# Privacy Policy

> Privacy Policy, cookie policy and electronic marketing policy of Datafirefly Limited (Ireland), for the DataFirefly Server-Side Tracking service.

- Original page: https://server-side.datafirefly.com/en/privacy.html
- Language: en
- Updated: 2026-08-03
- Publisher: DataFirefly (Datafirefly Limited), https://server-side.datafirefly.com/en/

---

Privacy, cookies & electronic marketing: Datafirefly Limited (GDPR)

**LEGAL DOCUMENTATION**

**DATAFIREFLY LIMITED**

15A Main Street, Blackrock, Dublin, Ireland, A94T8P8

This document contains:

- 1. Privacy Policy (GDPR)
- 2. Cookies / ePrivacy Policy
- 3. Electronic Marketing Policy

Compliant with GDPR (EU) 2016/679 · Data Protection Act 2018 · ePrivacy Regulations (Ireland)

Competent supervisory authority: Data Protection Commission, Dublin, Ireland

*Version 1.0: March 2026*

Privacy contact: privacy@datafirefly.com

**1. PRIVACY POLICY**

Last updated: March 2026, DATAFIREFLY LIMITED

**1.1 Controller**

This website and its associated services are operated by DATAFIREFLY LIMITED, an Irish company registered under number 810100, acting as data controller within the meaning of the GDPR.

| **Field** | **Value** |
| --- | --- |
| **Company name** | DATAFIREFLY LIMITED |
| **Registration number (CRO)** | 810100 |
| **Address** | 15A Main Street, Blackrock, Dublin, Ireland, A94T8P8 |
| **Privacy email** | privacy@datafirefly.com |
| **Hosting provider** | O2switch, France (EEA) |

**1.2 Scope**

This policy applies to any person who:

- visits our website
- contacts us by form, email or any other means
- requests a quote, demonstration or information about our services
- subscribes to our services, modules, consulting, training or SaaS subscriptions
- uses our technical support or customer service
- signs up for our newsletter or consents to receive our commercial communications
- is in a professional (B2B) relationship with Datafirefly

**1.3 Data collected**

**1.3.1 Identification and contact data**

- Last name, first name
- Company name and role
- Email address and phone number
- Postal address and country

**1.3.2 Commercial and contractual data**

- Content of your requests, quotes, orders and invoices
- Commercial relationship history
- Information relating to your subscriptions, licenses or subscribed services

**1.3.3 Technical and connection data**

- IP address, technical logs, date and time of access
- Browser, device type, operating system

**1.3.4 Usage data**

- Site journey, pages viewed, interactions with our content
- Audience measurement data (via Google Analytics, subject to consent)

**1.3.5 Support data**

- Content of messages, attachments, screenshots and exchange histories

**1.3.6 Payment data**

Payment data (card number, expiry date, CVV) are collected and processed directly by our payment provider Stripe Technology Europe Limited. Datafirefly never stores full card details on its servers.

**1.4 Purposes and legal bases**

In accordance with Articles 13 and 14 of the GDPR, each processing activity is based on an identified legal basis.

| **Purpose** | **Legal basis** |
| --- | --- |
| **Responding to your contact, quote or demonstration requests** | Pre-contractual measures / Legitimate interest |
| **Creation and management of client account** | Contract performance |
| **Provision of SaaS services, modules, consulting, training** | Contract performance |
| **Billing, accounting, tax obligations** | Legal obligation |
| **Customer support and technical maintenance** | Contract performance |
| **Security, fraud and abuse prevention** | Legitimate interest |
| **Service improvement and internal statistics** | Legitimate interest / Consent |
| **Sending newsletters and commercial communications** | Consent / ePrivacy rules |
| **Lead scoring and customer segmentation (AI)** | Legitimate interest: see section 1.9 |
| **Defence in court and dispute management** | Legitimate interest / Legal obligation |

**1.5 Data recipients**

Your data are accessible to authorised persons within Datafirefly. They may be transmitted, strictly as necessary, to the following categories of recipients:

- Hosting provider: O2switch (France, EEA)
- Communication and emailing tools: own email infrastructure, hosted in the EU
- Analytics tools: Google Analytics (see section on transfers outside EEA)
- Advertising networks: Meta Platforms (see section on transfers outside EEA)
- Payment provider: Stripe Technology Europe Limited, direct processing of banking data (see section 1.6)
- Accounting, legal or administrative advisors, under professional secrecy
- Public or judicial authorities, where required by law

**1.6 Transfers outside the European Economic Area**

Some of our tools involve data transfers to countries outside the EEA, in particular:

| **Provider** | **Country** | **Legal safeguard** |
| --- | --- | --- |
| **Google Analytics** | United States | Standard Contractual Clauses (SCC): EU-US adequacy decision applicable |
| **Meta Platforms (Pixel)** | United States | Standard Contractual Clauses (SCC) |
| **Stripe Technology Europe Ltd** | Ireland (EEA) / partial US | SCC for residual transfers: Stripe GDPR policy |
| **OpenAI / Anthropic / Ollama (if processing)** | United States | Standard Contractual Clauses (SCC) |

For further information on these safeguards or a copy of applicable mechanisms, please write to privacy@datafirefly.com.

