Hosted request page

The hosted request page is the DSAR request form as a web page on CookieHub's own address. You turn it on for a website in the Dashboard, copy its link, and publish that link wherever data subjects should be able to find it: your privacy policy, a footer, an app, or an email. No code is added to your site.

It has the same fields as the DSAR widget and sends requests to the same place, so a request made on the hosted page looks exactly like one made through the widget: it is created as unverified, the data subject gets a verification email, and it appears in your requests list.

Turning it onCopy Anchor Link

The hosted page is off by default. Until you turn it on for a website, nobody can reach it. You can turn it on if you are an account owner or a DSAR handler, and the website needs to be covered by your DSAR add-on.

1. In the Dashboard, go to DSAR.
2. Click Publish form.
3. Select the website in Domain.
4. Under Hosted page, click Turn on hosted page.
5. Click Copy link.

If you choose a language in the same dialog, the copied link ends in ?lang= followed by that language code, so the page opens in that language.

Each website has its own hosted page and its own link. Turning one on does not affect the others.

The URLCopy Anchor Link

The link has this shape:

https://dash.cookiehub.com/dsar/form/0123456789abcdef0123456789abcdef

The last part is a random 32-character code created when you first turn the page on. It is not your website's domain key or account key, so the keys that appear in a widget embed code do not open the hosted page. Only the current code works.

Two things can end a link's life:

• Turn off switches the page off. Its link shows a "not found" page until you turn the page on again, and the same link works again.
• New link (old one stops working) replaces the code. Every copy of the old link shows "not found" straight away. Use this if the link was shared somewhere it should not have been.

The page also shows "not found" if the website is deleted or the account no longer has DSAR enabled.

LanguageCopy Anchor Link

The page opens in the language given by ?lang= in the link. Without it, it uses the language your visitor's browser prefers, and falls back to English. As with the widget, a regional code such as pt-br falls back to its base language, and then to English. The language is stored with the request and used for every email the data subject receives afterwards.

What the page does and does not doCopy Anchor Link

• The hosted page is meant to be opened as a page. It cannot be placed inside an <iframe>; link to it, or use the widget to show the form inside your own page.
• The widget records the visitor's consent ID from your website when there is one (see Consent token). The hosted page is on a different address from your website and does not carry a consent ID.
• The request's source is the hosted page's address. This is shown as the Source URL on the request.
• Opening the page is limited to 60 times a minute from one address.

Hosted page or widgetCopy Anchor Link

You can use both for the same website at the same time.

Next stepsCopy Anchor Link

• Install the widget if you want the form inside your own page
• Manage incoming requests
• Build your own form on the public widget API