iGoDigital

The personalisation beacon collects pageviews, clicks, scroll depth, search queries, product views, cart actions, purchases, custom events and form submissions. It writes first party cookies (evgUserUid, evgSessionToken, a session id) and uses local storage to keep extended profile data. When a visitor authenticates or submits identifying information, the beacon stitches the anonymous device profile to a known customer record stored in the Salesforce Data Cloud. Einstein models then enrich the profile with affinity scores, segment memberships and recommendation rankings used to personalise content.

Yes. Loading the beacon stores identifiers on the device, which triggers Art. 5(3) ePrivacy, and the systematic behavioural monitoring qualifies as profiling under Art. 4(4) GDPR. EDPB Guidelines 8/2020 on targeting of social media users and consistent CNIL, AEPD and garante guidance require prior, freely given, specific, informed and unambiguous consent. The beacon must be loaded only after explicit opt in, with a reject all button as visible as accept all, and the Salesforce consent API used to suppress event capture before consent.

The lawful basis is consent under Art. 6(1)(a) GDPR combined with Art. 5(3) ePrivacy for the device storage. Legitimate interest is generally not available given the intrusive nature of cross site behavioural profiling. Where profiles infer Art. 9 special category data such as health condition, religion or political opinion, explicit consent under Art. 9(2)(a) is required. If iGoDigital outputs feed automated decisions with legal or similarly significant effects, Art. 22 GDPR safeguards (information, human review, contestation) must also be put in place.

Yes by default. Salesforce Marketing Cloud Personalization runs on the Salesforce Hyperforce platform with regional pods, but the default pod for many customers terminates in the United States. EU customers can request an EU Hyperforce pod (Frankfurt or Paris) at provisioning time, although certain global services such as Einstein training and support tooling may still touch US infrastructure. Salesforce is certified under the EU US Data Privacy Framework and offers Standard Contractual Clauses (Module Two), with technical and organisational supplementary measures. A Schrems II Transfer Impact Assessment is required.

Yes. The processing combines systematic monitoring, profiling and large scale processing of personal data, which together meet at least three of the EDPB DPIA criteria. The DPIA should describe the events captured, the identity stitching logic, retention of profile data, the Einstein training scope, the transfer mechanism and the Schrems II Transfer Impact Assessment, the lawful basis and Art. 22 risk, the option of EU Hyperforce, and the residual risks accepted. It should also document how DSAR, deletion and consent withdrawal propagate to all Salesforce datasets.

Choose an EU Hyperforce pod where possible. Implement the Salesforce SDK in consent gated mode so that no events fire before opt in. Use the CMP to control accept, reject and granular preferences, and synchronise consent state to Salesforce so opt outs propagate to email and journey channels. Sign the Salesforce DPA, SCC Module Two, run a Schrems II Transfer Impact Assessment and document supplementary measures (transport encryption, pseudonymous visitor IDs, restricted Einstein training). Surface a clear preference centre and respect Do Not Sell or Share signals where applicable.

EU residency alternatives include Dynamic Yield (Mastercard, EU pod), Algolia Personalization (Paris and Frankfurt regions), AB Tasty (France), Kameleoon (France), Optimizely Personalization (EU region) and Bloomreach (EU data centres). For privacy first personalisation, open source options like NextRoll OneTrust integration with self hosted recommenders on Matomo or n8n can keep data in the EEA. Each alternative still requires consent and a CMP, but they remove or reduce the US transfer exposure typical of a default Hyperforce US deployment.

Review the iGoDigital privacy notice, cookie inventory and segment catalogue at least every six months and whenever you add new event types, change Einstein training scope, switch pod region, modify retention settings or change sub processors. Re prompt visitors for consent when new categories of processing emerge, such as cross device stitching or new third party enrichment. Audit segment definitions to make sure they do not implicitly infer Art. 9 data, and check that DSAR responses cover both the Marketing Cloud Personalization profile and the linked Data Cloud unified record.