**1.7 Retention periods**

Retention periods correspond to the legal maximums allowed for each purpose, in accordance with the storage limitation principle (Art. 5(1)(e) GDPR) and applicable Irish obligations.

| **Type of data** | **Retention period** | **Legal reference** |
| --- | --- | --- |
| **Events held during a quota overage** | 7 days maximum, encrypted at rest | Performance of the contract (Art. 6(1)(b) GDPR): deferred transmission to the destination platforms |
| **Proof of acceptance of the Terms (version, date, IP, language)** | Contract duration + 6 years | Legitimate interest (Art. 6(1)(f) GDPR): evidencing contractual consent; Statute of Limitations Act 1957 |
| **Contact requests without commercial follow-up** | 3 years after last contact | Irish Statute of Limitations |
| **Unconverted prospect data** | 3 years after last meaningful contact | Irish Statute of Limitations |
| **Client and contractual data** | Contract duration + 6 years (archive) | Statute of Limitations Act 1957 (Ireland) |
| **Invoices and accounting data** | 6 years from end of financial year | Companies Act 2014 & Taxes Consolidation Act 1997 |
| **Tax and intra-EU VAT documents** | 6 years minimum | Revenue Commissioners Ireland: VAT Act 2010 |
| **Technical and security logs** | 12 months | GDPR minimisation: security use only |
| **Support data / tickets** | 3 years after ticket closure | Irish Statute of Limitations |
| **Newsletter / marketing consent** | 3 years after withdrawal or last interaction | DPC Guidance: ePrivacy Regulations |
| **Payment data (transaction reference)** | 6 years | Companies Act 2014: accounting obligations |
| **Non-essential cookies and trackers** | 13 months maximum | EDPB & DPC guidance on cookies |
| **Strictly necessary cookies** | Session or 12 months max | ePrivacy Regulations (Ireland) |
| **GDPR consent evidence** | 3 years after end of relationship | Art. 5(2) GDPR: accountability principle |

**1.8 Your rights**

In accordance with the GDPR, you have the following rights:

| **Right** | **Description** |
| --- | --- |
| **Access** | Obtain a copy of data concerning you |
| **Rectification** | Correct inaccurate or incomplete data |
| **Erasure** | Request deletion of your data, under conditions |
| **Restriction** | Request temporary suspension of processing |
| **Objection** | Object to processing based on legitimate interest |
| **Portability** | Receive your data in a structured, machine-readable format |
| **Withdrawal of consent** | Withdraw your consent at any time, without prejudice |

To exercise your rights, contact us at: privacy@datafirefly.com. We may ask you to verify your identity. Any request is processed free of charge within one month, extendable by two months for complex requests.

**Right to lodge a complaint with the supervisory authority**

You have the right to lodge a complaint with the Data Protection Commission (DPC) of Ireland.

Website: www.dataprotection.ie, Email: info@dataprotection.ie

**1.9 Customer scoring and automated processing**

Datafirefly uses artificial intelligence tools for lead scoring and customer segmentation. The purpose of such processing is to tailor our commercial offers and prioritise our marketing actions.

Such processing does not constitute automated decisions producing significant legal effects within the meaning of Article 22 GDPR. Scoring is used as an aid to human decision-making and does not automatically determine a contractual decision.

Legal basis: legitimate interest, balanced against your fundamental rights and freedoms.

You may object at any time by writing to privacy@datafirefly.com.

**1.9 bis AI features in the service (Signal Analyst and "Ask your data")**

The service includes two features that rely on an artificial intelligence model, disclosed as such in the console in accordance with article 50 of the EU Artificial Intelligence Act:

- **Anomaly explanations (Signal Analyst)**: when statistical detection raises an anomaly on your tracking, the wording of the explanation may be produced by an AI model from the **aggregated figures** of that anomaly. Any explanation produced this way carries an "Explanation generated by AI" notice in the console and in the weekly report; explanations we write ourselves do not.
- **"Ask your data"**: your natural-language questions about your own aggregated statistics are interpreted by an AI model.

