> How Grasp Technologies handles cookies, traveller data and US transfers under GDPR and ePrivacy. Compliance guide for EU companies using Grasp. > > Canonical: https://www.flowconsent.com/en/services/other/grasp Other # Grasp Analytics · [Official website](https://www.getgrasp.com) Grasp Technologies is a travel and expense data management platform used by corporations, travel management companies and travel agencies to unify fragmented booking, card and ERP data into a single source of truth. The Grasp marketing website also uses analytics cookies to measure visitor behaviour. For EU customers, Grasp processes traveller and expense data on US infrastructure, which raises GDPR consent and international data transfer questions for any organisation deploying it. [Block Grasp until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Analytics - Prior consent Required - Documented cookies 3 - Third-party domains 3 - Servers Grasp Technologies is a United States company with primary processing infrastructure in the United States. Some EU customer deployments may use regional cloud regions, but the default data location is the US. Overview ## What does Grasp do? ## **What Grasp is and how it works** Grasp Technologies is a United States based travel and expense data management platform. It consolidates booking, expense and payment data from travel management companies, corporate card programmes, online booking tools and ERPs, then exposes the unified data set through dashboards, scheduled reports and APIs. The Grasp marketing website also uses standard web analytics cookies to measure visitor activity. EU corporations and TMCs deploy Grasp to gain a single view of travel spend across vendors. ## **What data Grasp collects** On the public Grasp website, analytics cookies log IP address, user agent, operating system, browser, screen resolution and plugins. Inside the Grasp platform, the data set covers traveller name records, itineraries, ticket numbers, corporate card transactions, supplier identifiers, project codes and cost centres. Traveller data can be sensitive because it reveals presence, movement patterns and sometimes health context (visa requirements, medical evacuation). ## **GDPR and ePrivacy implications** Two layers of compliance apply. First, the analytics cookies dropped on the Grasp marketing site require prior consent under article 5(3) ePrivacy. Second, traveller data uploaded to Grasp is processed by Grasp acting as a processor for EU corporate controllers under article 28 GDPR. A signed Data Processing Agreement, documented sub processors and a clear retention schedule are all mandatory. ## **Consent requirements** Consent is required only for the analytics cookies on the public Grasp site. Inside a corporate deployment, employee travel data is processed on the basis of the employment contract, legitimate interest, or compliance with a legal obligation, not consent. Employees should still receive transparent information under articles 13 and 14 GDPR about the use of Grasp, the categories of data processed, retention and recipients. ## **International data transfers** Default Grasp infrastructure is hosted in the United States. EU customers must rely on Standard Contractual Clauses, the EU US Data Privacy Framework where Grasp is certified, and supplementary measures such as encryption in transit and at rest, granular access controls and pseudonymisation where feasible. A transfer impact assessment is expected before relying on these transfers, especially after the Schrems II decision. ## **Practical compliance steps** Sign a GDPR compliant DPA with Grasp including SCCs and a sub processor list. Run a transfer impact assessment for the US transfer. Conduct a DPIA covering travel monitoring. Update the internal privacy notice for employees. Configure a Consent Management Platform to block Grasp marketing analytics until consent is given. Limit access to the Grasp portal, enable MFA and define a clear retention period for traveller data. Compliance ## Grasp and the GDPR Grasp is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis For analytics cookies on the Grasp website, the legal basis is the visitor's prior consent under article 5(3) ePrivacy. For traveller and expense data processed on behalf of EU corporate clients, Grasp acts as a processor and the controller relies on its own legal basis, typically performance of the employment contract or legitimate interest in managing corporate travel. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, national cookie laws (CNIL in France, BfDI guidance in Germany, AEPD in Spain), EU US Data Privacy Framework. Sensitivity is moderate because traveller data can reveal whereabouts and health context. ### Impact assessment (DPIA) A DPIA is generally required where Grasp processes traveller data of EU employees on US infrastructure, given the systematic monitoring of travel patterns, the volume of data and the transfer to a third country. Assess proportionality, data minimisation, retention, access controls and the effectiveness of supplementary measures such as encryption and SCCs. ### Sample text for your banner > We use Grasp Technologies to consolidate travel and expense data. This involves transferring booking and card data to Grasp servers in the United States under Standard Contractual Clauses. The Grasp website also uses analytics cookies that we activate only after your consent. Cookies and trackers ## What Grasp sets and contacts - Tracking method Cloud based travel and expense data analytics. Grasp aggregates booking, expense and payment data from multiple sources (TMCs, corporate card programs, ERP) and renders dashboards and reports. Tracking on the Grasp marketing site uses standard analytics cookies, IP address, user agent, screen resolution and Flash plugin presence to measure visitor activity. - Server location Grasp Technologies is a United States company with primary processing infrastructure in the United States. Some EU customer deployments may use regional cloud regions, but the default data location is the US. - Data transferred outside the EU Personal data, including IP addresses of EU website visitors and traveller data submitted by EU corporate clients, is transferred to the United States. Transfers rely on Standard Contractual Clauses and on the EU US Data Privacy Framework where Grasp is certified. A transfer impact assessment is recommended