E-commerce businesses process substantially more personal data than content websites — and that data serves more varied purposes across more processors. A privacy policy that works for a portfolio site will leave an online store legally exposed. This checklist maps every data category an e-commerce operation typically processes to its correct legal basis, retention period, and processor disclosure.
The Additional Data Categories in E-Commerce
A standard website typically processes contact form data, email addresses, and analytics. An e-commerce site additionally processes:
- Billing and shipping addresses — required to fulfil orders
- Payment card data (partial) — card type, last four digits, expiry (full card data never touches your server if using Stripe/PayPal)
- Order history — itemised records of every purchase
- Abandoned cart data — products added to cart but not purchased
- Product reviews and ratings — user-generated content linked to identity
- Loyalty points and rewards balances — if you operate a loyalty programme
- Returns and refund history — reason for return, condition, refund method
- Product search and browsing history — if stored (used for personalisation)
- Retargeting pixel data — cookie-based identifiers linking a browser to an ad profile
- Fraud signals — IP address, device fingerprint, transaction pattern data
- Customer service communications — support tickets, chat logs, complaint history
Each category requires its own entry in your privacy policy with a legal basis, retention period, and processor identification.
Legal Basis and Retention Mapping
| Data Type | Legal Basis | Retention Period | Primary Processor |
|---|---|---|---|
| Order fulfilment data (name, address, items ordered) | Contract performance (Art. 6(1)(b)) | 10 years (accounting law — varies by member state) | Shopify / WooCommerce |
| Payment card data (partial) | Contract performance (Art. 6(1)(b)) | Per PCI DSS: 1 year for truncated data; full card data never stored | Stripe / PayPal |
| Shipping and logistics data | Contract performance (Art. 6(1)(b)) | Duration of contract + 3 years for disputes | DHL, DPD, UPS, national postal services |
| Marketing emails (existing customers, similar products) | Legitimate interest (Recital 47 ePrivacy) or Consent | Until opt-out | Mailchimp, Klaviyo, Brevo |
| Marketing emails (new subscribers) | Consent (Art. 6(1)(a)) | Until consent withdrawn | Mailchimp, Klaviyo |
| Retargeting pixels (Meta, Google Ads) | Consent (Art. 6(1)(a)) | 90 days (standard cookie window) | Meta, Google |
| Fraud prevention data | Legitimate interest (Art. 6(1)(f)) | 3 years | Stripe Radar, internal |
| Product reviews | Consent (where user creates public profile) | Until deletion requested | Yotpo, Trustpilot, in-house |
| Loyalty programme data | Contract / Consent | Duration of membership + 1 year | In-house / LoyaltyLion |
| Returns and refund records | Legal obligation (consumer law) | 3–5 years | In-house / ERP |
| Customer service records | Legitimate interest | 3 years after last contact | Zendesk, Intercom, Freshdesk |
| Analytics / behavioural data | Consent (Art. 6(1)(a)) | As set in analytics platform (typically 14 months GA4 default) | Google Analytics |
Payment Data and PCI DSS
A common misconception is that because you use Stripe or PayPal, you have no payment data obligations. This is partially correct — full card numbers (PANs) are handled entirely within the payment processor's PCI DSS-compliant environment and never reach your server. However:
- You do process billing addresses, which are personal data requiring GDPR disclosure
- You retain transaction IDs and partial card details (last 4 digits, card type) for order records
- You are responsible for the security of your integration — an insecure checkout page can expose card data in transit even if you use a hosted payment page
Your privacy policy should:
- Name Stripe Payments Europe Ltd (or your payment processor) as a data processor for payment transactions
- Note that card numbers are processed directly by the payment processor and not stored by your systems
- Reference the processor's own privacy policy for how cardholder data is handled
- State the legal basis for billing address processing (contract performance)
Third-Country Transfers in E-Commerce
Most e-commerce stacks involve US-based processors. You must disclose and justify each non-EU transfer.
| Processor | Server Location | Transfer Mechanism |
|---|---|---|
| Shopify (unless EU store) | US and global CDN | SCCs + EU-US Data Privacy Framework |
| Google Analytics | US | EU-US Data Privacy Framework (Google LLC) |
| Mailchimp / Intuit | US | SCCs incorporated in DPA |
| PayPal (Europe) Ltd | Luxembourg → US infrastructure | SCCs |
| Klaviyo | US | SCCs |
| Meta (for pixel data) | US | EU-US Data Privacy Framework |
The EU–US Data Privacy Framework (DPF), approved by the European Commission in July 2023, replaced Privacy Shield as the adequacy mechanism for certified US companies. Before relying on the DPF, verify the vendor is currently certified at dataprivacyframework.gov.
Cookie Consent Interaction for E-Commerce
E-commerce sites have a more complex cookie consent architecture than content sites because some cookies serve transactional purposes (strictly necessary) while others serve marketing purposes (consent required).
Strictly necessary (no consent required):
- Session cookies maintaining cart state during an active browsing session
- Authentication cookies maintaining login
- Security tokens (CSRF)
- Payment session cookies during checkout (Stripe
__stripe_mid,__stripe_sid) - Consent preference cookies (storing the user's own cookie choices)
Consent required:
- Analytics cookies (GA4, Hotjar, Clarity)
- Retargeting cookies (Meta Pixel
_fbp, Google Ads_gcl_au) - Abandoned cart reminder cookies (if used for re-engagement emails or ads)
- Affiliate and referral tracking cookies
A common mistake is loading the Meta Pixel unconditionally on all pages, including the checkout. If a user has not consented to marketing cookies, the Pixel must not fire — including on order confirmation pages. Conversion data can be sent server-side (via the Meta Conversions API) conditioned on cookie consent, which avoids browser-side pixel fires while still capturing consented conversion events.
Right to Erasure vs Order Retention
This tension is one of the most frequently misunderstood issues in e-commerce GDPR compliance.
The customer's position: They have the right under Article 17 to request deletion of their personal data.
The business's position: Tax law in every EU member state requires retention of financial records — typically 7–10 years. In Germany: 10 years (§257 HGB). In France: 10 years (L123-22 Code de commerce). In Spain: 6 years. In the Netherlands: 7 years. In the UK: 6 years (HMRC).
The correct approach: You cannot delete order records that fall within the statutory retention window. You can — and must — delete everything else: marketing profile data, browsing history, loyalty data, support communications outside the retention window, saved payment methods, and account credentials. Where possible, anonymise retained order records by replacing identifiable fields with tokens, keeping the financial data without the customer's name or contact details.
Your privacy policy must explain this balance explicitly. A clause that simply says "we retain your data for 10 years" without explaining the legal obligation and the scope of what is retained will not satisfy the transparency requirements of Article 13.
Privacy Policy Structure for E-Commerce
A compliant e-commerce privacy policy should include all of the following sections:
- Who we are — controller identity, registered address, contact details
- What data we collect — comprehensive list by category (account, order, payment, behavioural, marketing)
- Why we collect it and on what legal basis — one entry per purpose, mapped to the correct Article 6 basis
- Who we share it with — all processors and controllers named, with sub-processor information
- International transfers — countries, mechanisms, links to processor certifications
- How long we keep it — specific retention periods per category
- Your rights — all eight GDPR rights with instructions on how to exercise each
- Cookies — summary with link to full cookie policy
- Children's data — age restriction statement and consent mechanism description
- Changes to this policy — how you will communicate updates
- How to complain — supervisory authority details for your country
Generate a complete, e-commerce-specific GDPR privacy policy with all required disclosures, correct legal bases, and processor listings at /gdpr-privacy-policy-generator.