What GDPR duties does an online store have?
A store owner is the controller for customers, subscribers and complainants. The most common error is not paperwork but consent: purchase and newsletter are two purposes and cannot share one checkbox.
Short answer
- Meet the art. 13 GDPR information duty when data is collected, not later.
- Publish a privacy policy stating purposes, legal bases, recipients and retention periods.
- Keep records of processing activities under art. 30 GDPR.
- Sign processor agreements with hosting, couriers, the payment provider and the mailing tool.
- Newsletter consent must be separate, freely given and never a condition of purchase.
Purposes and legal bases
Typical processing in a store
| Purpose | Basis | Note |
|---|---|---|
| Fulfilling an order | Contract performance | No consent needed |
| Invoicing and bookkeeping | Legal obligation | Retention follows tax law |
| Newsletter | Consent | Separate box, unticked by default |
| Analytics and marketing cookies | Consent | Set only after consent |
| Legal claims | Legitimate interest | Must be described in the policy |
Minimum implementation set
- A privacy policy and cookie notice reachable from every page.
- A consent banner that sets nothing beyond essential cookies before a click.
- A processing register updated whenever a new tool is added.
- Processor agreements with every vendor that sees customer data.
- A procedure for access, rectification, erasure and objection requests.
Common mistakes
- One checkbox bundling terms acceptance with marketing consent.
- A cookie banner that loads analytics before consent.
- No processor agreement with the courier or the mailing tool.
- Keeping accounts and orders indefinitely, with no defined retention period.
How 4shopy helps
- Marketing consent is a separate, unticked field, stored with date and wording.
- Data and backups stay in the European Union, shortening transfer paperwork.
- The customer account allows data export and deletion, covering typical GDPR requests.
- Analytics scripts fire only after banner consent.