCI DSS for payment data via Stripe ### Impact assessment (DPIA) A full DPIA is usually not required for standard booking management, but a screening assessment is advisable. Consider that the booking engine processes customer contact and payment details, that the embeddable widget can set cookies on the host site, and that optional Google Analytics and Stripe integrations may transfer data to the United States. Document hosting in Canada and the EU, the role of Stripe for payments, and consent handling for analytics cookies. ### Sample text for your banner > We use Checkfront to manage your booking and process your payment. The booking form may set cookies needed to complete your reservation, and with your consent we use analytics cookies to improve the service. You can manage your preferences at any time. Cookies and trackers ## What Checkfront sets and contacts - Tracking method Booking engine with session cookies, embeddable widget and iframe, plus optional Google Analytics cross domain tracking and Stripe payment scripts - Server location Canada and European Union (AWS Canada and AWS European Sovereign Cloud), operated by Checkfront Bookings, Inc. - Data transferred outside the EU Checkfront is a Canadian operator and hosts data in AWS Canada and the EU. Canada benefits from an EU adequacy decision for commercial organisations under PIPEDA. Optional integrations such as Google Analytics and Stripe may route data to the United States, which then requires appropriate transfer safeguards. ### Cookies set (6) | Name | Type | Duration | Purpose | | ------------------- | --------- | ---------- | -------------------------------------------------------------------------------------------------- | | CF\_SESSID | Necessary | Session | Maintains the Checkfront booking session and the contents of the reservation basket | | checkfront\_session | Necessary | Session | Keeps the authenticated account session within the Checkfront booking engine | | \_ga | Analytics | 2 years | Google Analytics cross domain cookie that distinguishes visitors across the host site and checkout | | \_gid | Analytics | 24 hours | Google Analytics cookie that distinguishes visitors over a short period | | \_\_stripe\_mid | Necessary | 1 year | Stripe cookie used for fraud prevention during payment | | \_\_stripe\_sid | Necessary | 30 minutes | Stripe session cookie used for fraud prevention during checkout | ### Third-party domains contacted (6) - `checkfront.com` - `checkfront.io` - `js.stripe.com` - `api.stripe.com` - `google-analytics.com` - `googletagmanager.com` Questions ## Frequently asked questions about Checkfront Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Checkfront set? Checkfront uses necessary session cookies to maintain the booking basket and the logged in account. If you enable Google Analytics cross domain tracking it sets analytics cookies, and Stripe sets fraud prevention cookies during payment. Only the strictly necessary cookies can load without consent. ### Is consent required to use Checkfront? The core booking and payment rely on the contract legal basis, so they do not need consent. However, any analytics or marketing cookies the widget loads require prior consent through your cookie banner before they fire. ### What is the legal basis for Checkfront? Processing a reservation and payment is based on contract under Article 6(1)(b) GDPR. Analytics and other non essential cookies rely on consent under Article 6(1)(a) and Article 5(3) of the ePrivacy Directive. ### Does Checkfront transfer data to third countries? Core hosting is in Canada, which has an EU adequacy decision, and the EU AWS region, so the base risk is low. Optional Google Analytics and Stripe integrations may send data to the United States, which then requires Standard Contractual Clauses. ### Do I need a DPIA for Checkfront? A full DPIA is usually not required for standard booking management, but a screening assessment is advisable. If you process large volumes of bookings or add extensive analytics and profiling, a DPIA may become necessary. ### How do I implement Checkfront compliantly? Disclose Checkfront, Stripe and any analytics, and gate analytics cookies behind consent. Sign a data processing agreement, keep card data within Stripe to limit PCI DSS scope, and set retention limits for completed bookings. ### What are the alternatives to Checkfront? Alternatives include FareHarbor, Rezdy, Bokun, Peek Pro and TrekkSoft. EU or adequacy country hosting and clear consent handling for analytics should weigh in any comparison. ### How do I update my cookie policy for Checkfront? List the necessary booking and Stripe cookies separately from the optional Google Analytics cookies, and explain their purpose and duration. Review the entry whenever you change integrations or Checkfront updates its widget. Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [Nody](https://www.flowconsent.com/en/services/ecommerce/nody) [Nody is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Nody integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Nody helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/nody) [Preferences](https://www.flowconsent.com/en/services/ecommerce/nody) · ### [Envíopack](https://www.flowconsent.com/en/services/ecommerce/enviopack) [Enviopack is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Enviopack integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Enviopack helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/enviopack) [Preferences](https://www.flowconsent.com/en/services/ecommerce/enviopack) · ### [CMoffer](https://www.flowconsent.com/en/services/ecommerce/cmoffer) [CMoffer is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. CMoffer integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, CMoffer helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/cmoffer) [Preferences](https://www.flowconsent.com/en/services/ecommerce/cmoffer) · ### [BedBooking](https://www.flowconsent.com/en/services/ecommerce/bedbooking) [BedBooking is an online scheduling and booking platform that enables businesses to automate appointment management and reduce no-shows. It provides a customizable booking interface, calendar synchronization, and automated reminders via email and SMS. BedBooking supports multiple service types, staff scheduling, and payment collection. With timezone detection and availability management, BedBooking simplifies scheduling across any industry and business size.](https://www.flowconsent.com/en/services/ecommerce/bedbooking) [Preferences](https://www.flowconsent.com/en/services/ecommerce/bedbooking) · ### [Prive](https://www.flowconsent.com/en/services/ecommerce/prive) [Prive is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Prive integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Prive helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/prive) [Preferences](https://www.flowconsent.com/en/services/ecommerce/prive) · ### [Chinese Menu Online](https://www.flowconsent.com/en/services/ecommerce/chinese-menu-online) [Chinese Menu Online is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Chinese Menu Online offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Chinese Menu Online empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/ecommerce/chinese-menu-online) [Analytics](https://www.flowconsent.com/en/services/ecommerce/chinese-menu-online) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)