ThingPark Enterprise

What ThingPark Enterprise is

ThingPark Enterprise is the LoRaWAN network server (LNS) developed by Actility, a French company that pioneered carrier grade LoRaWAN since 2010. The platform performs the core LNS functions: gateway provisioning, frame deduplication, MAC commands, adaptive data rate, OTAA join procedure and forwarding of decrypted application payloads to the customer business systems. It also offers a web console (ThingPark UI), a Network and Operations Centre, an Application Server (ThingPark X) and a Device Manager. ThingPark Enterprise is deployed at thousands of industrial sites worldwide, often through Actility partners such as Inmarsat, Orange Business or Tata Communications.

What data and cookies ThingPark Enterprise handles

On the operator side, the ThingPark portal sets technical cookies for authentication, anti CSRF protection and session continuity, plus optional analytics cookies. On the network side the platform processes device identifiers (DevEUI, JoinEUI, DevAddr), gateway identifiers and location, signal metrics (RSSI, SNR), join requests and encrypted application payloads. Payloads are decrypted with the AppSKey before forwarding to the application server defined by the customer. Metadata such as gateway GPS coordinates and RSSI can in some scenarios be used to derive end device location.

GDPR and ePrivacy implications

Whether GDPR applies depends on the use case. Industrial telemetry from anonymous sensors usually does not involve personal data, but smart building, smart metering or worker tracking deployments clearly do. Actility acts as a processor on behalf of the customer for telemetry and as controller for portal accounts. ePrivacy applies to the operator portal cookies, which must follow the usual consent rules for analytics, and to any localisation data that can identify a subscriber.

Consent requirements

Consent is required for non essential cookies on the operator portal and for any IoT use case where the controller cannot rely on contract or legitimate interest, for example workplace monitoring or geolocation of employees. For most B2B asset monitoring the legal basis is contract or legitimate interest, supported by transparency notices and an information security baseline.

Data transfers

The Actility ThingPark SaaS is hosted primarily in France and other EU regions. Customers can also subscribe to a global ThingPark instance or operate behind partner networks (Inmarsat, KPN, Tata, Senet) that may route data through non EEA regions. Customers commonly forward decoded payloads to AWS, Microsoft Azure or Google Cloud application backends, including non European regions. Standard Contractual Clauses, the EU US Data Privacy Framework and a transfer impact assessment are therefore essential.

Practical compliance steps

Sign the Actility data processing agreement, choose an EU region, document gateway and device categories in the record of processing activities, configure short retention windows in ThingPark and offload long term storage to your own systems, restrict portal access through SSO and RBAC, perform a DPIA for any high risk use case (worker tracking, smart metering, public lighting), and pair ThingPark with NIS2 grade incident response procedures.