Exponea

What is Exponea

Exponea was a Slovak customer data platform launched in 2015. It was acquired by Bloomreach in 2021 and rebranded as Bloomreach Engagement. The platform combines a customer data platform, web and mobile analytics, marketing automation, email and SMS sending, in app messaging, web personalisation and predictive scoring in a single product. It serves mainly retail, fashion, financial services and travel customers in Europe and North America.

What data and cookies Exponea collects

The Exponea JavaScript SDK sets a long lived first party cookie (__exponea_etc__) that stores the anonymous visitor identifier and a per session cookie (__exponea_time2__) for timing measurements. Every page view, click, scroll, form interaction, product view, cart event and purchase is sent to the Exponea API. The SDK can also collect device data (browser, OS, screen, language, rough geolocation from IP) and merge anonymous activity with the customer profile once the visitor logs in or provides an email. Server side events imported from a CRM or an e commerce backend are linked to the same profile.

GDPR and ePrivacy implications

Exponea sets non essential cookies and performs cross device profiling, so Article 5(3) of the ePrivacy Directive requires a prior informed opt in before the SDK loads. The downstream processing of behavioural data and the profiling under Articles 6(1)(a) and 22 GDPR require consent for marketing personalisation and impose transparency, opt out and human intervention rights. Regulators such as the French CNIL, the Dutch Autoriteit Persoonsgegevens and the Italian Garante have sanctioned CDP deployments that loaded scripts before consent or relied on legitimate interest for marketing.

Consent requirements and user controls

The Exponea SDK must be gated behind a cookie banner under an analytics and a marketing category. Bloomreach provides a consent management framework that lets you map purposes (functional, analytics, personalisation, marketing automation) and feed the SDK with the chosen state, so events can either be stored anonymously or attached to the full profile. Visitors must be able to refuse as easily as accept, withdraw consent, and ask for access, rectification, deletion and portability through the Bloomreach customer data centre.

Data transfers and hosting

Bloomreach Engagement runs on AWS with primary regions in Frankfurt, Dublin and Virginia. Customers choose where their production data is stored, but support, R&D and certain administrative systems are operated from Slovakia, the Netherlands and the United States. Transfers to the US rely on the EU US Data Privacy Framework and on standard contractual clauses; supplementary measures include encryption in transit, pseudonymisation of cookie identifiers and limited retention of raw events.

Practical compliance steps

Sign the Bloomreach data processing addendum and the SCCs, choose the EU region where possible, list Exponea in your records of processing as a processor with sub processors disclosed, deploy a CMP that signals consent purposes to the SDK, configure the consent free anonymous mode for visitors who refuse, document the retention policies for events and profiles, run a DPIA before adding predictive models or audience synchronisation with advertising platforms, and review the deployment every twelve months.