\n<\/p>\n
Today, it is essential to properly configure your analytics solution to comply with the\u00a0GDPR\u00a0and the\u00a0ePrivacy Directive<\/a>, which together regulate the conditions of use of personal data and trackers on your various digital devices. If you fail to make your analytics solution compliant, you could face inspections by the authorities, restrictions on your data or even administrative and financial penalties. So, if you haven\u2019t already done so, it\u2019s time to get up to speed. Are you an AT Internet customer or about to become one? In this article, we present a step-by-step tutorial to guide you in making your\u00a0Analytics Suite<\/em>\u00a0compliant.\u00a0<\/p>\n \u00a0<\/p>\n Important<\/strong>: if necessary, please do not hesitate to contact\u00a0AT Internet\u2019s support team<\/a>, who will be able to help you with all your Privacy issues.\u00a0<\/p>\n \u00a0<\/p>\n This compliance<\/strong>, which aims to help you choose a configuration that is as close as possible to your needs, whether they are business or legal (GDPR), takes place in 4 stages:\u00a0<\/p>\n \u00a0<\/p>\n Firstly, AT Internet makes each data controller sign a Data Processing Agreement (or more commonly called a DPA). This is a personal data processing agreement, a central document that defines the obligations and responsibilities of each party.\u00a0<\/p>\n \u00a0<\/p>\n This formality complies with\u00a0Article 28 of the GDPR<\/a>\u00a0which states:\u00a0<\/p>\n \u201cProcessing by a processor shall be\u00a0<\/em>governed by a contract<\/em><\/strong>\u00a0or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.\u201d<\/em>\u00a0<\/p>\n \u00a0<\/p>\n The DPA we submit to our customers contains various information such as:\u00a0<\/p>\n \u00a0<\/p>\n Good to know<\/strong>: At\u00a0AT\u00a0Internet, we call an \u201corganisation\u201d a set of sites and users of our solution representing the functional structure of your company. If several of your legal entities are grouped together within the same \u201cAT Internet organisation\u201d, then the processing agreement applies to the entire organisation. Indeed, an organisation can only benefit from a single DPA.\u00a0<\/p>\n \u00a0<\/p>\n Nothing could be easier.\u00a0Send us an e-mail<\/a>\u00a0with the following subject and message:\u00a0<\/p>\n Subject<\/em>: Request for DPA\u00a0<\/p>\n Message<\/em>: Could you send us a DPA for my organisation?\u00a0<\/p>\n You can also contact our support department directly at:\u00a0support@atinternet.com<\/a>.\u00a0<\/p>\n Once you have received the DPA, please send it to your legal department for validation and return it to us signed at\u00a0dpo@atinternet.com<\/a>\u00a0to start the compliance procedure. Of course, we will then return the document to you countersigned.\u00a0<\/p>\n Please note<\/strong>: within the framework of a digital analytics project carried out with us, you may have to work with other parties such as A\/B testing tools, agencies, integrators, etc. For all of these parties, check whether the\u00a0GDPR<\/a> applies\u00a0to any processing. If necessary, also set up a DPA with these companies.\u00a0<\/p>\n \u00a0<\/p>\n This step in the process of making your\u00a0Analytics Suite<\/em>\u00a0compliant complies with\u00a0Article 5<\/a>\u00a0of the GDPR, which states that personal data must be \u201ckept in a way which allows data subjects to be identified for no longer than is necessary for the purposes for which they are processed\u201d.\u00a0<\/p>\n In other words, you need to determine a retention period for your analytics data based on the purposes exposed to the users of your various digital media.\u00a0<\/p>\n \u00a0<\/p>\n To comply with a limited retention period, you have two options:\u00a0<\/p>\n Important<\/strong>: If you have already signed a DPA, then the data retention period is already indicated within the document.\u00a0<\/p>\n \u00a0<\/p>\n This means that your personal data is automatically deleted over a sliding period defined by you (e.g. 13, 25, 37 months or more) and over all the sites of the same organisation.\u00a0<\/p>\n With\u00a0Analytics Suite<\/em>, the deletion applies to all analytics data, which is considered\u00a0personal data<\/a>\u00a0by default. Once the data deletion has been configured, no data will be accessible in\u00a0Analytics Suite<\/em>\u00a0beyond the X months.\u00a0<\/p>\n The opt-out is a means of opposition and a fundamental right for the Internet user (see article 21 of the GDPR<\/a>), which can be found on all your digital media (site, mobile application). It refers to a user\u2019s choice not to be tracked and is reflected at\u00a0AT\u00a0Internet by anonymous data collection.\u00a0<\/p>\n At\u00a0AT\u00a0Internet we rely on properties and cookies dedicated to visitor identification and user identification. If you use our tags, you must also use our opt-out tagging methods.\u00a0<\/p>\n \u00a0<\/p>\n Good to know<\/strong>: the hits collected in the opt-out mode are\u00a0anonymised\u00a0and used for the privacy analysis available in our Explorer tool. However, you can also prevent this from happening by using a specific tag.\u00a0<\/p>\n \u00a0<\/p>\n See\u00a0here\u00a0<\/a>for more information on how to configure the tags.\u00a0<\/p>\n To manage consent on your digital platforms, there are several scenarios you can choose from:\u00a0<\/p>\n In this scenario, consent is requested. By default, visitors are excluded from general traffic,\u00a0anonymised\u00a0and only visible in the privacy analysis under the category \u201copt-out\u201d. After consent (\u201copt-in\u201d), all data can be transmitted.\u00a0<\/p>\n Visitor identification cookies are deposited on the first page of the visit with an \u201copt-out\u201d value. Once consent is received, the cookie value will change to a unique value corresponding to the visitor\u2019s identification.\u00a0<\/p>\n Find out more\u00a0<\/a><\/p>\n With this method, consent is requested. Without consent, visitors are excluded from general traffic,\u00a0anonymised\u00a0and only visible in the privacy analysis under the \u201cno-consent\u201d category.\u00a0<\/p>\n Once consent is obtained, all data can be transmitted. The cookie(s) are deposited with a unique value corresponding to the identification of the visitor.\u00a0<\/p>\nHow does the compliance of your Analytics Suite<\/em> work?<\/h2>\n
\n
\n
\n
\n
Step 1: Sign a Data Processing Agreement (DPA)<\/strong>\u00a0<\/h2>\n
What does the AT Internet DPA contain?<\/strong><\/h3>\n
\n
How do I apply for a DPA with AT Internet?<\/strong>\u00a0<\/h3>\n
Step 2: Set up the retention period for your analytics data<\/strong>\u00a0<\/h2>\n
How do you define a limited retention period for your data?<\/strong>\u00a0<\/h3>\n
\n
What is the impact on your data?<\/strong>\u00a0<\/h3>\n
Step 3: Set up the opt-out on all your digital platforms<\/strong>\u00a0<\/h2>\n
Step 4: Choose your consent management scenario to suit your needs<\/strong>\u00a0<\/h2>\n
\n
Opt-out by default<\/strong>\u00a0<\/h3>\n
\u201cNo-consent\u201d by default<\/strong>\u00a0<\/h3>\n