Insider

What Insider Is

Insider is a cross channel marketing personalisation and customer experience platform used by online businesses to recognise visitors and tailor content across websites, mobile apps, email, SMS and push. It collects behavioural signals through a first party JavaScript tag known as the Insider Tag, then unifies them into a single customer profile. These profiles feed AI driven segmentation, product recommendations and automated campaigns. Marketing and growth teams rely on it to increase conversion and retention. Because it observes and predicts individual behaviour at scale, it processes large volumes of personal data. This places it firmly within the scope of European data protection and ePrivacy rules.

Cookies and Data Collected

The Insider Tag sets first party cookies and uses localStorage and sessionStorage to store a unique visitor identifier and session information. This identifier links page views, clicks, searches, product interactions and conversions to build a persistent behavioural profile. The platform also ingests attributes you send, such as email, purchase history and custom events. For web push it registers a service worker and stores a subscriber identifier and permission state. Identifiers commonly persist for up to a year, while session values are shorter lived. Together these data points allow Insider to track returning visitors and personalise their experience.

GDPR and ePrivacy Implications

Under the ePrivacy Directive, storing or reading cookies and similar identifiers that are not strictly necessary requires prior consent. The behavioural profiles Insider builds are personal data under the GDPR, and combining them across channels amounts to profiling. Where personalisation produces significant effects, Article 22 on automated decision making may also apply. Controllers must therefore have a valid legal basis, provide transparent information and honour data subject rights. Supervisory authorities such as the CNIL have made clear that tracking for marketing cannot rely on legitimate interest alone. Insider should never load before consent is captured.

Consent Requirements and CMP Integration

Valid consent must be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as to give. In practice the Insider Tag should be gated behind a consent management platform so that it fires only after the visitor accepts marketing or personalisation cookies. The platform supports a cookie free integration that can serve campaigns without setting tracking cookies for those who decline. Web push requires its own clear opt in that is separate from the browser permission prompt. You should record proof of consent and pass signals to Insider so it respects the visitor choice. Regularly test that no identifiers are written before acceptance.

International Data Transfers

Insider operates global cloud infrastructure and personal data may be processed outside the European Economic Area, including in the United States. Transfers to third countries require an appropriate safeguard under Chapter V of the GDPR, typically Standard Contractual Clauses and, where the importer is certified, the EU US Data Privacy Framework. Controllers should carry out a transfer impact assessment and apply supplementary measures such as encryption and strict access controls. Enterprise customers may be able to request EU based hosting to keep data within the region. Document the locations involved and disclose them in your privacy notice. Review the data processing agreement and its list of sub processors carefully.

Practical Compliance Steps

Start by mapping every data point Insider collects and documenting the purpose and retention for each. Gate the Insider Tag behind your consent management platform and verify with browser tools that nothing loads before consent. Conduct a data protection impact assessment given the scale of profiling involved. Sign the data processing agreement, review sub processors and confirm transfer safeguards for the United States. Update your privacy and cookie policies to name Insider, list its cookies and explain the personalisation and push features. Finally, establish a process to handle access, deletion and objection requests and to refresh consent when purposes change.