Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
GetSiteControl is an on site engagement platform that adds popups, signup forms and surveys to websites, with built in email marketing for follow up. It loads a first party JavaScript widget that sets cookies and browser storage to control how often widgets appear and to capture data submitted through forms and surveys. Because it collects contact data and can target visitors by behaviour, its non essential cookies generally require prior consent under European law.
GetSiteControl is an on site engagement and email marketing platform that lets websites add popups, signup and contact forms, announcement bars and surveys without coding. It pairs these widgets with a dashboard for managing contacts, sending email broadcasts and running automations. Website owners add a first party JavaScript widget to their pages, after which GetSiteControl can display campaigns, trigger them based on visitor behaviour and collect the data people enter. It is delivered as a cloud service, so visitor and contact data is processed on its hosting infrastructure. Because it observes visitor activity and captures contact and survey responses, it processes personal data on behalf of the website that deploys it.
GetSiteControl sets first party cookies and uses browser storage to remember whether a visitor has already seen, closed or submitted a widget so the same popup, form or survey is not shown repeatedly. These identifiers also support display rules and targeting and can last from a single session up to around a year depending on configuration. When a visitor completes a form or survey, the data entered, such as name, email address and answers, is captured and stored against the campaign. GetSiteControl may also process technical signals like IP address, device and browser details and on site behaviour used to decide when widgets appear. Together these data points let it recognise returning visitors and tailor the timing and content of campaigns.
Under the ePrivacy Directive, storing or reading information on a visitor device requires consent unless it is strictly necessary for a service the visitor explicitly requested. The cookies and storage GetSiteControl uses for frequency capping, targeting and campaign logic go beyond the strictly necessary, so they fall within the consent requirement. Under the GDPR, capturing contact details and survey responses and tracking behaviour is processing of personal data that needs a valid lawful basis and clear information to visitors. The website operator is the controller and must inform visitors and collect consent before non essential widgets load. GetSiteControl acts as a processor and provides a data processing agreement and a list of sub processors to support compliance.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Marketing popups, surveys, behavioural targeting and form based sign ups rely on consent under Article 6(1)(a) of the GDPR. In practice this means integrating GetSiteControl with a consent management platform so its non essential widgets and cookies are blocked until the visitor accepts the marketing category. Consent should be freely given, specific, informed and as easy to withdraw as to give, and each form or survey should make clear what data is collected and why. GetSiteControl can itself be used to build cookie consent notices, but using it for that purpose does not remove the need to gate its own non essential cookies. Basic display frequency capping might be argued under legitimate interest in narrow cases with a documented balancing test.
GetSiteControl is a cloud service that relies on sub processors which may be located outside the European Economic Area, including the United States. Where personal data flows to United States based providers, those transfers should rely on the EU US Data Privacy Framework or Standard Contractual Clauses combined with supplementary measures. The data processing agreement should identify the sub processors and the safeguards in place. Operators should review the published sub processor list to understand where data is hosted and confirm the transfer mechanism. Documenting the transfer position in the record of processing activities supports accountability.
Sign the GetSiteControl data processing agreement and add it to your record of processing and sub processor list. Configure a consent management platform so GetSiteControl non essential widgets and cookies only load after the visitor accepts marketing. Disclose the cookies, their purposes and durations in your cookie policy, and make each form and survey clear about what data is collected and why. Provide easy ways for people to withdraw consent, unsubscribe from emails and exercise access and deletion rights, and confirm GetSiteControl can action erasure requests. Review settings periodically so retention, active widgets and integrations stay consistent with what visitors were told.
Websites using GetSiteControl must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment is advisable when GetSiteControl is used for behavioural targeting or large scale survey and form collection, because these involve monitoring visitor activity and processing contact and opinion data. Document the data captured through forms and surveys, the cookies and storage used, retention periods, the consent mechanism and the role of sub processors. Record the international transfer position, including any United States hosting, and the lawful basis for each purpose.
Sample consent text
We use GetSiteControl to show you relevant messages and surveys and to collect your details if you choose to take part. This sets cookies and stores data in your browser to manage how often widgets appear and to remember your choices. Do you consent to these marketing cookies?
Third-party domains contacted
getsitecontrol.coml.getsitecontrol.comcdn.getsitecontrol.comwidgets.getsitecontrol.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| gsc_widget | first party | up to 1 year | Records which widgets a visitor has already seen, closed or submitted so the same popup, form or survey is not shown repeatedly and display rules are respected. |
| gsc_visitor | first party | up to 1 year | Stores a visitor identifier used to recognise returning visitors and apply targeting and frequency rules across visits. |
| gsc_session | first party | session | Maintains the current browsing session so widget state and interactions are tracked consistently during a visit. |
GetSiteControl places tracking cookies for advertising — comply with GDPR using FlowConsent.
GetSiteControl sets first party cookies and uses browser storage to remember whether a visitor has already seen, closed or submitted a widget so the same popup, form or survey is not shown repeatedly, and to support display rules. These identifiers can last from a session up to around a year depending on configuration. Form and survey submissions also capture the data a visitor chooses to provide.
Yes, for most uses. Because GetSiteControl sets non essential cookies and tracks visitor activity to time and target widgets, prior consent is required under the ePrivacy Directive and the GDPR before those scripts run. Strictly necessary functions are limited, so the safe approach is to gate it behind a marketing consent category.
The main legal basis is consent under Article 6(1)(a) of the GDPR for marketing popups, surveys, behavioural targeting and form based sign ups. Legitimate interest under Article 6(1)(f) may be considered for basic display frequency capping with a documented balancing test. The website operator is the controller and decides the basis for each purpose.
GetSiteControl is a cloud service that relies on sub processors which may be located outside the EEA, including the United States. Transfers to United States providers should rely on the EU US Data Privacy Framework or Standard Contractual Clauses with supplementary measures set out in the data processing agreement. Review the published sub processor list to confirm where data is hosted and the safeguards in place.
A data protection impact assessment is advisable when GetSiteControl is used for behavioural targeting or large scale survey and form collection, since these involve monitoring activity and processing contact and opinion data. The assessment should cover the data captured, cookies used, retention, the consent mechanism and international transfers. For light use a full DPIA may not be required but the reasoning should be recorded.
Sign the GetSiteControl data processing agreement, add it to your record of processing and integrate it with a consent management platform so non essential widgets only load after consent. Disclose the cookies and their purposes in your cookie policy and make each form and survey clear about what data is collected. Offer easy ways to withdraw consent, unsubscribe and request deletion, and confirm GetSiteControl can action erasure requests.
Comparable popup, form and survey tools include Adoric, Poptin, Justuno, OptinMonster and Hotjar for surveys. Each sets cookies and can profile or target visitors, so the same consent and transparency obligations apply. The right choice depends on the features you need, the hosting region and the strength of the provider data processing terms.
List the GetSiteControl cookies and storage items with their purposes and durations and group them under marketing rather than strictly necessary. Name GetSiteControl as the provider, note the international transfer position including any United States hosting, and link to its privacy information. Keep the policy aligned with your consent banner categories and review it whenever you change GetSiteControl widgets or integrations.