GDPR-compliant visitor identification: the 5 rules
1. Company level only
Identification resolves the organisation behind a visit through network and IP-to-company matching. Individual people are never identified, and a visit that cannot be matched to a company stays anonymous.
2. Legal basis: legitimate interest, Art. 6(1)(f) GDPR
Company-level identification is commonly based on legitimate interest under Art. 6(1)(f) GDPR, documented with a balancing test. Consent is not required where no personal identifiers are processed; the final assessment stays with you as the controller.
3. No personal identifiers
No names, personal e-mail addresses, device fingerprints or cross-site profiles are created. Raw network addresses are not available in the interface, exports or API — only the resolved company is stored.
4. EU data processing
Personal and visitor data concerning the EU is processed in ISO-certified data centres in the European Union. EU visitor data is not moved outside the EU for this purpose.
5. Transparency and opt-out
Disclose the identification in your privacy policy — a copy-ready paragraph is on this page. Every visitor can object at any time through the public opt-out page. Opt-out page.
lead.box applies all five rules by design.
الركائز
المصلحة المشروعة بعبارات واضحة
نعالج بيانات على مستوى الشركة، أي شخص اعتباري لا طبيعي. وبمفهوم المادة 6(1)(و) من الـ GDPR تستند هذه المعالجة إلى المصلحة المشروعة، واختبار الموازنة الموثَّق يرجّح النشاط التجاري. تستخدم الأداة معرّفًا وظيفيًا من الطرف الأول على نطاقك أنت.
المادة 6(1)(و) — المصلحة المشروعة
تحديد شركات B2B لخدمة خط أنابيب المبيعات لمالك الموقع، مع اختبار موازنة موثَّق.
معرّف وظيفي من الطرف الأول فقط
لا تُضبط على نطاقك سوى كِنية وظيفية من الطرف الأول — بلا ملفات إعلانية أو عبر المواقع.
لا بيانات شخصية للزائر
نحدد مؤسسات لا أفرادًا. المعرّفات الشخصية خارج نطاق المنتج.
نص جاهز لسياسة الخصوصية
أدرج هذا النص في سياسة الخصوصية الخاصة بك؛ فهو يصف بدقة ما يفعله lead.box على موقعك.
This website uses lead.box (operated by lead.box LLC) to identify visiting organisations on the level of the company. For that purpose the tracker sets a first-party functional identifier (e.g. a device-scoped ID stored on this website’s domain) and processes technical connection data (in particular the IP address) transiently to resolve the visiting organisation. No advertising cookies and no cross-site cookies are used, no personal profile is created and no cross-site tracking takes place. Processing is based on Art. 6(1)(f) GDPR (legitimate interest of the site operator in B2B lead identification). All processing takes place on EU infrastructure inside ISO 27001-certified European data centers. You can opt out at any time at https://lead.box/opt-out.
مستندات ذات صلة
كل ما قد يطلبه فريقك القانوني أو مسؤول حماية البيانات، بنقرة واحدة.
Frequently asked questions
The compliance questions we hear most often — answered without legalese.
It is workable under the GDPR when it stays at company level. Identification resolves the organisation behind a visit through network and IP-to-company matching; individual people are never identified, and a visit that cannot be matched to a company stays anonymous. lead.box applies all five rules by design, and publishes a DPA and a sub-processor list for review.
Legitimate interest under Art. 6(1)(f) GDPR, documented with a balancing test: a legitimate purpose, necessity, and a weighing of interests. Consent is not required where no personal identifiers are processed. The final assessment stays with you as the controller; lead.box acts as processor under a DPA.
No personal identifiers are processed, so no advertising consent category is involved: there are no names, personal e-mail addresses, device fingerprints or cross-site profiles, and raw network addresses are not available in the interface, exports or API. Whether you still place the snippet behind a consent category is your own assessment — lead.box does not gate itself.
In the European Union. Personal and visitor data concerning the EU is processed in ISO-certified data centres in the EU, and EU visitor data is not moved outside the EU for this purpose. The DPA under Art. 28 GDPR and the versioned sub-processor list are published, so a data protection review is possible before you commit.
Through the public opt-out page, at any time — and companies can additionally request a company-level opt-out. Transparency is the other half of this rule: disclose the identification in your privacy policy, for which a copy-ready paragraph is provided on this page.
No, deliberately not. lead.box shows you which companies visit your website — name, industry, size and the pages they viewed. It never tells you which person was on the site. Visitors from home offices or mobile networks stay anonymous, because their connection cannot honestly be matched to a company. That limit is a feature, not a gap: it is what keeps company-level identification GDPR-friendly.
Yes. Every customer can sign our DPA digitally in a few minutes — no email back-and-forth. The full list of sub-processors is published openly and versioned, so you always know which providers are involved in processing. Both documents are available before you buy, so legal review can happen during your free trial.
You add one small snippet to your site, served first-party via your own domain. It records page visits; the company behind a visit is resolved server-side by lead.box. It is not an advertising tracker — no cross-site profiles and no person-level identifiers are created. Installation works the same way for classic websites and single-page apps.
The network address is used to resolve the organisation and the connection type; the visit record keeps that result, not the raw value, and raw addresses are not available in the interface, exports or API. Retention windows for visit history are set out in the DPA, which is public and signable before you buy.
Because identification stops at the organisation, there is no person-level profile to hand over or erase. Company records can be removed from your workspace, workspace-wide deletion requests run through the contact channels named in the DPA, and any visitor can object through the public opt-out page.
ابنِ خط أنابيب يوافق عليه مسؤول حماية البيانات
ابدأ مجانًا أو اطلب عرضًا توضيحيًا يُخصَّص فيه النص أعلاه لموقعك.