Data Processing & Security

At CookieHub, we take data processing and security seriously. We are committed to maintaining high standards of data protection and operational security in line with GDPR and ISO/IEC 27001 principles.

This page provides an overview of our data processing practices and security measures.

Consent log

CookieHub does not intentionally collect directly identifiable personal information about your website’s end-users.

If the consent log feature is enabled for your domain, we collect and store only the pseudonymous and technical data necessary to demonstrate a user’s consent choices in accordance with GDPR Article 7(1).

Consent log entries are automatically deleted after 12 months.

The consent log stores the following information:

Cookies used by CookieHub

Depending on configuration, CookieHub may use up to three cookies or local storage items:

cookiehub

To prevent the CookieHub widget from repeatedly appearing for the same user, the cookie choices must be stored in a first-party cookie within the user’s browser. The cookie is set to expire after one year by default but can be adjusted in the dashboard, the CookieHub tag in Google Tag Manager or by modifying the cpm variable in the inline HTML code.

The cookie name and whether the Secure attribute is added can also be configured in the Consent storage section of your domain settings. The Secure attribute is not added by default.

Our aim is to store only necessary information and to be transparent about the data collected and processed. Detailed information about the CookieHub cookie structure and the purpose of each section can be found below.

To avoid issues caused by special characters that are not permitted in cookies, the cookie value is base64 encoded. The base64 encoded value will resemble the following:

eyJhbnN3ZXJlZCI6dHJ1ZSwicmV2aXNpb24iOjMsImRudCI6ZmFsc2UsImFsbG93U2FsZSI6dHJ1ZSwicmVnaW9uIjoiRzAiLCJ0b2tlbiI6IkVqN2FEb0dna2xLbVpUSEVZTWxQTE1Sc1pnOFVGY0hNZkNxblA4N1U3SWhKZnZhY25kTkYxMFlLUHRYcXIxclciLCJ0aW1lc3RhbXAiOiIyMDIyLTEyLTE3VDIzOjE3OjA1LjMxOFoiLCJhbGxBbGxvd2VkIjp0cnVlLCJjYXRlZ29yaWVzIjpbXSwidmVuZG9ycyI6W10sInNlcnZpY2VzIjpbXSwiaW1wbGljaXQiOmZhbHNlfQ==

Once decoded, the value will be structured as a JSON object, similar to this:

{
    "answered":true,
    "revision":3,
    "dnt":false,
    "allowSale":true,
    "region":"G0",
    "token":"Ej7aDoGgklKmZTHEYMlPLMRsZg8UFcHMfCqnP87U7IhJfvacndNF10YKPtXqr1rW",
    "timestamp":"2022-12-17T23:17:05.318Z",
    "allAllowed":true,
    "categories":[],
    "vendors":[],
    "services":[],
    "implicit":false
}

Below is a table that outlines the different properties of the JSON object used by CookieHub, along with their respective details and purposes:

cookiehub-ac

Used to store AC string (Google Additional Consent Mode) which contains a list of consented Google Ad Tech Providers that are not registered with IAB.

An AC string contains the following three components:

• Part 1: A specification version number, such as “1”
• Part 2: A separator symbol ”~”
• Part 3: A dot-separated list of user-consented Google Ad Tech Provider (ATP) IDs. Example: “1.35.41.101”

For example, the AC string 1~1.35.41.101 means that the user has consented to ATPs with IDs 1, 35, 41 and 101, and the string is created using the format defined in the v1.0 specification.

Google’s Additional Consent Mode technical specification 

euconsent-v2

Used to store TC string which contains the transparency and consent established for vendors on IAB’s Global Vendor List (GVL)

Transparency and Consent String with Global Vendor 

Personal data processed

CookieHub processes personal data on behalf of its customers in order to provide and operate the consent management platform. This includes recording and storing user consent signals, managing customer accounts and configured services, delivering service-related communications and providing customer support.

The categories of data subjects and personal data are set out in Annex 1 of the DPA:

No special categories of personal data are intentionally processed. Customers are responsible for ensuring that special category data is not transmitted to the Service unless lawful and appropriate safeguards are in place.

Personal data is retained for the duration of the Service Agreement and in accordance with documented retention settings, including standard retention of consent logs for up to one year.

Security and Data Protection practices

CookieHub implements appropriate technical and organisational measures in accordance with Article 32 GDPR.

Our security practices are aligned with generally recognised information security standards, including ISO/IEC 27001 principles, and are applied uniformly across all customers. They include:

• Encryption in transit (TLS)
• Encryption at rest where applicable
• Role-based access control
• Infrastructure monitoring
• Patch and vulnerability management
• Segregated environments
• Redundant hosting architecture

Primary application data, consent log data and encrypted backups are processed and stored within the EEA.

No customer-specific security controls or certifications are provided unless expressly agreed in writing.

International Transfers

Some service providers operate outside the European Economic Area. Where personal data is transferred outside the EEA, appropriate safeguards under Chapter V GDPR, including Standard Contractual Clauses where applicable, are implemented.

Data Processing Agreement (DPA)

CookieHub acts as a data processor for customer data processed through the Service. The customer is the data controller.

Our Data Processing Agreement (DPA) is entered into pursuant to Article 28 GDPR and forms part of the Terms and Conditions or other service agreement between CookieHub and the customer. The current version is effective from April 1, 2026.

The DPA is accepted as part of the Terms of Service and does not require signature. This copy is provided for your records. Enterprise customers may request a signed or customised DPA subject to approval.

Download CookieHub DPA (April 2026)

Under the DPA, CookieHub commits to:

• Process personal data only in accordance with the customer’s documented instructions, unless required to do otherwise by applicable law
• Ensure that persons authorised to process personal data are subject to binding confidentiality obligations
• Implement appropriate technical and organisational measures in accordance with Article 32 GDPR
• Maintain an up-to-date list of sub-processors, including their country of location, and ensure they are bound by data protection obligations no less protective than those in the DPA
• Provide reasonable assistance so that the customer can respond to data subject requests and comply with Articles 32–36 GDPR
• Notify the customer without undue delay after becoming aware of a personal data breach affecting the customer’s data
• Make available all information reasonably necessary to demonstrate compliance with the DPA and Article 28 GDPR
• Delete or return personal data upon termination of the Service Agreement, subject to technical constraints, backup retention cycles and legal obligations

Server locations

CookieHub uses cloud infrastructure providers with data centres located in Germany, France and the Netherlands. Content delivery and network protection services operate globally to ensure performance and availability.

Sub-processors

CookieHub engages trusted third-party service providers to support its Services. The customer grants CookieHub general authorisation to engage sub-processors for the provision of the Service.

The approved sub-processors are listed in Annex 2 of the DPA:

The table reproduces Annex 2 of the DPA, which lists the providers and regions CookieHub is authorised to use. Personal data is currently stored only in the regions listed under Server locations above.

Where sub-processors are located outside the EEA, transfers are subject to appropriate safeguards under Chapter V GDPR, including Standard Contractual Clauses where applicable.