Measurement and observability
GDPR Matomo
In an indie stack, Matomo is used for Audience measurement, in the cloud or on your servers. Entity cited: InnoCraft Ltd, 7 Waterloo Quay, PO Box 625, 6140 Wellington, New Zealand. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 5, 2026. Verified on October 5, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Matomo
Yes for Matomo Cloud. Public DPA, part of the terms. No InnoCraft DPA for self-hosting: InnoCraft states that it does not process that data.
Stated role
For Matomo Cloud, the DPA states that the customer is controller and InnoCraft is processor. The FAQ states that, with self-hosting, InnoCraft does not process visitors' data and is not a processor: the customer's host may be.
Personal data
The Cloud DPA (version 3.0, 9 October 2025) lists, depending on the configuration, in particular the IP address (anonymized, hashed, or full), a location, the browser and the device, the pages visited, the referrer, a user identifier and, if the feature is enabled, a session recording. The full list is in the DPA.
Sub-processors of Matomo
Public list (stated last update: 9 October 2025): Amazon Web Services EMEA SARL (infrastructure and CDN), Oblivion Cloud Control B.V. (Netherlands), and Tideways GmbH (Germany).
Transfers outside the EU
Hosting / location
The sub-processor list places server, database, and log infrastructure at Amazon Web Services EMEA SARL, in Europe: Frankfurt, with backups in Dublin. The JavaScript CDN, optional, is also at AWS Europe, with EU traffic remaining in the EU. The Cloud Privacy Policy states that InnoCraft receives the data in New Zealand on the basis of an adequacy decision.
EU–United States Data Privacy Framework
Official search for “InnoCraft” and “Matomo” on the list: no participant. Not registered. The transfer to New Zealand is presented, in the Cloud Privacy Policy, as based on an adequacy decision. For sub-processors outside the EU, the same policy cites an adequacy decision or standard contractual clauses.
Cookies
Cookie names: not disclosed.
Typical use, written by StackLégal and not by the vendor: Audience measurement, in the cloud or on your servers.
History
Last update: October 5, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 5, 2026.
Frequently asked questions
Is Matomo a processor within the meaning of the GDPR?
For Matomo Cloud, the DPA states that the customer is controller and InnoCraft is processor. The FAQ states that, with self-hosting, InnoCraft does not process visitors' data and is not a processor: the customer's host may be.
What DPA does Matomo publish?
Yes for Matomo Cloud. Public DPA, part of the terms. No InnoCraft DPA for self-hosting: InnoCraft states that it does not process that data. https://matomo.org/matomo-cloud-dpa/
Which further sub-processors does Matomo publish?
Public list (stated last update: 9 October 2025): Amazon Web Services EMEA SARL (infrastructure and CDN), Oblivion Cloud Control B.V. (Netherlands), and Tideways GmbH (Germany). https://matomo.org/matomo-cloud-dpa/subprocessors/
Where does Matomo state that it processes data, including outside the EU?
The sub-processor list places server, database, and log infrastructure at Amazon Web Services EMEA SARL, in Europe: Frankfurt, with backups in Dublin. The JavaScript CDN, optional, is also at AWS Europe, with EU traffic remaining in the EU. The Cloud Privacy Policy states that InnoCraft receives the data in New Zealand on the basis of an adequacy decision.
Is Matomo registered under the EU–United States Data Privacy Framework?
Official search for “InnoCraft” and “Matomo” on the list: no participant. Not registered. The transfer to New Zealand is presented, in the Cloud Privacy Policy, as based on an adequacy decision. For sub-processors outside the EU, the same policy cites an adequacy decision or standard contractual clauses.
Which personal data does Matomo mention?
The Cloud DPA (version 3.0, 9 October 2025) lists, depending on the configuration, in particular the IP address (anonymized, hashed, or full), a location, the browser and the device, the pages visited, the referrer, a user identifier and, if the feature is enabled, a session recording. The full list is in the DPA.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.