Made in the European Union

European infrastructure, European accountability

IP Raccoon is built, operated and hosted in the European Union by a European company and a European team. Every lookup is processed and stored within the Union under the GDPR, with the documentation your compliance function will ask for - published, not on request.

Read the compliance detail Request a Data Processing Agreement

Data Protection Officer: support@ipraccoon.com · Lead supervisory authority: AEPD, Spain

Commitments

What European means here

Two commitments, each substantiated in the registers that follow.

Infrastructure inside the Union

Application, processing and storage are located within the European Union, in Amsterdam, the Netherlands. No replica, backup or failover of production data is held outside the Union.

A European company and a European team

IP Raccoon is a European company staffed by European employees. All personnel with access to production data are employed within the Union and work under EU labour and data protection law.

Lawful basis

An IP address is personal data

The Court of Justice of the European Union established in Breyer (C-582/14) that a dynamic IP address constitutes personal data where the party holding it has lawful means to identify the individual concerned. IP Raccoon therefore treats every submitted address as personal data and structures its obligations accordingly.

Our role: IP Raccoon acts as processor in respect of addresses submitted for assessment, on the documented instruction of the customer as controller, and as controller in respect of account, billing and support data.
Legal basis: Processing rests on legitimate interests under Article 6(1)(f) GDPR - fraud prevention and information security, as expressly recognised in Recitals 47 and 49. A balancing assessment is documented and available to customers on request.
Data minimisation: We process only what an assessment requires: the address submitted and the score returned. No end-user identifiers, session data or request context are collected, as Article 5(1)(c) requires, because they are never transmitted to us.
Automated decisions: IP Raccoon produces an assessment, not a decision. No automated decision with legal or similarly significant effect is taken on our infrastructure; Article 22 obligations attach to the customer's use of the score within its own process.

Residency

Data residency and security measures

The technical and organisational measures of Article 32, stated plainly enough to be verified.

Processing region: European Union - Amsterdam, Netherlands
Storage: Within the Union only. No replica, backup or failover held outside it.
In transit: TLS 1.3, HSTS preloaded, no plaintext fallback
At rest: AES-256, full-disk and per-column for account identifiers
Access: Named EU employees only, hardware-backed MFA, every access logged
Lookup retention: 30 days, then aggregated beyond re-identification
Account retention: Life of the contract, plus six years for statutory accounting records
International transfers: None for lookup data. No third-country processor in the request path.
Cookies: Strictly necessary storage on both sites (session, preferences, your cookie choice) plus, only once you accept the consent banner, Google Analytics - and Microsoft Clarity session recording behind a second, separate box. Full register on the Cookies Policy.
Breach notification: Supervisory authority within 72 hours; affected controllers without undue delay
Data Protection Officer: support@ipraccoon.com
Lead supervisory authority: Agencia Española de Protección de Datos (AEPD), Spain

Rights

Data subject rights

Data subjects may exercise the following rights at any time. Requests are acknowledged on receipt and answered within one month, as Article 12(3) requires.

Access: Obtain confirmation as to whether personal data is processed and a copy of it, with the information Article 15 requires.
Rectification: Have inaccurate personal data corrected and incomplete data completed without undue delay.
Erasure: Request deletion of personal data. Only data subject to a statutory retention obligation, such as accounting records, is withheld, and the ground is stated.
Restriction: Require that processing be limited while accuracy is contested or a legitimate interest is under review.
Portability: Receive the personal data you provided in a structured, commonly used, machine-readable format, or have it transmitted to another controller.
Objection: Object to processing founded on legitimate interests. Processing ceases unless compelling legitimate grounds are demonstrated, and those grounds are disclosed.
No automated decision: Not to be subject to a decision based solely on automated processing. IP Raccoon returns an assessment; no qualifying decision is taken on our infrastructure.
Complaint: Lodge a complaint with a supervisory authority - the AEPD in Spain, or the authority of your habitual residence or place of work.

Requests to support@ipraccoon.com. Identity verification may be requested where necessary; no fee applies.

Sub-processors

Everyone we let near your data, what they do with it and where they sit. Before we add anyone to this list we tell you first, and you can object.

Sub-processor	Purpose	Location	Transfer
LeaseWeb Netherlands B.V.	Hosting, compute and storage	Amsterdam, Netherlands	None - within the EU
Chargebee Europe B.V.	Subscription billing, checkout and invoicing. Card details are entered on the provider's own hosted page and never reach us; its payment gateway partners process the card itself	Amsterdam, Netherlands	Chargebee, Inc. (United States) and group support entities, under Standard Contractual Clauses
Google Ireland Limited	Website analytics (Google Analytics 4, loaded through Google Tag Manager) - gated behind the cookie consent banner; nothing is set until you accept	Dublin, Ireland	Google LLC (United States), under the EU–US Data Privacy Framework
Microsoft Ireland Operations Limited	Session recording on both sites (Microsoft Clarity) - replays of what happens on screen, tied in the dashboard to your account id and email. Its own consent box, separate from analytics; nothing is recorded until you accept	Dublin, Ireland	Microsoft Corporation (United States), under the EU–US Data Privacy Framework
Crisp IM SAS	Live chat on the website and in the dashboard. Loads with the page; a conversation, and its storage, only start if you open it	Nantes, France	None - within the EU
Functional Software, Inc. (Sentry)	Error and crash monitoring. Stores nothing in your browser; when something breaks it receives the technical details of the failure, including your IP address	United States	Standard Contractual Clauses

Outside the EU

CCPA, CPRA and US state privacy law

IP Raccoon is established in the European Union and serves customers subject to the California Consumer Privacy Act as amended by the CPRA, and to the comparable statutes now in force across other US states. A US state privacy addendum is available.

Our role: IP Raccoon acts as a service provider within the meaning of Cal. Civ. Code §1798.140(ag), processing personal information solely on the customer’s behalf and for the disclosed business purpose. A disclosure to a service provider under a compliant contract is neither a sale nor a share, so it triggers no opt-out obligation for the customer.
An IP is personal information here too: The CCPA enumerates an internet protocol address as personal information at §1798.140(v)(1)(A), where the GDPR reaches the same conclusion through Breyer. The obligations we already meet under the GDPR are therefore applied without modification to Californian data subjects.
We do not sell or share: IP Raccoon does not sell personal information and does not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. No opt-out mechanism is presented because none is applicable; where a customer requires one for its own processing, the addendum records that position.
Not precise geolocation: Sensitive personal information under the CPRA includes precise geolocation, defined at §1798.140(ae)(1)(C) as a location within a radius of 1,850 feet. IP-derived geolocation resolves to city level at best and therefore does not constitute precise geolocation.
What the CCPA does not ask for: The CCPA imposes no international data transfer restrictions comparable to Chapter V of the GDPR. The EU residency described above is therefore a commitment we make beyond what US state law requires, not a condition of compliance with it.

Documentation

Documentation and contact

Our Data Processing Agreement, sub-processor register, DPIA summary and security overview are available to customers and prospective customers on request.

External counsel engaged for a full GDPR assessment
Gap analysis and legal review of every processing activity
Data Protection Impact Assessment completed for IP scoring
In-house staff training, repeated annually
Record of Processing Activities maintained under Article 30
Identical retention, encryption and rights handling on every plan, free tier included

Contact our Data Protection Officer