FAQ: General Data Protection Regulation (GDPR)

The EU General Data Protection Regulation (GDPR) has been in force since May 25, 2018. The aim of the GDPR is to harmonize data protection law within the European Union and to strengthen the protection of personal data. At Shopgate, the confidential handling and secure storage of customer data has always been a top priority – this applies equally to the data of our merchants and the data of end customers. That is why we have adapted our services to the requirements of the GDPR.

What does this mean for you as a Shopgate merchant? In the following FAQ, we have summarized all important points on GDPR compliance at Shopgate.

Does Shopgate have a data processing agreement?

Yes, Shopgate provides you with a comprehensive data processing agreement. Please follow this link.

Which technical measures does Shopgate implement under the GDPR?

• Cookie notices

• Unfortunately, the cookie notice cannot be customized individually. However, you can replace our standardized cookie notice with your own cookie notice (if you have one). To do so, please contact support@shopgate.com.

→ see also the guide Cookie opt-in

• Tracking opt-out

• Your end customers can deactivate all tracking providers for which Shopgate provides ready-made interfaces via an opt-out.  
• Your end customers can find the option to deactivate tracking under the privacy policy in the apps.
• This opt-out function does not apply to any external providers that you as a merchant have added using the "Tracking Codes" tool. For these, the respective provider's opt-out links must be listed in the privacy policy.

• Deletion of customer data

• Customer data can be deleted at any time. As a merchant, you can carry out the deletion in the Shopgate Admin; your end customers can request the deletion of their data in the apps.
  
  
• Your customers' deletion requests are collected in a table in the Shopgate Admin so that you can approve them for deletion. You can also add new requests via an input form. To do so, simply log in to your Shopgate Admin and go to Customers › Delete Customer Data.
  

• If your customers request the deletion of their data in the app, we will inform you by email so that you can delete this data both in your system and in your Shopgate Admin (see screenshot above).
• After approval, the data is deleted immediately and irrevocably.
• Orders continue to be displayed anonymized in our merchant area. This way, we can still provide you with the data for statistics.
• As a merchant, you are responsible for complying with all statutory deadlines under the GDPR. 

Is the tracking of your end customers anonymized at Shopgate?

• Shopgate tracking
  To continuously improve our service, Shopgate tracks only anonymous user data with Google Analytics. 
• Google Analytics via Shopgate
  We give our merchants the option to use Google Analytics. For this, Shopgate uses the IP anonymization function provided by Google, which ignores the last part of each user's IP address. This means that only anonymized data is collected.
• Other external tracking providers (Facebook, AppsFlyer, Econda, etracker, Facebook Pixel)
  Shopgate does not apply any special configuration to these external tracking services, but adopts the standard behavior of the respective provider. If the provider works in compliance with the GDPR, the data should be anonymized.
  If you have any questions about this, please contact the respective provider directly. 
• Shopgate "Tracking Codes" function
  With our "Tracking Codes" function, you as a merchant can add your own tracking scripts. In this case, you must make sure that the data collected is anonymized by the respective provider.

Does Shopgate have a template for a privacy policy?

No, Shopgate does not offer templates for privacy policies and unfortunately cannot provide legal advice. Your privacy policy should be reviewed on the basis of our data processing agreement and adjusted if necessary.

Do customers have to actively agree to the privacy policy during checkout? 

No, your customers do not have to actively agree to the privacy policy when they use the apps. This would only be necessary if agreeing also meant consenting to other hidden permissions (e.g. the sale of data). However, this type of hidden consent is not permitted under the GDPR.

Is customers' personal information stored in log files?

Yes, Shopgate also stores customers' personal information, such as name, email address and address, in log files. This is necessary to investigate possible technical problems (for example with order transfer). These log files are completely deleted after 2 months.