> GDPR and ePrivacy guide for Recommy: tracking cookies, AI personalisation, consent, profiling, DPIA and EU compliance for online stores. > > Canonical: https://www.flowconsent.com/en/services/personalization/recommy Personalization # Recommy Analytics · [Official website](https://recommy.com) Recommy is an AI personalisation and product recommendation engine for ecommerce. It tracks visitor behaviour across sessions, builds individual profiles and serves dynamic recommendations and personalised content, which makes it subject to prior consent under GDPR and the ePrivacy Directive. [Block Recommy until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=personalization) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Personalization](https://www.flowconsent.com/en/services/personalization) - Consent Analytics - Prior consent Required - Documented cookies 9 - Third-party domains 9 - Servers European Union (Recommy is a Polish company with infrastructure typically hosted within the EU on AWS or Hetzner European regions) Overview ## What does Recommy do? ## **What Recommy is and how it works** Recommy is an AI personalisation, analytics and product recommendation engine designed for ecommerce. The platform, developed by a Polish company, deploys a JavaScript tracker on the merchant store, ingests browsing events (page views, product views, basket actions, searches, purchases) and builds a behavioural profile for every visitor. It then exposes APIs and UI widgets to serve personalised product carousels, dynamic content and segmentation. Under the hood, Recommy assigns each visitor a persistent identifier stored in first party cookies and local storage, sends events to a Recommy API endpoint and feeds machine learning models that compute similarity scores, look alike audiences and next best offers. ## **Cookies and data collected** Recommy sets first party cookies such as recommy\_uid, \_rcm and recommy\_session, and uses local storage to keep the visitor profile in sync between sessions. Collected data includes anonymous identifiers, page URLs, product identifiers, basket actions, search keywords, user agent, language preferences and, once the visitor logs in or completes a purchase, a hashed customer identifier. ## **GDPR and ePrivacy legal basis** Because Recommy reads and writes non essential information on the user device and builds behavioural profiles, Art. 5(3) of the ePrivacy Directive requires prior consent, and Art. 6(1)(a) GDPR is the appropriate legal basis. The CNIL, the UODO in Poland and the EDPB consistently consider that personalisation and recommendation engines require explicit opt in. ## **Data transfers and sub processors** Recommy hosts its production stack within the European Union. By default no systematic data transfer outside the EEA is required, which is an advantage over US based personalisation engines. CDN providers, AWS or Hetzner edges and email gateways may still be involved as sub processors. The DPA should list them with their location and applicable transfer mechanism, in particular if any non EU region is enabled. ## **DPIA and risk assessment** A DPIA is recommended. Recommy combines persistent identifiers, full browsing histories, basket content, search keywords and AI driven scoring on a large scale, which triggers several Art. 35(3) GDPR criteria. The DPIA should cover retention, profile portability, data minimisation, the explainability of recommendations and the rights of customers to object to personalisation under Art. 21(2) GDPR. ## **Practical compliance steps** Block the Recommy tracker behind a Consent Management Platform, document a DPIA, sign the Recommy DPA, configure retention periods for inactive profiles, expose an opt out mechanism to logged in customers, list each Recommy cookie and event type in your cookie policy and update your privacy notice with the Polish processor and any sub processor. Compliance ## Recommy and the GDPR Recommy is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Art. 6(1)(a) GDPR (consent) for behavioural tracking, personalisation and AI driven recommendations, combined with Art. 5(3) ePrivacy Directive for cookies and local storage. Strictly aggregated A/B testing and anti fraud telemetry can be supported by Art. 6(1)(f) GDPR (legitimate interest) after a balancing test. