Privacy
Recognising companies on your website and the GDPR.
Establishing which company visits your business website is allowed under the GDPR on the basis of legitimate interest, as long as you recognise companies and not people, and write nothing to the visitor's device. You do not need to show a cookie banner, but you do need to mention it in your privacy statement. Below is the paragraph you can use for that.
Is an IP address personal data?
Yes. The Court of Justice of the European Union decided that in 2016 in the Breyer case. That is why we treat the address of a connection as personal data: it is encrypted within a second and deleted within an hour, and it never leaves Europe.
On what legal basis is this allowed, then?
Legitimate interest, article 6(1)(f) of the GDPR. A company may know which other companies visit its business website, as long as that does not outweigh the visitor's interest. The Court of Justice confirmed in October 2024 that a commercial interest can be legitimate too; the Dutch supervisory authority had been stricter before.
Why is no consent or cookie banner needed?
Because the script writes and reads nothing on the visitor's device: no cookie, no storage, no fingerprint. The cookie rules are about exactly that, and that does not happen here.
What do I need to arrange myself?
Three things. Put the paragraph below in your privacy statement. Include swungby in your list of processors. And use what you see for what it is: a company that came by, not a person.
What is the difference with tools that identify people?
Those try to work out which person sat behind the screen, often through purchased profiles. That is not possible in Europe without consent, and the Dutch norm is clear: identifying people cannot and may not be done. We do not do it, even if it would yield more.
What if a company does not want to be recognised?
It arranges that itself, without an account and without emailing us, on the opt-out page. One button, works immediately, and what was already there is deleted.
Put this in your privacy statement
Our script stores nothing with your visitors, but the GDPR asks that you say what you do. You can copy this paragraph.
We use swungby to see which companies visit our website. For this, the IP address of your connection is compared with public registers of company networks and then encrypted immediately. Nothing is stored on your device and no individuals are identified. More at swungby.com/en/privacy.
Sources
- 1GDPR, article 6(1)(f) (legitimate interest)
- 2Court of Justice of the EU, case C-582/14 (Breyer), 19 October 2016
- 3Court of Justice of the EU, case C-621/22 (KNLTB), 4 October 2024
- 4Our privacy text: exactly what we record and for how long
This is an explanation with sources, not legal advice. If you are unsure about your situation, ask your own lawyer.
Updated on 6 September 2026
Within five minutes you see who came by.
One line on your site, and the first companies usually show up the same day.