​
Ensuring Data Privacy & Security in User Behavior Tracking

This policy is in effect as of March, 2025, and serves as an official compliance guide to help clients implement GDPR-aligned usage of the Lucidworks Signals Beacon.

​
1. Introduction

The Lucidworks Signals Beacon is a lightweight tracking mechanism designed to collect anonymized user behavior data for search and merchandising optimization. To ensure full compliance with the General Data Protection Regulation (GDPR), Lucidworks adheres to strict data privacy, security, and user control policies. This document outlines the key measures taken by Lucidworks to ensure the Signals Beacon meets GDPR compliance standards.

​
2. GDPR Compliance Framework

Lucidworks Signals Beacon is built on the following core GDPR principles:

​
2.1 Lawfulness, Fairness, and Transparency

Legal Basis for Data Processing
  • Lucidworks ensures that clients can configure data collection to align with one of the lawful bases for processing under Article 6 of GDPR (e.g., legitimate interest, contract necessity, or user consent).
  • Customers remain in control of data collection configurations.
User Transparency
  • The Signals Beacon does not collect personally-identifiable information (PII).
  • Clients are encouraged to update their Privacy Policies to inform users about behavioral tracking, in compliance with Articles 12-14 (Transparency and Right to Information).

​
2.2 Data Minimization & Purpose Limitation

Only Necessary Data is Collected
  • The Signals Beacon collects only essential behavioral signals to improve search and merchandising performance.
  • The following event data is captured:
    • Search queries
    • Product clicks & facet interactions
    • Cart-adds & purchases
No Excessive or Unrelated Data
  • The Signals Beacon does not collect unnecessary metadata, personal details, or user-generated content.
Configurable Data Collection
  • Clients have the ability to enable/disable tracking for specific event types via configuration settings.

​
2.3 Anonymization & Data Protection by Design

No Personally-Identifiable Information (PII) Collection
  • The Signals Beacon never collects names, email addresses, account details, or device identifiers.
  • Anonymized session-based tracking ensures user privacy.
IP Address Anonymization
  • IP addresses are partially masked (removing the last octet) before storage, ensuring GDPR compliance under Recital 26.
  • No geolocation tracking beyond country or regional level.
Session-Based Tracking Instead of Persistent User IDs
  • Visitor interactions are tracked using an anonymous session identifier, which resets periodically.
  • No cross-session profiling or persistent identifiers.
No Third-Party Data Sharing
  • All captured data remains within Lucidworks’ secure environment and is never sold or shared with third parties.
  • Clients retain full ownership of their collected data.

​
2.4 Data Security & Integrity

Encrypted Data Transmission
  • All data collected by the Signals Beacon is transmitted using encryption to prevent unauthorized interception.
Secure Data Storage & Retention Policies
  • Raw event logs are stored securely for a maximum of 3 months (default retention period).
  • Aggregated insights can be stored longer, but no individual user data is retained beyond the retention period.
  • Clients can configure shorter retention periods based on their compliance requirements.
Access Control & Restricted Data Handling
  • Only authorized personnel within the client’s organization can access the data.
  • Lucidworks maintains strict role-based access control (RBAC) to prevent unauthorized access.

​
3. User Rights Under GDPR

The Signals Beacon ensures compliance with user rights under GDPR, including:

​
3.1 Right to Access (Article 15) & Right to Rectification (Article 16)

  • Since the Signals Beacon does not collect PII, users cannot be personally identified, reducing access requests.
  • Clients can export anonymized session-level data upon request for internal auditing.

​
3.2 Right to Erasure (Article 17)

  • Clients can have Lucidworks delete historical tracking data upon request.

​
3.3 Right to Object (Article 21) & Opt-Out Mechanisms

  • Lucidworks provides client-side opt-out mechanisms, allowing users to disable tracking via browser settings or site preferences.
  • The Signals Beacon respects Do Not Track (DNT) headers and similar consent signals.

​
4. Client Responsibilities for Compliance

While Lucidworks ensures GDPR compliance at the platform level, clients remain responsible for their implementation and user consent strategies. To maintain compliance, clients should:
  1. Update Privacy Policies
    • Clearly inform users about behavioral tracking.
    • Specify the purpose of data collection and retention periods.
  2. Implement Consent Management
    • Use a GDPR-compliant cookie banner to obtain user consent where required.
    • Offer opt-out options for tracking.
  3. Regularly Audit Data Collection Configurations
    • Ensure that tracking aligns with the principle of data minimization.
    • Adjust retention settings to match internal privacy policies.