GDPR-compliant link shortener & QR codes
Shorten links, track QR codes, build link-in-bio pages — and stay compliant while doing it. promolinks hosts in Frankfurt, includes the DPA as standard and counts clicks without cookies, with no detour via US servers.
10 short links free for life · no credit card
Why most link tools are a GDPR problem
Bitly, Linktree & co. host in the US. Every click on your short link transfers personal data — IP address, device, approximate location — to US servers. That's the core of the Schrems II problem. Often uncritical for private individuals, but a real risk for businesses, coaches and agencies: without a solid DPA and with data transfer to the US, the legal basis is quickly missing.
What “GDPR-compliant” actually means for link tracking
Six points that matter — and what they mean:
Hosting in the EU
Servers and data processing within the EU instead of the US. No third-country transfer, no Schrems II exposure.
Hosting in the EUDPA (data processing agreement)
A DPA is mandatory as soon as a provider processes data on your behalf — the case with any click tracking.
DPA (data processing agreement)IP anonymisation
The IP address is personal data. If it's hashed or never stored raw, the risk drops considerably.
IP anonymisationCookieless tracking
If a tool counts clicks without cookies, you don't need a consent banner for the measurement itself.
Cookieless trackingTTDSG (device access)
In Germany the TTDSG governs access to end devices — relevant as soon as cookies or similar techniques are involved.
TTDSG (device access)SSL/TLS encryption
Every short link and redirect should run encrypted — standard, but not a given everywhere.
SSL/TLS encryptionHow promolinks solves it
The technical foundation is built for compliance from the start:
- Hosted on Supabase in Frankfurt — your click and scan data stays in the EU.
- DPA included as standard in the GDPR documentation, without an enterprise surcharge.
- IP address hashed (HMAC-SHA256 with a server-side pepper) — the raw IP is never stored, and the country code comes from GeoIP without third parties.
- Cookieless click and scan measurement: count, device type, country, time — no cookies, no personal profiles.
- No custom-DPA paperwork like with US providers; custom agreements for agencies from Enterprise.
GDPR checklist for your short links & QR codes
A quick pass before your next campaign link:
- Does my link tool host in the EU?
- Do I have a DPA with the provider?
- Is the IP address anonymised or never stored raw?
- Does the tracking use cookies — and do I then have a consent banner?
- Does every redirect run over HTTPS?
- Are my target pages (landing, bio) themselves GDPR-compliant?
This page explains how promolinks is technically built for GDPR compliance — it is not legal advice. For your specific situation, consult a data protection expert; the binding details are in our privacy policy.
Common questions about GDPR & link tracking
Is click tracking GDPR-compliant at all?▼
Yes — as long as the basics are right: EU hosting, DPA, IP anonymisation and, if cookies are used, a consent banner. promolinks measures clicks cookielessly and doesn't store the raw IP (it's hashed), which makes the measurement itself much less critical.
Do I need a DPA for short links?▼
As soon as a service processes click data on your behalf, yes. With promolinks the DPA is a standard part of the GDPR documentation — no enterprise surcharge, no custom-DPA process.
Do I need a cookie banner for QR code tracking?▼
Not for the plain scan count at promolinks — it works without cookies. You only need a consent banner once you use cookies or pixels yourself (e.g. your own Facebook pixel) on the target page.
What is the Schrems II problem with Bitly & Linktree?▼
Both host in the US. With “Schrems II” the ECJ heavily restricted data transfers to the US. Without additional safeguards US tools often lack a legal basis — with EU hosting the problem disappears.
Is promolinks an alternative to Bitly and Linktree?▼
Yes. Short links, QR codes, link-in-bio and digital business cards in one tool — EU-hosted, GDPR-compliant, from €9.90 / month. The direct comparisons are linked below.
Start compliant with your links
10 short links free for life, EU-hosted, DPA included. No credit card, no trial.