Measurement and observability
GDPR Hotjar
In an indie stack, Hotjar is used for Heatmaps, session recordings, and surveys. Entity cited: For a Hotjar order form (Ask, Observe or Engage), the entities table indicates Content Square SAS, 7 rue de Madrid, 75008 Paris, if the customer is not domiciled in the Americas, and Content Square, Inc., 60 Hudson St, New York, NY 10013, for the Americas (except Cuba).. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 5, 2026. Verified on October 5, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Hotjar
Yes. Contentsquare Data Processing Agreement, published on the Hotjar site and incorporated into the contract.
Stated role
The DPA published on hotjar.com provides, for the purposes in Annex 1, that the customer is controller and Contentsquare is processor. It also provides for the processor-to-processor module. Contentsquare may also process data as controller, according to the services policy cited by the DPA.
Personal data
The CSQ Experience Platform annex cites, depending on use: IP addresses (website), identifiers, names, emails, behavior data (movements, clicks, scrolling), technical data (pages, system, browser, referring URL, geolocation down to the city) and, if the customer enables it, additional data entered in the service. The stated default retention is 13 months after collection, unless agreed in writing.
Sub-processors of Hotjar
The DPA points the list to the Contentsquare privacy center. The named table is not copied here.
Transfers outside the EU
Hosting / location
The DPA does not set a single country: it refers the location of processing and storage to the sub-processor list. For transfers outside the EEA, it incorporates the standard contractual clauses, French law, French courts.
EU–United States Data Privacy Framework
The DPA defines the Data Privacy Framework as a possible mechanism and uses the standard contractual clauses for transfers from the EEA. Registration of Content Square SAS or of Content Square, Inc. on the official list, read on 5 October 2026: not disclosed.
Cookies
The help article “Cookies Set by the Hotjar Tracking Code” names, on the customer's site, _hjSessionUser_{site_id} (cookie, 365 days, Hotjar identifier specific to that site) and _hjSession_{site_id} (cookie, 30 minutes, session). The page lists others. Hotjar states that it does not track a user from one site to another via _hjSessionUser.
Typical use, written by StackLégal and not by the vendor: Heatmaps, session recordings, and surveys.
History
Last update: October 5, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 5, 2026.
Frequently asked questions
Is Hotjar a processor within the meaning of the GDPR?
The DPA published on hotjar.com provides, for the purposes in Annex 1, that the customer is controller and Contentsquare is processor. It also provides for the processor-to-processor module. Contentsquare may also process data as controller, according to the services policy cited by the DPA.
What DPA does Hotjar publish?
Yes. Contentsquare Data Processing Agreement, published on the Hotjar site and incorporated into the contract. https://www.hotjar.com/legal/support/dpa/
Which further sub-processors does Hotjar publish?
The DPA points the list to the Contentsquare privacy center. The named table is not copied here. https://contentsquare.com/privacy-center/subprocessors/
Where does Hotjar state that it processes data, including outside the EU?
The DPA does not set a single country: it refers the location of processing and storage to the sub-processor list. For transfers outside the EEA, it incorporates the standard contractual clauses, French law, French courts.
Is Hotjar registered under the EU–United States Data Privacy Framework?
The DPA defines the Data Privacy Framework as a possible mechanism and uses the standard contractual clauses for transfers from the EEA. Registration of Content Square SAS or of Content Square, Inc. on the official list, read on 5 October 2026: not disclosed.
Which personal data does Hotjar mention?
The CSQ Experience Platform annex cites, depending on use: IP addresses (website), identifiers, names, emails, behavior data (movements, clicks, scrolling), technical data (pages, system, browser, referring URL, geolocation down to the city) and, if the customer enables it, additional data entered in the service. The stated default retention is 13 months after collection, unless agreed in writing.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.