> How the FirstHive customer data platform handles cookies, consent and profiling under GDPR, plus transfers to India via Standard Contractual Clauses and a DPIA. > > Canonical: https://www.flowconsent.com/en/services/marketing/firsthive Marketing # FirstHive Analytics · [Official website](https://firsthive.com) FirstHive is a customer data platform that unifies first party customer data across web, email, mobile and offline sources, resolves identities and powers marketing automation. It ingests directly identifying data such as emails and phone numbers and builds persistent profiles, which makes it large scale profiling under the GDPR. It uses first party and third party cookies and requires prior consent and a solid legal basis. Because it is hosted in India, with no EU adequacy decision, transfers depend on Standard Contractual Clauses and a transfer impact assessment, and a DPIA is normally required. [Block FirstHive until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Analytics - Prior consent Required - Documented cookies 3 - Third-party domains 4 - Servers Cloud infrastructure on AWS, typically in India or the customer chosen region Overview ## What does FirstHive do? ## **What FirstHive is** FirstHive is a customer data platform headquartered in India that unifies first party customer data from web, email, mobile and offline channels into a single view. It performs identity resolution to stitch together the different touchpoints of the same person and then powers segmentation, marketing automation and personalised campaigns. Because it deliberately joins data across channels and builds persistent profiles, it sits at the heart of an organisation marketing operation. For European deployments this means the platform processes the personal data of large numbers of customers and prospects on an ongoing basis. ## **What data and cookies it collects** FirstHive ingests directly identifying data such as email addresses and phone numbers, alongside behavioural events from the website, email engagement and mobile activity. On the web it relies on first party and third party cookies, including a persistent visitor identifier such as fhive\_uid, a session cookie such as fhive\_session and tracking helpers such as fh\_track. These identifiers are linked to known customer records, so the resulting profiles are rich and directly attributable to individuals. None of this is necessary to deliver the website itself, which places the tracking firmly in the non essential category that demands consent. ## **GDPR and ePrivacy implications** Under the GDPR, building unified profiles through identity resolution is profiling, and doing it at scale on directly identifying data is treated as a high risk activity. Article 5(3) of the ePrivacy Directive separately requires prior consent for the cookies and identifiers placed on the user device. FirstHive normally acts as a processor on behalf of the controller, so a data processing agreement under article 28 is essential, together with clear documentation of purposes, retention and the international element. The combination of cross channel tracking and identifiable profiles raises the regulatory stakes considerably. ## **Consent requirements** Consent is the appropriate basis for the cookies and for the profiling that FirstHive performs, because legitimate interest is very hard to sustain for cross channel profiling of identifiable people. That consent must be obtained before any identifier is set, must be specific to the profiling and marketing purposes, and must be as easy to withdraw as to give. In practice you should block the FirstHive tag behind a consent management platform, pass the consent signal through to the platform, and stop building or enriching profiles for users who decline or later withdraw. ## **International data transfers** FirstHive is based in India and typically hosts data on AWS in India or in a region chosen by the customer. India does not benefit from a European Commission adequacy decision, so transfers cannot rely on adequacy and instead require the EU Standard Contractual Clauses backed by a transfer impact assessment that considers local access to data. The India DPDP Act 2023 also governs the processing in India and should be reflected in your documentation. Where possible, choosing an EU hosting region and applying strong supplementary measures will reduce the transfer risk. ## **Practical compliance steps** Sign a robust data processing agreement, complete a data protection impact assessment and put the Standard Contractual Clauses and a transfer impact assessment in place before launch. Route the FirstHive tag through your consent management platform so no identifier is set without consent, and synchronise consent withdrawals so profiles stop being enriched. Apply data minimisation, set clear retention limits on profiles and identifiers, and update your privacy notice and cookie policy to name FirstHive, describe the profiling and explain the transfer to India. Review the arrangement regularly and keep the supporting records to demonstrate accountability. Compliance ## FirstHive and the GDPR FirstHive is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent under GDPR article 6(1)(a) for profiling and marketing identifiers, plus prior consent under article 5(3) ePrivacy for the cookies; legitimate interest is difficult to sustain for cross channel profiling - Risk level high - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, EU Standard Contractual Clauses, India DPDP Act 2023, TTDSG (Germany), LOPDGDD (Spain), LIL (France) ### Impact assessment (DPIA) A data protection impact assessment is normally required for FirstHive because it carries out large scale profiling and cross channel identity resolution on directly identifying data. Map every source feeding the platform, the identifiers used, the profiles built and the retention applied. Assess the transfer to India under the Standard Contractual Clauses, the supplementary measures and the India DPDP Act 2023. Evaluate the risks of profiling to individuals and document mitigations such as consent gating, data minimisation and limited retention before going live. ### Sample text for your banner > We use FirstHive to recognise you across our website, email and apps and to build a unified profile so we can personalise our marketing. This relies on cookies and identifiers and only happens after you accept, and it may transfer your data to FirstHive on infrastructure in India under EU approved safeguards. You