What is sent to our processor **Anthropic** (model provider, United States, standard contractual clauses) is limited to **aggregated, non-personal data**: event counts, rates, thresholds, destination names. **No personal data belonging to your own customers is ever sent to an AI model**: no email address, no identifier, no hash, no IP address.

| **What the AI does not do.** Anomaly **detection** is purely statistical: no model is involved, and the figures shown are measurements, never a model's estimates. **Fix recipes** are hand-written and versioned. No **action** on your configuration or on your advertising accounts is ever triggered by a model: every write requires an explicit human approval. No automated decision within the meaning of article 22 GDPR is taken. |
| --- |
|  |

**1.10 Data security**

Datafirefly implements appropriate technical and organisational measures, including:

- Access control and authentication
- Logging of access to sensitive data
- Regular backups and business continuity plan
- Secure hosting on O2switch infrastructure (France)
- Access restricted to authorised personnel only
- Revocation of access at the end of a service

**1.11 Data of minors**

Datafirefly services are intended for professional or adult audiences. We do not knowingly collect personal data concerning persons under 18.

**1.12 Policy update**

This policy may be updated to reflect legal, regulatory or operational developments. The version in force is the one published on the site on the date indicated at the top of the document. In case of substantial modification, we will inform you by email or via a notice on the site.

**1.13 Two roles: data controller and processor**

Datafirefly Limited acts in two different capacities, which do not carry the same responsibility under the GDPR. The distinction determines who a request should be addressed to.

- **For the people described so far** — site visitors, prospects, customers, support users — Datafirefly Limited is the **data controller**.
- **For the shoppers of our merchant customers’ stores**, whose conversions pass through the service, Datafirefly Limited is a **processor**: the merchant is the data controller. They determine the purposes, choose the receiving platforms and collect their shoppers’ consent. We act solely on their documented instructions, under the data processing agreement concluded with them pursuant to Article 28 GDPR.

If you purchased from a store running DataFirefly Server-Side and wish to exercise your rights, your point of contact is **that merchant**, not us. Any request reaching us directly is forwarded to them without delay, and we cannot answer it on the merits without their instruction.

The data processed on the merchant’s behalf is: identity from the order (email address, first and last name, telephone, city, postcode, country, the store’s internal customer identifier); order data (amount paid, amount excluding tax, currency, reference, products with quantity and price); technical context (IP address, user agent, page URL); advertising identifiers set by the platforms or by our tracker; and the consent verdict recorded for each event.

No data falling under Article 9 GDPR is processed. A refund produces a separate event with no personal data: only the order reference and the amount are sent. Where consent is refused, no event is transmitted and **no advertising identifier is retained**: only the record of the refusal is kept, so that it can be evidenced.

**1.14 Your Google account data**

This section concerns merchants who connect a Google Ads account to DataFirefly Server-Side. What we access:

- your email address and Google account identifier, to identify you, attach the connection to the correct account, and show you in your client space which Google account is connected;
- the list of Google Ads accounts you can access, so that you can choose which one to connect;
- the Google Ads account you select, in order to upload the conversions measured on your store;
- where you grant it, your Google Analytics data in read-only mode, solely to display in your client space the comparison between what we sent and what Google recorded.

What we do not do:

- we do not create, modify or delete any campaign, ad, budget or bid;
- we do not sell or rent your Google data to anyone;
- we do not use it for our own targeted advertising, nor to train generalised models;
- we allow no human to read it, other than in the cases Google’s policy permits: your explicit consent, support at your request, a legal obligation, or what is strictly necessary to operate and secure the service.

The refresh token issued by Google is stored encrypted and is **never exposed to your store or to your browser**. Access tokens are derived on demand and not persisted. Token and account data are deleted within thirty days of account closure. You can revoke access at any time, from your client space or directly at [myaccount.google.com/permissions](https://myaccount.google.com/permissions); revocation takes effect immediately.

*DataFirefly’s use of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.*

**1.15 Hosting and retention specific to the service**

The marketing site is hosted by O2switch (France, EEA). The DataFirefly Server-Side service itself — the client console and the event collector — is hosted on a dedicated **Hetzner Online GmbH** server in the Falkenstein data centre, Germany (EEA), ISO 27001 certified, under a data processing agreement signed pursuant to Article 28 GDPR and with encryption at rest. **Our merchant customers’ events are stored exclusively on that server, within the European Union.**

Cloudflare, Inc. (United States) provides delivery, traffic protection and access control in front of our servers. Traffic transits its network; no data is durably stored there.

