Attraqt

What Attraqt is

Attraqt is a London headquartered software company that provides search, merchandising, and personalisation services to online retailers and brands. The platform combines the Fredhopper search engine, acquired in 2017, with category page management, product recommendations, and AI driven product discovery widgets. Merchants integrate Attraqt through a JavaScript SDK and server side catalog feeds, and the platform powers the on site search bar, faceted navigation, category ordering, and recommendation carousels. Attraqt is used by large European fashion, beauty, and home retailers and competes with vendors such as Algolia, Bloomreach, and Coveo.

Cookies and event collection

Attraqt writes a first-party cookie to identify the browsing session, track click positions in search results, and link multiple visits to the same anonymous profile. The SDK captures product views, add to cart, search queries, filter clicks, and purchases, and forwards them to the Attraqt event API. Where the merchant uses the personalisation modules, a longer lived identifier is used to build a behavioural profile across sessions. The cookies and identifiers stored on the visitor device fall within the scope of ePrivacy Article 5(3), so consent is required before they are written for purposes that go beyond strictly necessary search.

GDPR scope and roles

When a merchant uses Attraqt, the merchant is the controller and Attraqt acts as a processor under Article 28 GDPR. The data processing agreement should describe the categories of data, the purposes, the retention, and the sub processors. The categories typically include online identifiers, behavioural events, search queries that may reveal interests, and, for logged in customers, hashed customer identifiers. Special categories should not be sent to Attraqt unless a specific lawful basis under Article 9 applies. The Digital Services Act adds transparency obligations for very large online platforms that use recommender systems.

Consent, legitimate interest, and ePrivacy

Strictly necessary search that simply finds products matching a query can rely on Article 6(1)(f) legitimate interest and does not require ePrivacy consent if no non essential identifier is stored. Personalisation, behavioural recommendations, A: B testing, and cross session profiling require Article 6(1)(a) consent because identifiers are stored on the device for non essential purposes. The CNIL and the ICO confirm that cookie banners must offer an equally accessible refuse option, and the AEPD adds that scrolling does not constitute consent. Configure the SDK to operate in a non personalised mode when consent is refused.

Data transfers and sub processors

Attraqt processes data primarily in EU regions but routes some support and engineering operations through the United Kingdom. The UK benefits from an EU adequacy decision adopted in 2021, so transfers do not require Standard Contractual Clauses, but controllers should record the transfer in the records of processing and inform data subjects in the privacy notice. Where Attraqt uses sub processors in countries without adequacy, such as engineering support from third countries, Standard Contractual Clauses with supplementary measures must apply. Review the sub processor list in the data processing agreement at least annually.

Practical compliance steps

Map every Attraqt cookie and event to a purpose in the cookie policy and the records of processing. Configure the SDK so that the personalisation and recommendation modules load only after consent for personalisation, while basic search remains available. Update the privacy notice to mention Attraqt as a processor, the categories of data, the retention, and the UK adequacy decision. Sign the Attraqt data processing agreement, request the latest sub processor list, and ensure that data subject access and erasure requests are routed correctly. Test pages with consent denied to confirm that no profiling cookie is set.