Data Processing & Security

At CookieHub, we take data processing and security seriously. We understand that our customers rely on us to protect their sensitive information, and we are committed to maintaining the highest standards of data privacy and security. On this page, we’ll provide an overview of our data processing practices and the measures we take to keep your data safe.

Consent log

CookieHub does not collect or store any sensitive or personal information about your website’s end-users. If the consent log feature is enabled for your domain, we only collect and store the necessary data to demonstrate the user’s choices as required by GDPR article 7.1.

The consent log data is stored in a secure vault that is separate from other CookieHub services and has built-in safeguards to prevent unauthorized access. Additionally, consent log entries are automatically deleted after 12 months to ensure compliance with data retention policies.

Our objective is to avoid collecting any unnecessary information and maintain transparency regarding the data that we collect or process.

Below is a list of details and their purposes that are stored in the CookieHub consent log:

Cookies used by CookieHub

Depending on policy framework in use, CookieHub may use up to 3 cookies/local storage items to store user consent

cookiehub

To prevent the CookieHub widget from repeatedly appearing for the same user, the cookie choices must be stored in a first-party cookie within the user’s browser. The cookie is set to expire after one year by default but can be adjusted in the dashboard, the CookieHub tag in Google Tag Manager or by modifying the cpm variable in the inline HTML code.

Our aim is to store only necessary information and to be transparent about the data collected and processed. Detailed information about the CookieHub cookie structure and the purpose of each section can be found below.

To avoid issues caused by special characters that are not permitted in cookies, the cookie value is base64 encoded. The base64 encoded value will resemble the following:

eyJhbnN3ZXJlZCI6dHJ1ZSwicmV2aXNpb24iOjMsImRudCI6ZmFsc2UsImFsbG93U2FsZSI6dHJ1ZSwicmVnaW9uIjoiRzAiLCJ0b2tlbiI6IkVqN2FEb0dna2xLbVpUSEVZTWxQTE1Sc1pnOFVGY0hNZkNxblA4N1U3SWhKZnZhY25kTkYxMFlLUHRYcXIxclciLCJ0aW1lc3RhbXAiOiIyMDIyLTEyLTE3VDIzOjE3OjA1LjMxOFoiLCJhbGxBbGxvd2VkIjp0cnVlLCJjYXRlZ29yaWVzIjpbXSwidmVuZG9ycyI6W10sInNlcnZpY2VzIjpbXSwiaW1wbGljaXQiOmZhbHNlfQ==

Once decoded, the value will be structured as a JSON object, similar to this:

{
    "answered":true,
    "revision":3,
    "dnt":false,
    "allowSale":true,
    "region":"G0",
    "token":"Ej7aDoGgklKmZTHEYMlPLMRsZg8UFcHMfCqnP87U7IhJfvacndNF10YKPtXqr1rW",
    "timestamp":"2022-12-17T23:17:05.318Z",
    "allAllowed":true,
    "categories":[],
    "vendors":[],
    "services":[],
    "implicit":false
}

Below is a table that outlines the different properties of the JSON object used by CookieHub, along with their respective details and purposes:

cookiehub-ac

Used to store AC string (Google Additional Consent Mode) which contains a list of consented Google Ad Tech Providers that are not registered with IAB.

An AC string contains the following three components:

• Part 1: A specification version number, such as “1”
• Part 2: A separator symbol ”~”
• Part 3: A dot-separated list of user-consented Google Ad Tech Provider (ATP) IDs. Example: “1.35.41.101”

For example, the AC string 1~1.35.41.101 means that the user has consented to ATPs with IDs 1, 35, 41 and 101, and the string is created using the format defined in the v1.0 specification.

Google’s Additional Consent Mode technical specification 

euconsent-v2

Used to store TC string which contains the transparency and consent established for vendors on IAB’s Global Vendor List (GVL)

Transparency and Consent String with Global Vendor 

Security and Data Protection practices

CookieHub is committed to ensuring the highest levels of security and data protection in accordance with ISO 27001, GDPR, and PCI-DSS. Our robust security and management policies are designed to protect the data we store and process, and ensure business continuity.

We store all data in tier 3+ data centers in Europe that are ISO 27001 certified, secure by design, and redundant. Our servers are monitored 24/7, and we have automatic offsite backups in place. We also have policies for vulnerability and patch management, network access, and risk management.

We have built-in data protection safeguards in all our services, including our content delivery network (CDN), which is fully redundant and scalable, distributed across data centers worldwide.

We do not store, track, or process any personal information about end-users, and we anonymize IP addresses in log files to protect user privacy.

Data Processing Agreement (DPA)

In order to comply with GDPR regulations, data controllers are obligated to sign a data processing agreement with any parties that act as data processors on their behalf. A data processor, according to GDPR, is a third party that processes personal data on behalf of a data controller.

For customers with active paid subscriptions who require a signed DPA, we can provide one upon request. To receive a signed DPA, please contact us with your company name, registration number, address, and the primary email address associated with your account.

If you require a custom DPA, we can sign one upon approval by our legal team. Please note that this option is only available for customers with active enterprise subscriptions.

Download CookieHub DPA 

Server locations

CookieHub uses a robust infrastructure with multiple cloud hosting providers to ensure the secure storage and processing of data. The data centers are located in Germany, France, and the Netherlands, and all data is encrypted both in transit and at rest. Additionally, CookieHub never shares or sells data to third parties or transfers it outside of the EU and EEA.

The primary cloud provider used by CookieHub is Amazon AWS, which hosts the CookieHub dashboard (dash.cookiehub.com) and provides various core services. It also runs the primary content delivery network (CDN), which serves the CookieHub widget on customer websites. The CDN is distributed across various data centers around the world to minimize latency and ensure the CookieHub widget has minimal impact on website performance.

To provide an alternative content delivery network and consent log storage in data centers operated by a European service provider, CookieHub offers a Europe-only storage option. Customers can switch to this option in the CookieHub dashboard under the Settings tab. The cloud providers used for European storage are Scaleway SAS and BunnyWay d.o.o., with consent log data stored in the Netherlands and France.

Sub-processors

CookieHub has a globally distributed infrastructure, powered by top-tier cloud service providers. Here is a list of sub-processors that we collaborate with:

* Content delivery network (CDN) providers run a global network of servers.

** For customers who have opted-in to the EU-only network, consent log data will be stored with cloud hosting providers owned by EU entities.