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, TTDSG, LOPDGDD, CNIL guidelines on trackers, UODO (Poland) guidelines, EDPB Guidelines 08/2020 on targeting of social media users, EDPB Guidelines on profiling and automated decision making ### Impact assessment (DPIA) A Data Protection Impact Assessment is recommended because Recommy combines persistent identifiers, behavioural histories, basket data, search queries and AI personalisation. This meets several criteria of Art. 35(3) GDPR (systematic profiling, large scale, innovative technology). The DPIA should review data minimisation, retention of profiles, the explainability of AI recommendations, customer rights to opt out of personalisation and any sub processor edges in third countries. ### Sample text for your banner > We use Recommy to remember your browsing on our store, build a personalised profile and show you AI driven product recommendations. This requires storing identifiers on your device and processing your browsing history. Recommy will only run after you click Accept. You can withdraw your consent at any time from our cookie preferences. Cookies and trackers ## What Recommy sets and contacts - Tracking method cookies, local storage, JavaScript tracker, event API and server side identification linked to a persistent visitor profile - Server location European Union (Recommy is a Polish company with infrastructure typically hosted within the EU on AWS or Hetzner European regions) ### Cookies set (9) | Name | Type | Duration | Purpose | | ---------------- | -------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------- | | rcm\_visitor | HTTP | 13 months | Persistent visitor identifier used to recognise returning users across sessions. | | recommy\_uid | first\_party | 1 year | Persistent Recommy visitor identifier used to recognise the same browser across sessions and link behavioural events to a profile. | | \_rcm | first\_party | 1 year | Stores Recommy tracking flags and last interaction state to feed the recommendation models. | | rcm\_session | HTTP | 30 minutes | Session identifier used to group events into a single browsing session. | | rcm\_consent | HTTP | 6 months | Stores the visitor consent state for Recommy to suppress repeated prompts. | | recommy\_session | session | Session | Holds the current Recommy session identifier for short term event correlation within a browser session. | | recommy\_profile | local\_storage | Persistent | Local storage entry that caches the current visitor profile and segmentation tags computed by Recommy. | | rcm\_test | HTTP | Session | Stores the A/B test variant assigned to the visitor for personalisation reports. | | recommy\_ab | first\_party | 6 months | Assigns the visitor to a stable A/B testing variant for personalisation experiments inside Recommy. | ### Third-party domains contacted (9) - `recommy.com` - `api.recommy.com` - `cdn.recommy.com` - `app.recommy.com` - `cdn.recommy.com` - `tracker.recommy.com` - `app.recommy.com` - `api.recommy.com` - `recommy.com` Questions ## Frequently asked questions about Recommy Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Recommy set? Recommy sets first party cookies such as rcm\_visitor (persistent visitor ID, \~13 months), rcm\_session (session correlation, 30 minutes), rcm\_consent (consent state) and rcm\_test (A/B test variant). It also processes IP address, user agent and event metadata. ### Which cookies does Recommy set on my store? Recommy mainly sets first party cookies such as recommy\_uid, \_rcm and recommy\_session, plus local storage entries for the visitor profile. These are persistent identifiers used to recognise visitors across sessions and feed the AI recommendation models. ### Does Recommy require user consent? Yes. Recommy stores a persistent identifier that allows cross session re identification, so its tag falls outside the strictly necessary exemption and requires an explicit opt in under Article 5(3) of the ePrivacy Directive. ### Is consent required before loading Recommy? Yes. Recommy stores identifiers on the device and performs profiling, so prior, freely given, specific, informed and unambiguous consent is required under Art. 5(3) of the ePrivacy Directive and Art. 6(1)(a) GDPR. ### What is the legal basis for processing under Recommy? Consent (Art. 6(1)(a) GDPR) is the appropriate basis for the tag and cookies. Legitimate interest (Art. 6(1)(f) GDPR) may apply to internal aggregated reporting after a documented balancing test and only on properly anonymised data. ### What is the legal basis for processing with Recommy? The primary basis is consent under Art. 6(1)(a) GDPR for personalisation and recommendations. Legitimate interest under Art. 6(1)(f) may cover narrow anti fraud or aggregated A/B testing scenarios, but never the personalised recommendation itself. ### Does Recommy transfer data outside the EU? The Recommy backend is hosted in the EU but the tracker is delivered through a global CDN. CDN edge nodes outside the EEA require Standard Contractual Clauses under Article 46(2)(c) GDPR and a transfer impact assessment. ### Does Recommy transfer data to the United States? Not by default. Recommy is a Polish company hosting production data in EU regions. Some sub processors (CDN providers, email gateways) may operate edges in third countries, in which case the EU US Data Privacy Framework or Standard Contractual Clauses apply. ### Do I need a DPIA for Recommy? A DPIA is recommended when Recommy is combined with personal data