can refuse or withdraw your consent at any time without losing access to the site. Cookies and trackers ## What FirstHive sets and contacts - Tracking method first party and third party cookies with cross channel identity resolution - Server location Cloud infrastructure on AWS, typically in India or the customer chosen region - Data transferred outside the EU Data is hosted on AWS cloud infrastructure, typically in India or the region chosen by the customer. India has no European Commission adequacy decision, so transfers rely on the EU Standard Contractual Clauses together with a transfer impact assessment. The India DPDP Act 2023 also applies to the processing. ### Cookies set (3) | Name | Type | Duration | Purpose | | -------------- | ---------- | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | | fhive\_uid | analytics | persistent (up to 1 year) | Persistent visitor identifier used for cross channel identity resolution and to link behaviour to a unified customer profile. | | fhive\_session | functional | session | Maintains the visitor session so events can be grouped within a single visit. | | fh\_track | analytics | persistent (up to 1 year) | Tracks on site behaviour and engagement events that feed segmentation and marketing automation. | ### Third-party domains contacted (4) - `firsthive.com` - `app.firsthive.com` - `cdn.firsthive.com` - `track.firsthive.com` Questions ## Frequently asked questions about FirstHive Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does FirstHive set? FirstHive uses first party and third party cookies, including a persistent visitor identifier such as fhive\_uid, a session cookie such as fhive\_session and tracking helpers such as fh\_track. These are linked to known customer records and feed identity resolution and profiling, so they are not strictly necessary and require consent. ### Is consent required to use FirstHive? Yes. The cookies and the profiling are not strictly necessary, so you must obtain prior, specific and freely given consent before any identifier is set. The tag should stay blocked until the visitor opts in, and profiles should not be built for those who decline. ### What is the legal basis for FirstHive? The appropriate basis is consent under GDPR article 6(1)(a) for the profiling and marketing identifiers, combined with the prior consent required by article 5(3) ePrivacy for the cookies. Legitimate interest is very difficult to sustain for cross channel profiling of identifiable people. ### Does FirstHive transfer data to third countries? Yes. FirstHive is based in India and typically hosts data on AWS in India or a customer chosen region. India has no EU adequacy decision, so transfers rely on the EU Standard Contractual Clauses plus a transfer impact assessment, and the India DPDP Act 2023 also applies. ### Do I need a DPIA for FirstHive? Yes, a DPIA is normally required. FirstHive carries out large scale profiling and identity resolution on directly identifying data, which is high risk under GDPR article 35. Document the sources, identifiers, profiles, retention and the transfer to India, and record your mitigations before going live. ### How do I implement FirstHive compliantly? Sign a data processing agreement, complete a DPIA and put Standard Contractual Clauses and a transfer impact assessment in place first. Gate the tag behind a consent management platform, pass the consent signal to FirstHive, apply data minimisation and clear retention, and synchronise consent withdrawals so profiles stop being enriched. ### What are the alternatives to FirstHive? Other customer data platforms offer EU hosting or stronger transfer guarantees, which can simplify the compliance picture. If full cross channel identity resolution is not essential, lighter first party analytics with a cookieless option may reduce risk. Whichever tool you choose, consent gating and a DPIA remain necessary for profiling. ### How do I update my cookie policy for FirstHive? List each FirstHive cookie with its purpose and duration, explain that the platform builds unified profiles through identity resolution, and disclose the transfer to India under the Standard Contractual Clauses. Link to your consent settings and review the entry whenever the configuration or hosting region changes. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Loops](https://www.flowconsent.com/en/services/marketing/loops) [Loops is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Loops enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Loops empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/loops) [Marketing](https://www.flowconsent.com/en/services/marketing/loops) · ### [Landingi](https://www.flowconsent.com/en/services/marketing/landingi) [Landingi is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Landingi supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Landingi enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/marketing/landingi) [Analytics](https://www.flowconsent.com/en/services/marketing/landingi) · ### [Avis Verifies](https://www.flowconsent.com/en/services/marketing/avis-verifies) [Avis Verifies is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Avis Verifies integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Avis Verifies helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/avis-verifies) [Preferences](https://www.flowconsent.com/en/services/marketing/avis-verifies) · ### [Linguise](https://www.flowconsent.com/en/services/marketing/linguise) [Linguise is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Linguise offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Linguise empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/marketing/linguise) [Marketing](https://www.flowconsent.com/en/services/marketing/linguise) · ### [Bestie](https://www.flowconsent.com/en/services/marketing/bestie) [Bestie is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Bestie integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Bestie makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/marketing/bestie) [Analytics](https://www.flowconsent.com/en/services/marketing/bestie) · ### [Headway](https://www.flowconsent.com/en/services/marketing/headway) [Headway is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Headway integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Headway helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/headway) [Marketing](https://www.flowconsent.com/en/services/marketing/headway) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)