Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Wheelio is a gamified email and SMS capture tool for online stores that shows a spin to win wheel offering a discount in exchange for contact details. It tracks behaviour to decide when to display, sets cookies to control frequency and store coupon state, and captures email addresses and sometimes phone numbers. Operated from the European Union, it still sets non essential cookies and captures marketing contacts, so it requires prior consent under the GDPR and the ePrivacy Directive.
Wheelio is a gamified opt in tool for e commerce, operated from the European Union, that displays a spin to win wheel or similar game to encourage visitors to subscribe in exchange for a discount. It is used to grow email and SMS marketing lists. Adding Wheelio loads a script that shows the game and stores cookies in the visitor browser.
Wheelio processes the contact details visitors submit, typically email and sometimes phone number, the discount or prize assigned, behavioural signals used to time the popup, and technical data like IP address and device. It sets cookies to control how often the game appears and to remember the coupon a visitor won. The contact data feeds email and SMS marketing.
The game sets non essential cookies and captures personal data for marketing, so the ePrivacy Directive requires prior consent for the cookies and clear consent for marketing messages. SMS marketing in particular needs explicit consent. The GDPR requires a lawful basis and a data processing agreement, and incentivised sign up must still be freely given and unbundled.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Obtain prior, opt in consent before Wheelio sets cookies, and use clear, separate consent for email and SMS marketing rather than treating the prize as automatic consent. Block the script behind your consent banner so the game loads only after acceptance. Make consent specific and easy to withdraw, and provide easy unsubscribe.
Wheelio is operated from the European Union, so core processing can stay within the EU and many deployments avoid a third country transfer. Confirm whether any subprocessors, such as SMS gateways or analytics, are located outside the EU and apply Standard Contractual Clauses and a transfer impact assessment if they are. Document the data locations in your records.
To use Wheelio compliantly, gate it behind consent, use clear marketing opt in for email and SMS, and sign a data processing agreement. Confirm subprocessor locations, minimise the contact data you collect, set retention limits, and provide easy unsubscribe. List Wheelio in your cookie policy and privacy notice and review it periodically.
Websites using Wheelio must obtain user consent under GDPR regulations.
DPIA considerations
Wheelio captures marketing contacts through a gamified incentive and tracks behaviour to time the popup, which raises its risk profile. Key DPIA points: (1) collection of email and sometimes phone numbers for email and SMS marketing, which needs valid, unbundled consent; (2) the incentive design, which must not make consent conditional in a way that undermines free choice; (3) non essential cookies requiring consent; (4) data processed in the EU, with any non EU subprocessors needing transfer safeguards; (5) the need for a data processing agreement, retention limits, and easy unsubscribe. A DPIA is advisable for large scale or SMS based campaigns.
Sample consent text
We use Wheelio to offer a fun way to claim a discount in exchange for subscribing. With your consent, Wheelio sets cookies and shows the game, and it stores the email or phone number you provide along with your IP address to send you the offers you opted into. Wheelio is operated from the European Union. You can withdraw your consent and unsubscribe at any time.
Third-party domains contacted
wheelio-app.comcdn.wheelio-app.comapi.wheelio-app.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| wheelio_shown | Functional | 30 days | Controls how often the spin to win game is shown to a visitor. |
| wheelio_coupon | Functional | 30 days | Remembers the discount code a visitor won so it can be reapplied at checkout. |
| wheelio_visitor | Analytics | 1 year | Visitor identifier used to attribute subscriptions and measure campaign performance. |
Wheelio places tracking cookies for advertising — comply with GDPR using FlowConsent.
Wheelio sets cookies that control how often the game is shown and remember the coupon a visitor won, plus identifiers used to attribute subscriptions. These are non essential and require consent. The email and phone number submitted are stored separately as contact data.
Yes. Wheelio sets non essential cookies and captures contacts for marketing, so obtain prior, opt in consent for the cookies and separate, clear consent for email and SMS marketing. The discount must not be used to bypass valid consent.
The cookies rely on consent (Art. 6(1)(a)) and the ePrivacy Directive. Email and SMS marketing to captured contacts relies on consent under the ePrivacy marketing rules, and SMS in particular requires explicit opt in.
Not necessarily. Wheelio is operated from the EU, so core processing can stay in the EU. Check whether SMS gateways, analytics, or other subprocessors are outside the EU and apply Standard Contractual Clauses and a transfer impact assessment if they are.
A DPIA is advisable for large scale list building or SMS campaigns. Assess the contact data collected, the incentivised consent design, the behavioural triggers, subprocessor locations, and your retention and unsubscribe processes.
Block Wheelio behind your consent banner, use clear opt in for email and SMS, sign a data processing agreement, and confirm subprocessor locations. Minimise contact data, set retention limits, provide easy unsubscribe, and document Wheelio in your cookie policy and privacy notice.
Yes. Simpler EU based or self hosted opt in forms can grow a list without gamified incentives or extra subprocessors. They reduce complexity and keep more control over data, though they may convert less aggressively.
Add a Wheelio entry listing its cookies, their purposes and durations, and the fact that contact data is processed in the EU, noting any non EU subprocessors. Link to Wheelio''s privacy notice and review the entry when its cookies or subprocessors change.