Privacy policy
Last updated on 17 October 2026
This policy explains what personal data Cookiemark collects through its service and cookiemark.com, why, and what rights you have. It covers two groups of people: our customers and their teams, and the people who visit cookiemark.com.
Two roles
We play two different roles, and this policy is about the first one.
- We are the controller for the data of our customers and their teams, such as your account, your invoices and your mail with us. We decide why and how we use that data.
- We are a processor for the consent records of the visitors to our customers' websites. Each customer is the controller for those records. Our data processing agreement covers that role. If you visited a website that uses Cookiemark, the privacy policy of that website tells you how it handles your choice.
Who we are
Cookiemark, Hoofdveste 10, 3992 DG Houten, the Netherlands. Mail hello@cookiemark.com with any question about your data. Our Chamber of Commerce (KvK) number is 56308167.
What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Your email address, first and last name, and when you last signed in | To give you an account, send you sign-in links and show your colleagues who you are. | Contract |
| The address, subject and delivery status of each mail we send you | To help you when a sign-in link or an invitation does not arrive. | Legitimate interest: support |
| The email address and IP address of each request for a sign-in link | To stop anyone from flooding an address with sign-in mails. We allow 5 links per address and 15 per IP address in 15 minutes. | Legitimate interest: security |
| Your organisation, team, clients and invitations | To let you work together and give clients access to their own sites. | Contract |
| Your sites, settings, texts, cookie lists and scan reports | To run the service you signed up for. | Contract |
| When you connect Google: the email address of that Google account, a sealed access token, and the settings of the Tag Manager containers you check | To check and fix consent in your Tag Manager containers when you ask us to. We do not use it for anything else, and you can disconnect at any time. | Contract |
| A hash of a random value stored in a cookie in the browser you sign in from | To keep the Free plan at one site per person or organisation. Only our staff see it. | Legitimate interest |
| Billing details, such as your company name, address and VAT number | To take payment and send invoices that meet tax rules. | Contract and legal obligation |
| Your notification choices | To send you only the emails you want, such as scan results. | Contract |
| Emails you send us, and messages through the contact form or Support in the dashboard: your name, email address, company if you give it, and the page you sent it from | To answer you and keep the conversation together. | Legitimate interest |
Data from your Google account
When an owner or admin connects Google, we ask for access to Google Tag Manager only, plus the email address of the account. We use it to list your containers, check the consent settings of their tags, and prepare and publish a fix when you press the buttons for that in the dashboard. We never publish without that action. We do not sell this data, use it for advertising or to train AI models, and we do not show it to anyone outside your organisation. Disconnecting under Settings, Integrations revokes our access at Google and deletes the token straight away.
Cookiemark's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Visitors of cookiemark.com
We do not use analytics or advertising on cookiemark.com. We collect data from visitors in two places only.
- The sign-in and free scan forms use Cloudflare Turnstile to tell people from scripts. Turnstile processes your IP address and some details of your browser for that check.
- The free scan stores the address you scan, the report and a screenshot of the start page. To limit scans per person, we store a salted hash of your IP address, never the address itself.
Cookies on cookiemark.com
We only set cookies that the site needs to work, and we do not use analytics or advertising cookies. Our cookie policy lists each cookie, what it is for and how long it stays. Our fonts come from our own domain, without cookies.
Who we share data with
We use a small number of companies to run Cookiemark, such as our database host, our payment provider and our mail service. They only process data on our instructions. The list of subprocessors names each one, what it does and where. We do not sell personal data, and we do not share it for advertising.
Where your data is stored
Our database runs in the EU, in Ireland. Some of our providers are companies based outside the EU, or have offices there. Where data may leave the EU, we rely on the safeguards the GDPR allows, such as the EU standard contractual clauses.
How long we keep it
- Your account data, for as long as you have an account. When you delete it, we remove it within 30 days.
- Invoices and the data on them, for 7 years, because Dutch tax law requires it.
- Requests for sign-in links, for as long as we need them to stop abuse.
- The record of mails we sent, 90 days.
- Free scan reports, for as long as their link may still be shared, after which we delete them.
Your rights
You may ask us for a copy of your data, and ask us to correct or delete it. You may also object to how we use it, or ask us to limit its use. Most data you can see and change yourself in the dashboard. For anything else, mail us and we reply within a month.
If you think we handle your data wrongly, please tell us first. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
Security
You sign in without a password, with a link that works once. Access to customer data in our database is limited to the people in each organisation, enforced by the database itself. Our own admin area asks for a second factor on every sign-in.
Changes
When we change this policy, we update the date at the top. We tell you by email about changes that matter to you.