Actito

What Actito is

Actito is a European customer engagement and marketing automation platform that originated in Belgium and positions itself as a customer engagement solution made in Europe. It brings together a central contact database, multichannel campaign management across email, SMS and push, and a website tracking capability called the Goals module. The platform is widely used by retailers, financial services firms and other brands that run personalised, data driven marketing. A defining characteristic is that Actito operates its own European infrastructure, with data centres in Belgium and a server in Paris, which makes it attractive to organisations that prioritise European data residency. Marketers use it to unify customer profiles, orchestrate campaigns and measure how recipients respond across channels.

Cookies and data collected

When the Goals tracking script is installed on a website, Actito sets a first party cookie that stores a unique identifier known as the actId, which links a visitor to a specific contact profile in the database. This cookie is typically generated when a recipient clicks a link in an Actito email for which goal tracking is enabled, and it can also be set through an external system to follow visitors who never clicked an email. The identifier allows page views and conversions to be attributed to a known contact, which is the basis of Actito behavioural reporting. In email, Actito relies on tracking pixels and tagged links rather than cookies to record opens and clicks. The combined effect is a profile that can contain contact details, campaign engagement history and website behaviour, all of which constitute personal data under the GDPR.

GDPR and ePrivacy implications

The actId cookie and the website Goals script are not strictly necessary to deliver a website, so under the ePrivacy Directive they require prior consent before they are placed on a visitor device. Because the identifier is linked to a named contact profile, the resulting processing is clearly within the scope of the GDPR and must rest on a valid lawful basis. Email open and click tracking that is tied to an identifiable individual is treated by several supervisory authorities as profiling that also needs consent. National rules such as the German TTDSG and the guidance issued by the French CNIL reinforce that non essential tracking must be opt in and must not run before a choice is made. Organisations therefore need to treat Actito website and email tracking as consent based processing and keep clear records of the choices their contacts make.

Consent requirements and CMP integration

The Goals tracking script should be governed by a consent management platform so that it only fires after a visitor has accepted marketing or analytics cookies. In practice this means loading the Actito script through the tag manager or consent gate and blocking it by default until consent is recorded. The consent banner must appear on first page load, offer a genuine choice to refuse, and make withdrawing consent as easy as giving it. For email, contacts should have a clear way to opt out of behavioural tracking, which Actito supports through preference and consent handling. Keeping the consent state synchronised between the CMP and the campaigns ensures that tracking and profiling stop promptly when someone changes their mind.

International data transfers

Actito is a European company that processes customer data within its European infrastructure, with data centres in Belgium and a server in Paris, which means EU customers can generally keep personal data inside the European Economic Area. This is a meaningful advantage compared with platforms that route data through the United States, because it limits exposure to third country transfer requirements. Actito does operate a separate North American region for North American clients, so European organisations should confirm that their account is provisioned on a European region and that no processing is silently routed elsewhere. Any sub processors used for delivery or supporting services should be listed in the data processing agreement and checked for their location. Where every component stays in the EU, the transfer chapter of the GDPR becomes far simpler to satisfy.

Practical compliance steps

Begin by signing a data processing agreement with Actito and confirming that your account runs on a European region. Inventory every place the Goals script is deployed and route it through your consent management platform so it stays blocked until consent is given. Update your cookie policy and privacy notice to describe the actId cookie, its purpose and its duration, and explain how email engagement is tracked. Configure preference and consent options so contacts can refuse or withdraw behavioural tracking, and verify that those choices propagate to live campaigns. Finally, document your lawful basis for each purpose, set sensible retention periods for engagement data, and review the configuration periodically as your campaigns and regulations evolve.