for any EU corporate client. ### Cookies set (3) | Name | Type | Duration | Purpose | | -------------- | ---------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | \_ga | persistent | 2 years | Google Analytics first party cookie used on the Grasp marketing website to distinguish unique visitors and measure traffic. Requires consent under article 5(3) ePrivacy. | | \_gid | persistent | 24 hours | Google Analytics short term cookie used on the Grasp marketing website to track session level activity. Requires consent. | | grasp\_session | session | session | Authentication session cookie set when a user logs into the Grasp travel and expense platform. Strictly necessary for authenticated access. | ### Third-party domains contacted (3) - `grasptech.com` - `app.grasptech.com` - `www.google-analytics.com` Questions ## Frequently asked questions about Grasp Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Grasp Technologies set? The Grasp marketing website sets analytics cookies that record IP address, user agent, operating system, browser type, screen resolution and plugins. Inside the Grasp travel and expense platform itself, sessions are managed with authentication cookies that are strictly necessary for the logged in user. Any cross site tracking cookies depend on the specific Grasp deployment. ### Is consent required for Grasp? Consent is required only for the analytics cookies on the Grasp marketing website, where prior consent under article 5(3) ePrivacy applies. Inside a corporate deployment, traveller data is processed for performance of the employment relationship or legitimate interest, not consent. Employees must be informed transparently. ### What is the legal basis for processing in Grasp? For analytics cookies, the legal basis is consent. For the unified travel and expense data set, the controller (the corporate client) typically relies on performance of the employment contract under article 6(1)(b) GDPR, legitimate interest under article 6(1)(f) for cost control and fraud prevention, or legal obligation for tax and accounting. ### Does Grasp transfer data to the US? Yes. Grasp Technologies is a US company and its default infrastructure is in the United States. Customer traveller and expense data, including data on EU based travellers, is transferred to US servers. Transfers must rely on Standard Contractual Clauses, the EU US Data Privacy Framework if Grasp is certified, and supplementary safeguards. ### Do we need a DPIA for Grasp? A DPIA is generally required because Grasp processes employee travel data at scale on infrastructure in a third country, with systematic monitoring of movement patterns. The DPIA should assess necessity, proportionality, retention, access controls, encryption, and the effectiveness of SCCs and any supplementary measures. ### How do we implement Grasp compliantly? Sign a DPA with SCCs, document Grasp in records of processing activities, run a transfer impact assessment, complete a DPIA, restrict access via SSO and MFA, set retention periods aligned with tax and audit obligations, brief employees and update the privacy notice. Wire marketing analytics on the public Grasp pages through a Consent Management Platform. ### What alternatives to Grasp exist for EU customers? EU oriented alternatives include SAP Concur with EU hosting, Mobilexpense, Cytric Travel by Amadeus, Egencia and Notilus. For pure analytics on travel data, in house data warehouses with Looker, Power BI or Tableau hosted in the EU can replicate the reporting layer while keeping data within the EEA. ### How do we update the cookie policy when using Grasp? Add a separate entry for Grasp marketing analytics cookies in the public cookie policy, with vendor name, purpose, lifetime and consent category. Document the internal Grasp deployment in the privacy notice for employees rather than in the public cookie policy. Review the policy whenever Grasp updates its sub processors or moves to new regions. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [Image Relay](https://www.flowconsent.com/en/services/other/image-relay) [Image Relay is an image management and optimization solution that helps websites deliver high-quality visual content with optimal performance. It provides automatic compression, format conversion, and responsive delivery for fast page loads. Image Relay supports lazy loading, CDN distribution, and gallery creation, enabling businesses to showcase visuals beautifully while maintaining excellent Core Web Vitals scores and search engine rankings.](https://www.flowconsent.com/en/services/other/image-relay) [Preferences](https://www.flowconsent.com/en/services/other/image-relay) · ### [Swapcard](https://www.flowconsent.com/en/services/other/swapcard) [Swapcard is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Swapcard enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Swapcard empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/other/swapcard) [Marketing](https://www.flowconsent.com/en/services/other/swapcard) · ### [uKnowva](https://www.flowconsent.com/en/services/other/uknowva) [uKnowva is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. uKnowva integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, uKnowva helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/uknowva) [Preferences](https://www.flowconsent.com/en/services/other/uknowva) · ### [Canva](https://www.flowconsent.com/en/services/other/canva) [Canva is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Canva offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Canva empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/other/canva) [Analytics](https://www.flowconsent.com/en/services/other/canva) · ### [ERPNext](https://www.flowconsent.com/en/services/other/erpnext) [ERPNext is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ERPNext integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ERPNext helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/erpnext) [Other](https://www.flowconsent.com/en/services/other/erpnext) · ### [HTTP/3](https://www.flowconsent.com/en/services/other/http-3) [HTTP/3 is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. HTTP/3 is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, HTTP/3 offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/other/http-3) [Other](https://www.flowconsent.com/en/services/other/http-3) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)