Events received are retained according to the plan subscribed for the site: **7 days** on the free plan, **30 days** on Starter, **90 days** on Growth, **365 days** on Scale. After that period, the event and the personal data it contains are deleted by an automated purge, logged on every run. Statistical aggregates computed from those events contain no personal data and are retained for 30 to 365 days depending on the plan. Encrypted database backups are kept on a 14-day rotation.

On termination of the service, all of the merchant’s data is deleted within thirty days, backups included as they rotate out.

**2. COOKIES / ePRIVACY POLICY**

Last updated: March 2026, DATAFIREFLY LIMITED

Legal basis: GDPR (EU) 2016/679 · Data Protection Act 2018 (Ireland) · ePrivacy Regulations (Ireland)

Competent authority: Data Protection Commission (DPC), Dublin.

In Ireland, the ePrivacy rules cover any storage of, or access to, information on the user's terminal equipment.

**2.1 What is a cookie?**

A cookie is a small text file, or any similar technology, placed on or read from your terminal (computer, smartphone, tablet) when browsing a site. Irish ePrivacy rules more broadly apply to any technology allowing information to be stored on, or accessed from, a user's terminal equipment (pixels, tags, local storage, SDK, etc.).

**2.2 Categories of cookies used**

**Strictly necessary cookies**

Essential to the operation of the site. They enable security, authentication, session stability and storage of your technical choices. They do not require prior consent but must be explained.

| **Name** | **Provider** | **Purpose** | **Duration** | **EEA Transfer** |
| --- | --- | --- | --- | --- |
| **session_id** | Datafirefly / O2switch | Secure session maintenance | Session | No |
| **cookie_consent** | Datafirefly (CMP) | Storage of consent preferences | 12 months | No |
| **csrf_token** | Datafirefly | Protection against CSRF attacks | Session | No |

**Audience measurement cookies: Google Analytics**

These cookies measure site traffic, pages viewed and browsing behaviour, to improve our content and performance.

| **Name** | **Provider** | **Purpose** | **Max duration (EDPB)** | **EEA Transfer** |
| --- | --- | --- | --- | --- |
| **\_ga** | Google Analytics | Unique visitor identification | 13 months | Yes: US (SCC) |
| ***ga***\* | Google Analytics | Google Analytics session state | 13 months | Yes: US (SCC) |
| **\_gid** | Google Analytics | User distinction | 24 hours | Yes: US (SCC) |

**Marketing cookies: Meta Pixel (Facebook)**

These cookies are set by Meta Platforms and allow us to measure the effectiveness of our advertising campaigns, create custom audiences and limit ad repetition.

| **Name** | **Provider** | **Purpose** | **Max duration (EDPB)** | **EEA Transfer** |
| --- | --- | --- | --- | --- |
| **\_fbp** | Meta Platforms | Conversion and advertising audience tracking | 13 months | Yes: US (SCC) |
| **\_fbc** | Meta Platforms | Facebook ad click tracking | 13 months | Yes: US (SCC) |

**2.3 Legal basis of cookies**

| **Category** | **Legal basis** | **Consent required** |
| --- | --- | --- |
| **Strictly necessary** | Legitimate interest / Service operation | No |
| **Audience measurement (Google Analytics)** | Prior consent | Yes |
| **Marketing / Meta Pixel** | Prior consent | Yes |

In accordance with the Irish DPC requirements, no non-essential cookie is set or read before obtaining your prior, free, specific, informed and unambiguous consent.

Refusing non-essential cookies is as easy as accepting them.

**2.4 Consent management**

On your first visit, a consent management banner (CMP) allows you to accept, refuse or configure cookies by category.

You can modify your preferences at any time:

- Via the "Manage my cookies" link available at the bottom of each page of the site
- Via your browser settings (blocking or deleting cookies)

Blocking certain strictly necessary cookies may affect the proper functioning of the site.

**2.5 Transfers outside EEA**

Google Analytics and Meta Pixel cookies involve data transfers to the United States. These transfers are based on Standard Contractual Clauses (SCC) approved by the European Commission. For more information, see our Privacy Policy: section 1.6.

**2.6 Chat assistant (AI assistant)**

The site offers an automated chat assistant, expressly labelled as an "AI assistant" in line with the transparency obligations of the EU Artificial Intelligence Act: you are not talking to a human unless our team explicitly takes over. The messages you type are transmitted to our processor Anthropic (the AI model provider) to generate the reply, and retained by Datafirefly Limited for support and service-improvement purposes. Do not enter sensitive data in the chat. No decision producing legal effects concerning you is taken in an automated way. You can request a human at any time (the "Talk to a human" button or support@datafirefly.com). Any email address you leave in the chat is used only to get back to you (pre-contractual measures, Art. 6(1)(b) GDPR).

