How does Usercentrics ensure from a legal point of view that it can be used as software to obtain the Consent?

According to art. 6 (1) (c) GDPR, data processing is lawful if it is necessary to fulfill a legal obligation to which the controller is subject.

Is implicit consent allowed by GDPR?

Implicit consent does not constitute a relevant legal basis within the meaning of Art. 6 I 1 a DSGVO, as consent must be in the form of a clear confirmatory act under Art. 4 No.11 DSGVO. With the ruling of the 01.10.19 (Az. C-673/17) "opt-ins" are required.

FAQ Legal & Privacy

Legal & Privacy

Where can I find the Usercentrics Terms & Conditions and Data Processing Agreement?

Under the following links you will find the Usercentrics Terms & Conditions and Data Processing Agreement.

Does the use of CDN transfer IP addresses to the USA?

In order to load the code of the Usercentrics CMP as quickly and reliably as possible for all your users, Usercentrics uses a CDN (Content Distribution Network). Based on the location of the website visitor, the next server is thus selected to load the corresponding files. Since a CDN has a global list of IP addresses, analysis tools such as Webkoll can accidentally mistake the server for an American one. Nevertheless, all servers which receive and process consents are located in the EU. Our API server is located in Frankfurt replace with a Consent database in Belgium.

Has Usercentrics concluded standard contract clauses with Google Cloud?

As a precautionary measure, we agreed on an EU standard contract (Processors 2010) with Google on October 19, 2019. Google updated its existing standard contractual clauses on September 24, 2021 to comply with European Commission Decision 2021/915 of June 04, 2021. We adopted these updated standard contractual clauses on 13 October 2021.

Is the access to CMP information by Google absolutely impossible?

The storage of consents and device data takes place exclusively in the European Union, namely in Frankfurt am Main (API server) and in Belgium (Consent database). We have contractually agreed these storage locations with our partner - Google Ireland Limited. Google LLC has no standard access to the stored data and is only technically involved in supporting the hosting services used by Google Ireland. These are: Hardware maintenance, CDN and server monitoring. For none of these services Google LLC US has access to CMP information from Usercentrics.

If I integrate the CMP via the Google Tag Manager, shouldn’t the GTM be categorised as “essential”?

Usercentrics cannot provide legal advice. That said, we can share our experience with this topic by stating that the Google Tag Manager can be categorized as Essential or Functional. It is especially important to note whether the Tag Manager is used to enforce the GDPR regulations or not. If, for example, if the Usercentrics CMP script is integrated via the GTM, you can consider it necessary to exercise the GDPR and thus classify it as Essential.

How can Usercentrics be noted in the privacy policy?

You can use the description of Usercentrics from our Privacy Information Center. You can find it in the Admin Interface under "View Preview" / "Show Info Modal".

How does the Usercentrics CMP prepare me for ePrivacy?

The ePrivacy regulation is designed to protect the security and confidentiality of electronic communications. The ePrivacy Regulation refers to the definition of user Consent in the GDPR regulatory framework. For this reason, the requirements for the validity of consent gathered in the ePrivacy Regulation are the same as in the GDPR. One thing is clear: If you use the Consent Management Platform from Usercentrics, you are fully prepared for the ePrivacy regulation. The ePrivacy Regulation takes precedence over the GDPR on a number of points, including cookies. However, as of April of 2020, the content of the ePrivacy Regulation has not yet been fully defined. Usercentrics follows the latest legal developments to ensure that its CMP is up to date with all current regulatory requirements.