Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
HumCommerce is an analytics, heatmap, and session recording tool for online stores. It records how visitors browse and interact with pages, sets tracking cookies, and processes data outside the EU, so it requires prior consent and careful data transfer handling under the GDPR.
HumCommerce is a conversion analytics tool for online stores that combines traditional analytics with heatmaps and session recordings. It shows where visitors click, how far they scroll, and replays individual browsing sessions so merchants can understand and improve the shopping experience.
HumCommerce sets tracking cookies and records detailed interaction data, including mouse movement, clicks, scrolling, and page content captured during session recordings. Because recordings can capture form inputs and on screen information, the data is personal data under the GDPR and can be sensitive if not properly masked.
Analytics, heatmap, and session recording cookies are not strictly necessary, so they require prior consent under Article 5(3) ePrivacy. Session recordings raise additional risk because they may capture personal data the visitor did not intend to share, and because HumCommerce processes data outside the EU you also need a valid transfer mechanism.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Load HumCommerce only after the visitor accepts analytics cookies, and never record sessions before consent. Configure input masking so passwords, payment details, and other sensitive fields are never captured, and make the recording and its purpose clear in your privacy notice.
Sign a data processing agreement, confirm the transfer safeguard, and enable strict masking of sensitive fields. Block the tool until consent, set a short retention period for recordings, document the analytics purpose, and run a DPIA given the session recording and the international transfer.
Websites using HumCommerce must obtain user consent under GDPR regulations.
DPIA considerations
Session recording can capture personal and potentially sensitive data and is combined with an international transfer, so a DPIA is recommended. Assess what the recordings capture, the masking applied, the retention period, and the transfer safeguards.
Sample consent text
We use HumCommerce to analyse how visitors use our store, including heatmaps and session recordings. These cookies and recordings are only created if you accept analytics cookies.
Third-party domains contacted
humcommerce.comcdn.humcommerce.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| hum_uid | Analytics | 1 year | Identifies a unique visitor for analytics and heatmaps |
| hum_session | Analytics | Session | Links interactions and session recordings within a single visit |
| hum_rec | Analytics | 30 days | Manages whether a visitor session is being recorded |
HumCommerce uses cookies for user preferences — inform visitors with a consent banner.
HumCommerce sets analytics cookies that identify a visitor, link interactions within a visit, and manage session recording. All of them are non essential analytics cookies that require consent.
Yes. Analytics, heatmap, and session recording cookies are not strictly necessary, so prior consent is required under Article 5(3) ePrivacy, and no recording should start before the visitor accepts.
Processing relies on consent under Article 6(1)(a) of the GDPR together with Article 5(3) ePrivacy for the cookies. Legitimate interest is not appropriate because of the intrusive nature of session recording.
Yes. HumCommerce processes data outside the EU, so you need a valid transfer mechanism such as Standard Contractual Clauses or the EU US Data Privacy Framework, and you must disclose the transfer.
Yes, a DPIA is recommended. Session recording can capture personal and sensitive data and is combined with an international transfer, so assess the masking, retention, and safeguards.
Block it until consent, enable masking of sensitive fields, sign a data processing agreement, document the transfer safeguard, set short retention for recordings, and run a DPIA.
EU hosted analytics and heatmap tools, including cookieless options, can reduce both consent friction and transfer risk. Any session recording tool still needs consent and careful masking.
List the HumCommerce analytics and recording cookies with their purpose and duration, state that data is processed outside the EU, and name the transfer safeguard. Explain that session recordings are masked.