**2.7 Contact**

For any question regarding our use of cookies and trackers, please write to: privacy@datafirefly.com

**3. ELECTRONIC MARKETING POLICY**

Newsletter · Commercial emails · Email tracking: DATAFIREFLY LIMITED

Legal basis: GDPR (EU) 2016/679 · ePrivacy Regulations (Ireland) · DPC Guidance on direct electronic marketing

Sending tool: own email infrastructure, hosted in the EU

Contact: privacy@datafirefly.com

**3.1 Types of communications sent**

Datafirefly may send you the following electronic communications:

- Editorial newsletter: news, articles, resources and advice on digital marketing and AI
- Commercial communications: presentation of our services, modules, offers and training
- Invitations to webinars, demonstrations or events
- Follow-ups within an ongoing commercial relationship or initial request
- Transactional emails: order confirmation, delivery, invoicing, support
- Product notifications: module updates, maintenance alerts, SaaS changes

**3.2 Legal basis and consent**

**Communications subject to prior consent**

In accordance with the Irish ePrivacy Regulations and the guidance of the Data Protection Commission, sending commercial emails to natural persons (B2C) requires prior, free, specific, informed and unambiguous consent.

This consent is collected via a sign-up form with an un-pre-ticked checkbox, accompanied by a clear statement on the nature of the communications and the possibility to unsubscribe at any time.

**B2B communications: applicable framework**

Within professional (B2B) relationships, certain communications may be sent on the basis of legitimate interest or existing customer relationship, strictly within the limits provided by the ePrivacy regulations applicable in Ireland and DPC guidance.

In all cases, the right to object is systematically respected.

Datafirefly does not sell, lease or share any contact list with third parties for prospecting purposes.

**3.3 Sending tool**

DataFirefly's transactional emails are sent from its own email infrastructure, hosted within the European Union. DataFirefly uses no third-party email SaaS (nor any equivalent). Relevant technical sub-processors are listed in the sub-processor list.

**3.4 Email tracking**

Our emails may include measurement technologies to collect the following data:

- Open rate (open tracking pixel)
- Clicks on links within the email
- Bounce and unsubscribe rates

This data is used for internal statistical purposes and to improve our communications. It also contributes to our lead scoring system described in the Privacy Policy: section 1.9.

You can disable email tracking by configuring your email client to block loading of remote images.

This deactivation does not affect your ability to read and unsubscribe from our emails.

**3.5 Proof of consent**

Datafirefly keeps proof of consent for each subscriber to its newsletter or commercial communications, including:

- Date and time of registration
- Source of the form (page of origin)
- Exact wording accepted at the time of registration
- Registration IP address (subject to applicable ePrivacy rules)
- Double opt-in confirmation where applicable

**3.6 Right of objection and unsubscription**

You may unsubscribe at any time from our commercial communications:

- By clicking the unsubscribe link included in each commercial email
- By writing to: privacy@datafirefly.com

Your request is processed as soon as possible and at the latest within 10 business days. Unsubscription does not affect the receipt of transactional emails related to an ongoing contractual relationship (order confirmations, invoices, support).

**3.7 Retention period for marketing data**

| **Type of data** | **Duration** | **Legal basis** |
| --- | --- | --- |
| **Active newsletter subscriber data** | Until withdrawal of consent | Art. 7(3) GDPR |
| **Inactive subscriber data (no open/click)** | 3 years after last active engagement | DPC Guidance: ePrivacy |
| **Proof of marketing consent** | 3 years after end of commercial relationship | Art. 5(2) GDPR: accountability |
| **Sending history and aggregated statistics** | 3 years | Irish civil statute of limitations |
| **Email tracking logs (opens/clicks)** | 13 months rolling | EDPB guidance on cookies & trackers |

**3.8 Contact and complaint**

For any question relating to our electronic marketing practices or to exercise your rights:

Privacy email: privacy@datafirefly.com

Address: DATAFIREFLY LIMITED, 15A Main Street, Blackrock, Dublin, Ireland, A94T8P8

Competent supervisory authority: Data Protection Commission (DPC), www.dataprotection.ie

## Terms of service

The terms governing the DataFirefly Server-Side service are set out in a separate document: [Terms of Service](https://server-side.datafirefly.com/en/terms.html). Those terms alone govern this service.