What GDPR duties does an online store have regarding its customers' data?
A store processes personal data from the very first order: name, address, phone and buying habits. The GDPR and Spain's LOPDGDD 3/2018 set out what to do with them, and most of it is documentation.
Short answer
- Inform at collection time under article 13 of the GDPR: who you are, why you process the data and how long you keep it.
- The order relies on performance of the contract as its lawful basis; the newsletter needs separate consent.
- Sign a data processing agreement with the platform, the payment gateway and the shipping carrier.
- Keep the record of processing activities under article 30 and handle access, rectification and erasure requests.
- Report security breaches to the Spanish authority within 72 hours where there is risk to the individuals concerned.
Lawful basis by type of processing
Each processing activity needs its own basis
| Processing | Lawful basis | Retention |
|---|---|---|
| Order handling | Performance of the contract | For the duration of the relationship |
| Invoicing | Legal obligation | Tax and commercial retention periods |
| Newsletter | Consent | Until it is withdrawn |
| Fraud prevention | Legitimate interest | A justified, documented period |
Practical examples
- Example: the newsletter checkbox cannot be pre-ticked at checkout; consent must be an action by the customer.
- Example: a customer asks for erasure but has invoices from two years ago. The data is blocked and kept only because of the tax obligation.
- Example: the carrier receives name, address and phone. It is a processor and requires a contract.
Common mistakes
- Using order emails to send promotions without prior consent.
- Copying a privacy policy from another site, complete with another controller's details.
- Having no contract with the suppliers that access customer data.
- Storing card data in the store instead of leaving it with the payment gateway.
How 4shopy helps
- Card data never reaches the store: it is handled by the payment gateway.
- Newsletter opt-in is consent separate from the order, with the date recorded.
- Customer accounts allow exporting and deleting data without touching the database by hand.
- Hosting and infrastructure across the 4b2b ecosystem are located in the European Union.