To use Matomo Cloud GDPR compliant you have to follow these instructions:

Legal Basis

The use of Matomo Cloud does not require consent. It can be carried out on one of the other applicable legal bases of Art. 6 GDPR.

Data Transfer

The documents contained on https://matomo.org/matomo-cloud-dpa/ must be checked to ensure that all the criteria of Art. 28 GDPR are met and that the technical and organizational measures specified by the service provider represent protection appropriate to the risk.
The documents must be archived so that they can be proven to the supervisory authority if necessary.

Privacy Statement for the Service Matomo Cloud

Personal data is processed when you visit this website. data for creating usage statistics. analysis of user behavior. a legitimate interest that overrides the rights and freedoms of the data subject (Art. 6 (1) f GDPR). strong economic interest in the proper operation of the website. InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand (https://matomo.org/). The data is transmitted to New Zealand on the basis of Art. 45 GDPR in conjunction with the European Commission’s adequacy decision 2013/65/EU. is variable and ends when the processing purpose no longer applies.

Additional Information

In addition to the above information, the data protection information must also contain the mandatory information from Art. 13 or 14 GDPR: Name and contact details of the controller, if necessary the contact details of the data protection officer, the purposes for which the personal data are to be processed, the legitimate interests, if the processing is based on Article 6 (1) f GDPR, the duration of the processing, information on the rights of the data subjects including the right to lodge a complaint with a supervisory authority, the possibility of simply revoking consent given, and information as to whether the Provision of the data is required by law or contract or what the possible consequences of non-provision would be. In the event that the data is used for automated decision-making, including profiling, meaningful information about the logic involved and the scope and impact on the data subject must be provided. The processing of the data must also be documented in the list of processing activities in accordance with Art. 30 GDPR. The information required for this can already be found in the privacy statement, which can be created from the previous information.