You’ve seen visitor identification demoed. You want to try it. Your boss — CEO, MD, owner — wants seven answers before you spend anything. Here they are, in the same tone you would use walking into their office. This is non-legal-advice; a lawyer or DPO has the last word on wording.
1. ‘Is this legal in the EU?'
Yes — when it’s done at the company level, on first-party infrastructure, with an opt-out and a documented business reason. That business reason is called ‘legitimate interest’ and it’s the same lawful basis that permits standard B2B account intelligence in the EU today. No advertising cookies, no cross-site profiles, no data sold to third parties. Full breakdown at /gdpr.
2. ‘What exactly do we learn about people?'
Nothing personal. You learn that a company visited, which pages, how long. No name, no email, no phone number, no photo. If you want to talk to a specific human, you still have to find them on public sources like LinkedIn.
3. ‘Where is the data processed?'
On EU infrastructure in ISO-certified European data centres. No routine transfers to third countries. Sub-processors are listed publicly at /subprocessors so any change is visible before it happens.
4. ‘Do we sign a data-processing agreement?'
Yes. A standard DPA is available at /dpa. It maps to the EU Commission’s standard clauses where relevant. Redlines are possible for larger contracts.
5. ‘What happens if a visitor doesn’t want this?'
Any visitor can opt out via a self-serve mechanism at /opt-out. Standard browser controls (clearing site data) also remove the first-party identifier. There is no cross-site profile to opt out of — it doesn’t exist.
6. ‘Can we cancel and get our data out?'
Yes. Monthly cancellation. Standard export formats. Deletion on termination per DPA. There is no artificial lock-in and no multi-year commitment required to get a fair price.
7. ‘What’s the realistic upside — in one sentence?'
You see roughly the 20–40% of your business-hours website traffic that is currently invisible to you, and you get a short weekly list of the companies most likely worth 20 minutes of your salesperson’s time. That’s the whole promise. Not magic. Useful.
| Question | One-line answer |
|---|---|
| Legal in EU? | Yes, with LI + first-party + opt-out |
| What we learn | Company, not person |
| Data location | EU only |
| DPA? | Standard, downloadable |
| Opt-out? | Self-serve + browser controls |
| Exit? | Monthly cancel + export |
| Upside? | See the 20–40% currently invisible |
Non-legal-advice
This piece is written to help internal conversations, not to replace legal review. Wording for policies should be signed off by your DPO or counsel.
How to close the meeting in 30 seconds
‘Here is the one-page answer sheet. Two-week free trial, no credit card. If it doesn’t produce five real leads in the first two weeks, we uninstall. Worst case: we lose 30 minutes of setup. Best case: we finally see who’s already visiting.’ That’s usually enough.
- Related: [The compliance questions your CFO will ask](/blog/compliance-questions-your-cfo-will-ask-and-the-answers)
- Related: [Is website visitor identification GDPR-compliant?](/blog/is-website-visitor-identification-gdpr-compliant)
- Related: [Legitimate interest — Art. 6(1)(f) for B2B marketers](/blog/legitimate-interest-art-6-1-f-gdpr-b2b-marketers)
Published by
lead.box Team
More articles
See lead.box on your own traffic
Start free — no card, no sales call required. Or book a 20-minute walk-through if you want the guided tour.