> How amoCRM (Kommo) handles personal data on websites: chat widget cookies, lead form data, international transfers and GDPR consent requirements. > > Canonical: https://www.flowconsent.com/en/services/marketing/amocrm Marketing # amoCRM Marketing · [Official website](https://www.amocrm.com) amoCRM (rebranded Kommo in international markets) is a messenger-first CRM developed by QSOFT. It combines pipeline management, multi-channel messaging (WhatsApp, Telegram, Instagram, Facebook), and an embeddable chat widget for websites. amoCRM is particularly popular among small and medium-sized businesses in Russia, the CIS region, and Latin America, with a growing European footprint through the Kommo brand. [Block amoCRM until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 5 - Third-party domains 6 - Servers Various: amoCRM (now Kommo) operates servers in the United States (Kommo Inc., San Francisco), and historically in Russia under amoCRM LLC. EU customer data may be processed depending on the chosen tenant region. Overview ## What does amoCRM do? ## **What amoCRM (Kommo) is** amoCRM is a messenger-first CRM created by QSOFT in 2009 and rebranded as Kommo for international markets in 2022. It bundles a sales pipeline, lead capture, automated workflows, and a centralised inbox for messengers (WhatsApp, Telegram, Instagram, Facebook Messenger, Viber, LINE). On websites, amoCRM appears as an embeddable chat widget and as web form integrations. It is widely used by SMBs in CIS and LATAM, and has a growing European footprint. ## **What data amoCRM collects** From the visitor: IP address, user agent, browsing path on the host site, full chat transcripts, attachments, contact details (name, email, phone, social handles), referrer information, and (with messenger integrations) the messenger ID. From the agent side: identity, performance metrics, deal status. The chat widget also sets persistent cookies for visitor identification and session continuity. ## **GDPR and ePrivacy implications** The chat widget cookies and the page-tracking script qualify as non-essential under TTDSG and ePrivacy and require prior consent. The lead and customer data submitted through the widget is processed under contract performance (for active customer relationships) or legitimate interest with a documented LIA (for cold leads), but the integration of historical Russian or current US data flows must be documented carefully. Messenger integrations import personal data from Meta and other channels, adding their own consent layers. ## **International data transfers** Kommo (the international entity) processes data in the United States. Legacy amoCRM tenants may still rely on Russian infrastructure. The EU has no adequacy decision for Russia, so any processing on Russian infrastructure must rely on SCCs plus additional safeguards and is subject to heightened scrutiny. US processing relies on SCCs and the EU-US Data Privacy Framework where Kommo Inc. is certified. A Transfer Impact Assessment is essential for any EU deployment. ## **Practical compliance steps** Confirm the tenant region (request US/Kommo for EU customers if legacy Russian residency exists), sign the Kommo DPA and SCCs, run a Transfer Impact Assessment, gate the chat widget behind a CMP, document a clear LIA for cold lead processing, configure short retention for chat transcripts, train sales agents on data minimisation, and audit messenger integrations for the data they bring back from third-party platforms. Compliance ## amoCRM and the GDPR amoCRM is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for chat widget tracking and marketing; contract performance (Art. 6(1)(b)) for CRM workflows; legitimate interest (Art. 6(1)(f)) for lead qualification - Risk level high - Applicable regulations GDPR, ePrivacy Directive, CCPA, Russian Federal Law 152, FZ on Personal Data (historical) ### Impact assessment (DPIA) amoCRM processes lead and customer data submitted through web forms, chat widgets, and messenger integrations. Key DPIA considerations: (1) the chat widget collects visitor metadata (IP, user agent, browsing path, conversation transcripts) and sets persistent cookies; (2) lead data can include sensitive information depending on the business (health appointments, financial services, legal context); (3) the historical Russian processing and current US processing both fall outside the EEA, requiring SCCs and a Transfer Impact Assessment; (4) integration with WhatsApp, Instagram, and other messengers replicates personal data into Meta-controlled ecosystems; (5) automated lead scoring and pipeline routing can amount to profiling under GDPR. A DPIA is recommended for any non-trivial deployment. ### Sample text for your banner > Our website uses the amoCRM (Kommo) chat widget to handle customer messages and leads. When you start a conversation or submit a form, amoCRM stores your messages, contact details, and interaction data on its servers. Depending on your tenant region, data may be processed in the United States. Transfers outside the EEA rely on Standard Contractual Clauses. You can decline non-essential cookies via our cookie banner. Cookies and trackers ## What amoCRM sets and contacts - Tracking method Web chat widget (JavaScript), web form embed, and backend integrations (API, webhooks) for CRM and lead capture - Server location Various: amoCRM (now Kommo) operates servers in the United States (Kommo Inc., San Francisco), and historically in Russia under amoCRM LLC. EU customer data may be processed depending on the chosen tenant region. - Data transferred outside the EU amoCRM (Kommo) processes data in the United States. Historical Russian infrastructure exists for legacy tenants. International transfers from the EU require Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR and, for Russian processing, an adequate safeguards assessment given the lack of an EU adequacy decision for the Russian Federation. ### Cookies set (5) | Name | Type | Duration | Purpose | | ------------------------ | --------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------- | | amocrm\_visitor\_id | Functional / Identification | 1 year | Persistent visitor identifier used by the amoCRM chat widget to associate the visitor with a lead record and reload the conversation history. | | amocrm\_session | Functional / Session | Session | Stores the current chat session identifier so the visitor can navigate or refresh without losing the conversation. | | amocrm\_lead\_id | Functional / CRM linkage | 1 year | Links the visitor to a specific lead in the amoCRM pipeline once contact details have been captured. | | amocrm\_chat\_widget\_\* | Functional / Preference | Up to 1 year | Stores widget display preferences (collapsed/expanded, language, last agent) so the widget restores its state across visits. | | amocrm\_analytics\_\* | Analytics | 13 months | Tracks widget interactions for performance reporting in the amoCRM dashboard. Only active when analytics features are enabled. | ### Third-party domains contacted (6) - `amocrm.com` - `amocrm.ru` - `kommo.com` - `www.kommo.com` - `cdn.amocrm.com` - `chat.amocrm.com` Questions ## Frequently asked questions about amoCRM Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does the amoCRM chat widget set? The chat widget sets visitor identification cookies (amocrm\_session, amocrm\_visitor\_id), conversation state cookies, and (when enabled) analytics cookies tying the visitor to a lead in the CRM. Some cookies persist for up to one year. ### Does amoCRM require user consent? Yes for the chat widget cookies and visitor tracking, which are non-essential under ePrivacy and TTDSG. Yes for marketing communications sent through amoCRM. The CRM workflows themselves can rely on contract performance once a customer relationship is established. ### What is the legal basis for using amoCRM? Consent (Art. 6(1)(a)) for the chat widget cookies and marketing emails. Contract performance (Art. 6(1)(b)) for active customer workflows. Legitimate interest (Art. 6(1)(f)) for cold lead qualification, with documented LIA. ### Does amoCRM transfer data to the United States or Russia? Yes. Kommo Inc. (the international entity) processes data in the United States. Legacy amoCRM tenants may still rely on Russian infrastructure. Both require SCCs; Russian processing has no EU adequacy decision and demands additional safeguards. ### Do I need a DPIA for amoCRM? A DPIA is recommended for any deployment with messenger integrations (WhatsApp, Instagram), cold outreach scoring, or sensitive-vertical leads. Document the integration map, the data categories, the retention, and the transfer mechanisms. ### How do I implement amoCRM compliantly? Confirm the tenant region (prefer Kommo US over legacy Russia for EU customers), sign the Kommo DPA and SCCs, run a TIA, gate the widget behind a CMP, document an LIA for cold leads, configure short retention for transcripts, train your sales team, and audit messenger integrations. ### What are the alternatives to amoCRM? Alternatives include HubSpot CRM (US, EU residency option), Pipedrive (Estonia), Salesforce Essentials (US, EU residency), Zoho CRM (US/India/EU options), Brevo CRM (France), Sellsy (France), and EU open-source options like Vtiger and SuiteCRM. ### How do I update the cookie policy for amoCRM? List the amoCRM chat cookies with name, purpose, duration, and category. Specify the controller (Kommo Inc., US) and (where applicable) the legacy Russian processing. Reference SCCs and DPF for transfers. Provide a CMP toggle to refuse the widget. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Outplay](https://www.flowconsent.com/en/services/marketing/outplay) [Outplay is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Outplay integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Outplay makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/marketing/outplay) [Marketing](https://www.flowconsent.com/en/services/marketing/outplay) · ### [Popupular](https://www.flowconsent.com/en/services/marketing/popupular) [Popupular is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Popupular integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Popupular helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/popupular) [Marketing](https://www.flowconsent.com/en/services/marketing/popupular) · ### [Homebot](https://www.flowconsent.com/en/services/marketing/homebot) [Homebot is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Homebot integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Homebot makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/marketing/homebot) [Marketing](https://www.flowconsent.com/en/services/marketing/homebot) · ### [Nido Tecnologia](https://www.flowconsent.com/en/services/marketing/nido-tecnologia) [Nido Tecnologia is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Nido Tecnologia is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Nido Tecnologia offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/marketing/nido-tecnologia) [Preferences](https://www.flowconsent.com/en/services/marketing/nido-tecnologia) · ### [Bazaarvoice Reviews](https://www.flowconsent.com/en/services/marketing/bazaarvoice-reviews) [Bazaarvoice Reviews is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Bazaarvoice Reviews integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Bazaarvoice Reviews helps organizations maintain robust websites that meet user expectations.](https://www.flowconsent.com/en/services/marketing/bazaarvoice-reviews) [Marketing](https://www.flowconsent.com/en/services/marketing/bazaarvoice-reviews) · ### [Marketo Forms](https://www.flowconsent.com/en/services/marketing/marketo-forms) [Marketo Forms is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Marketo Forms supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Marketo Forms ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/marketo-forms) [Marketing](https://www.flowconsent.com/en/services/marketing/marketo-forms) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)