GDPR and Data Privacy #
DMSI Analytics stores event data that includes IP addresses and customer IDs, which are personal data under GDPR. The plugin includes built-in GDPR compliance features.
Personal Data Stored #
| Data | Table | GDPR Relevance |
|---|---|---|
| IP address | analytics_events | Personal data in EU |
| Customer ID | analytics_events | Links to personal records |
| Event metadata | analytics_events | May contain personal data depending on event type |
Pre-calculated metrics (analytics_metrics) do not contain personal data; they are aggregate numbers.
WordPress Privacy Tools Integration #
DMSI Analytics integrates with WordPress’s built-in privacy tools (available at Tools > Export Personal Data and Tools > Erase Personal Data).
Personal Data Export #
When a WordPress admin exports personal data for a customer:
– DMSI Analytics adds a section to the export containing all event records linked to that customer’s ID
– Events include timestamps, event types, and metadata relevant to that customer
Personal Data Erasure #
When a WordPress admin processes a personal data erasure request:
– DMSI Analytics anonymizes (not deletes) the customer’s event records
– Anonymization: sets customer_id = NULL and ip_address = '0.0.0.0' in all events for that customer
– This preserves the aggregate analytics integrity (event counts remain, attribution is removed)
– The customer_anonymized event fires when DDLS Core processes the erasure, triggering this cleanup
Data Minimization #
DMSI Analytics only captures data that is fired via DDLS Core hooks. It does not independently gather personal data beyond what DDLS Core provides.
Retention Policy #
Configure event data retention in Analytics > Settings > Data & Maintenance. Shorter retention periods limit long-term personal data storage exposure.