FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Marketing

Mindbox

MarketingOfficial website

Mindbox is a Customer Data Platform combining customer profiles, segmentation, real time triggers, email, SMS, web push, on site personalisation and product recommendations. Its JavaScript SDK sets the mindboxDeviceUUID cookie, captures behavioural events and identifies customers across sessions. As a CDP performing cross visit tracking and operating from infrastructure outside the EU, it requires prior consent under the GDPR and the ePrivacy Directive.

Block Mindbox until consentScan my site
Overview

What does Mindbox do?

What is Mindbox?

Mindbox is a Customer Data Platform that bundles unified customer profiles, real time event ingestion, behavioural triggers, email, SMS, web push, mobile push, on site personalisation and product recommendations. It is widely used in retail and ecommerce, and integrates with major commerce backends and ad platforms.

Cookies and identifiers

The Mindbox SDK sets the mindboxDeviceUUID first party cookie on the merchant domain to recognise the device across sessions. When the customer logs in or submits a form with their email, Mindbox links the device UUID to the customer profile, turning anonymous browsing into identifiable data. Hashed email matching extends the identity resolution across channels.

GDPR and ePrivacy implications

The mindboxDeviceUUID cookie is not strictly necessary; Article 5(3) ePrivacy requires prior consent. The CDP processing (cross channel profiling, behavioural triggers, scoring) is opt in under the GDPR. Marketing emails, SMS and push follow national ePrivacy implementations and need their own opt in.

Consent management

Block the Mindbox SDK through your CMP until consent is granted. Disable identity resolution and behavioural triggers for visitors without consent, capture explicit opt ins for email/SMS/push and propagate the consent state to the Mindbox profile so the platform respects withdrawal across all channels.

Data transfers and Schrems II

Mindbox infrastructure is primarily in Russia, which is not covered by an EU adequacy decision. Transfers must rely on Standard Contractual Clauses combined with supplementary measures (encryption, pseudonymisation, jurisdictional risk assessment) under the Schrems II framework, and must be analysed against current EU policy on Russia.

Implementing Mindbox compliantly

Run a full DPIA before deploying Mindbox to EU customers, sign Standard Contractual Clauses with supplementary measures, gate the SDK on consent, set retention on profiles and events and update the privacy policy with a clear description of the CDP processing and the transfer.

Compliance

Mindbox and the GDPR

Mindbox is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Prior consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy: Mindbox is a Customer Data Platform that performs cross visit tracking, identity resolution and behavioural personalisation for marketing campaigns.
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive, Standard Contractual Clauses, EDPB Schrems II supplementary measures

Impact assessment (DPIA)

A DPIA is necessary because Mindbox is a CDP that performs identity resolution, builds detailed customer profiles, runs behavioural triggers and may transfer personal data to a non adequate country. Additional safeguards under Schrems II must be assessed.

Sample text for your banner

We use Mindbox as our Customer Data Platform. With your consent, Mindbox will set the mindboxDeviceUUID cookie, record your browsing and purchase activity, link it to your customer profile and forward the data to Mindbox infrastructure outside the EEA. You can refuse or withdraw your consent at any time from the cookie settings.
Cookies and trackers

What Mindbox sets and contacts

Tracking method
JavaScript SDK (mindbox.ru / api.mindbox.ru) loaded on the merchant site that captures product views, cart events, form submissions and identifies customers via the mindboxDeviceUUID first party cookie, then forwards events to the Mindbox CDP backend for triggers, recommendations and email/SMS campaigns.
Server location
Mindbox infrastructure operated by Mindbox LLC, primarily in Russia, with regional pods possible. Some EU customers are served by EU Mindbox affiliates.
Data transferred outside the EU
Personal data (events, IP, hashed identifiers) may be transferred to Mindbox infrastructure outside the EU. Russia is not covered by an EU adequacy decision, so the transfer requires Standard Contractual Clauses with supplementary measures and a clear assessment of jurisdictional risks.

Cookies set (2)

NameTypeDurationPurpose
mindboxDeviceUUIDfirst_party2 yearsPersistent device identifier set by the Mindbox SDK to recognise the device across sessions and link it to the unified customer profile in the Mindbox CDP.
mindbox_sessionfirst_partysessionStores the current Mindbox session state used to group events sent to the CDP backend.

Third-party domains contacted (4)

  • api.mindbox.ru
  • mindbox.ru
  • cdn.mindbox.ru
  • tracker.mindbox.ru
Questions

Frequently asked questions about Mindbox

Can't find your question? Write to us, we answer fast.

Which cookies does Mindbox set?

The Mindbox SDK sets the mindboxDeviceUUID first party cookie on the merchant domain, plus session storage entries that buffer events before they are sent to the Mindbox backend.

Does Mindbox require consent?

Yes. The cookies are not strictly necessary, the CDP performs identity resolution and behavioural profiling and the platform integrates marketing channels (email, SMS, push) that need their own opt in. Prior consent is required under Article 5(3) ePrivacy.

What is the legal basis?

Consent for the cookies, the cross channel profiling and marketing communications. Contract performance can apply for transactional triggers tied to a purchase, but the CDP profiling itself remains opt in.

Are data transferred outside the EEA?

Yes. Mindbox runs primarily on infrastructure outside the EEA, with no EU adequacy decision available. Transfers must rely on Standard Contractual Clauses with Schrems II supplementary measures and a clear jurisdictional risk assessment.

Do I need a DPIA for Mindbox?

Yes. The combination of identity resolution, large scale profiling, behavioural triggers and transfers to a non adequate country triggers a DPIA under Article 35 GDPR.

How do I deploy Mindbox compliantly?

Run the DPIA, sign Standard Contractual Clauses with supplementary measures, gate the SDK on consent, restrict the data sent to what is strictly necessary, set retention on profiles and disclose the integration and the transfer in the privacy policy.

Are there alternatives to Mindbox?

EU/UK based CDPs include Bloomreach Engagement (Czech Republic), Tealium AudienceStream EU, Emarsys (Austria), Salesforce Data Cloud EU region or Adobe Real Time CDP EU.

How do I update my cookie policy?

Add a section that names Mindbox, lists the mindboxDeviceUUID cookie with purpose and duration, mentions the email/SMS/push channels and discloses the transfer to Mindbox infrastructure outside the EEA with the legal mechanism used.

Same category

More services: Marketing

See the whole category

Talkable

Talkable is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Talkable provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Talkable helps deliver the right message to the right audience at the right time.

Marketing

Adaptix

Adaptix is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Adaptix integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Adaptix makes advanced AI accessible to all teams.

Preferences

Reviefy

Reviefy is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Reviefy supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Reviefy ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

FunnelCockpit

FunnelCockpit is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. FunnelCockpit provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, FunnelCockpit helps deliver the right message to the right audience at the right time.

Marketing

EspoCRM

EspoCRM is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. EspoCRM provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, EspoCRM helps deliver the right message to the right audience at the right time.

Marketing

Kyvio

Kyvio is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Kyvio offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Kyvio empowers organizations to optimize strategy and maximize return on investment.

Marketing

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site