Engaga

What Engaga is

Engaga, also branded Engaga Spark, is a SaaS marketing platform that lets website owners build and display popups, signup forms, exit intent overlays, promotional banners, and announcement bars without developer effort. The publisher embeds a small JavaScript snippet, configures campaigns from the Engaga dashboard, and Engaga decides when and to whom each popup should appear. Engaga is positioned as a generalist conversion optimisation widget similar to OptinMonster, Sumo, or Hello Bar.

Cookies and data collected

The Engaga snippet typically sets cookies to throttle frequency (so the same popup is not shown repeatedly), to remember dismissals, and to track conversion attribution. It also captures the URL, referrer, screen size, language, an anonymous visitor identifier, and the content of any form submitted by the user (often an email address, name, or phone number). When the publisher integrates Engaga with an email service such as Mailchimp or Klaviyo, those identifiers are forwarded to the downstream platform.

GDPR and ePrivacy implications

Because Engaga writes cookies that are not strictly necessary for a service the user has explicitly requested, ePrivacy Art. 5(3) requires prior consent before the snippet runs. The processing of email addresses and form data is personal data under GDPR and needs a lawful basis. Marketing popups generally rely on Art. 6(1)(a) consent, complemented by the soft opt in rules of national law for follow up emails. The publisher remains the controller, while Engaga acts as processor and must offer an Art. 28 contract.

Consent and transparency in the EU

The cookie banner must offer accept and refuse with equal prominence, name Engaga as a recipient, and disclose the US hosting before the script loads. CNIL, BfDI, AEPD, and the Italian Garante stress that refusing must not block access, and that a popup must not act as a dark pattern that forces users to consent. The form itself should include a separate, unticked opt in for marketing communications and a privacy notice link, in line with EDPB Guidelines 05/2020 on consent.

Data transfers and US hosting

Engaga operates on US infrastructure, so any deployment in the EU triggers GDPR Chapter V on international transfers. The controller should confirm whether Engaga self certifies under the EU US Data Privacy Framework, otherwise rely on Standard Contractual Clauses combined with a Transfer Impact Assessment. Supplementary measures such as IP minimisation, encryption in transit and at rest, and limiting the form fields exposed to the snippet help reduce residual risk.

Practical compliance steps

Sign a GDPR Art. 28 DPA with Engaga, gate the snippet behind your consent management platform, and only load it after the user accepts marketing or functional cookies according to your taxonomy. Use a separate marketing opt in inside the popup, store proof of consent, and align retention with your CRM or email service. Update the privacy policy and the cookie table with Engaga, the cookies it sets, the data categories collected, the US transfer, and a link to its privacy notice.