from forms or CRM, when events are stored at user level rather than aggregated or when reports cross reference marketing platforms. ### Do I need a DPIA for Recommy? A DPIA is recommended. Recommy performs systematic profiling at scale combined with AI driven recommendations, which triggers Art. 35(3) GDPR criteria. The DPIA should focus on profile retention, opt out for personalisation, automated decision making and AI explainability. ### How do I implement Recommy GDPR compliantly? Block the tag by default, load it after analytics consent, sign the Recommy DPA, list CDN and host as sub processors, set cookies to a maximum of 13 months, anonymise IPs and document retention. ### How do I implement Recommy compliantly in the EU? Block the Recommy tracker behind a Consent Management Platform, fire it only after opt in, sign the Recommy Data Processing Agreement, define retention for inactive profiles, expose an opt out for logged in customers and declare Recommy in your privacy policy as a Polish processor. ### Are there alternatives to Recommy? Yes. Synerise (Poland), Algolia Recommend (France with EU regions), Crossing Minds, Nosto (Finland) and self hosted open source recommenders are credible alternatives to Recommy. Most of them are also EU based, which simplifies compliance. ### What are alternatives to Recommy? For EU friendly analytics consider Matomo (self hosted or EU Cloud), Plausible (EU hosted), Pirsch (Germany), Fathom Lite, Simple Analytics or Cabin. ### How do I update my cookie policy to include Recommy? List the controller, the processor (Recommy), the purposes (analytics, reporting), the cookies and their lifetimes, the CDN sub processor, the international transfers and their legal basis, and the rights and withdrawal mechanism. ### How do I update my cookie policy for Recommy? List recommy\_uid, \_rcm, recommy\_session and local storage entries with purpose, type and duration, identify Recommy as a Polish processor, document any sub processor edge in third countries and explain how customers can opt out of personalisation. Same category ## More services: Personalization [See the whole category](https://www.flowconsent.com/en/services/personalization) ### [Convert](https://www.flowconsent.com/en/services/personalization/convert) [Convert is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Convert offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Convert empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/personalization/convert) [Analytics](https://www.flowconsent.com/en/services/personalization/convert) · ### [Perzonalization](https://www.flowconsent.com/en/services/personalization/perzonalization) [Perzonalization is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Perzonalization enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Perzonalization empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/personalization/perzonalization) [Preferences](https://www.flowconsent.com/en/services/personalization/perzonalization) · ### [Webeo](https://www.flowconsent.com/en/services/personalization/webeo) [Webeo is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Webeo enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Webeo empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/personalization/webeo) [Preferences](https://www.flowconsent.com/en/services/personalization/webeo) · ### [Bunting](https://www.flowconsent.com/en/services/personalization/bunting) [Bunting is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Bunting offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Bunting empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/personalization/bunting) [Analytics](https://www.flowconsent.com/en/services/personalization/bunting) · ### [Twik](https://www.flowconsent.com/en/services/personalization/twik) [Twik is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Twik enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Twik empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/personalization/twik) [Preferences](https://www.flowconsent.com/en/services/personalization/twik) · ### [Bounce Commerce](https://www.flowconsent.com/en/services/personalization/bounce-commerce) [Bounce Commerce offers a scalable e-commerce solution designed to help merchants sell products and services online. Its feature set includes customizable storefronts, multi-currency support, automated tax calculations, and advanced shipping options. Bounce Commerce integrates with leading payment gateways, marketing platforms, and fulfillment services. Built-in analytics and reporting tools help merchants track performance, optimize conversions, and make data-driven business decisions for sustainable growth.](https://www.flowconsent.com/en/services/personalization/bounce-commerce) [Preferences](https://www.flowconsent.com/en/services/personalization/bounce-commerce) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)