GDPR checklist for e-commerce tools.
Providers like this process personal data on your behalf, so they belong in your records. Compare 23 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Shopify | Usually a processor | Set per account or project | Published by the vendor |
 BigCommerce | Usually a processor | Set per account or project | Published by the vendor |
 Shopware | Usually a processor | Set per account or project | Published by the vendor |
 Saleor | Usually a processor | Set per account or project | Published by the vendor |
 Swell | Usually a processor | Set per account or project | Published by the vendor |
 Foxy | Usually a processor | Set per account or project | Published by the vendor |
 EKM | Usually a processor | Set per account or project | Published by the vendor |
 Rebuy | Usually a processor | Set per account or project | Published by the vendor |
 GemPages | Usually a processor | Set per account or project | Published by the vendor |
 PageFly | Usually a processor | Set per account or project | Published by the vendor |
 Shogun | Usually a processor | Set per account or project | Published by the vendor |
 Zipify | Usually a processor | Set per account or project | Published by the vendor |
 LoyaltyLion | Usually a processor | Set per account or project | Published by the vendor |
 Referral Rock | Usually a processor | Set per account or project | Published by the vendor |
 Talkable | Usually a processor | Set per account or project | Published by the vendor |
 Referral Factory | Usually a processor | Set per account or project | Published by the vendor |
 Viral Loops | Usually a processor | Set per account or project | Published by the vendor |
 KickoffLabs | Usually a processor | Set per account or project | Published by the vendor |
 Loop Returns | Usually a processor | Set per account or project | Published by the vendor |
 AfterShip | Usually a processor | Set per account or project | Published by the vendor |
 Sendcloud | Usually a processor | Set per account or project | Published by the vendor |
 ShipBob | Usually a processor | Set per account or project | Published by the vendor |
 Bigblue | Usually a processor | Set per account or project | Published by the vendor |
What to check for e-commerce tools
- Confirm the region and any transfer outside the EEA.
- Keep the agreement text you accepted and its date.
- List the provider in your privacy policy and your processing register.
All e-commerce tools
- ShopifyE-commerce
- BigCommerceE-commerce
- ShopwareE-commerce
- SaleorE-commerce
- SwellE-commerce
- FoxyE-commerce
- EKME-commerce
- RebuyE-commerce
- GemPagesE-commerce
- PageFlyE-commerce
- ShogunE-commerce
- ZipifyE-commerce
- LoyaltyLionE-commerce
- Referral RockE-commerce
- TalkableE-commerce
- Referral FactoryE-commerce
- Viral LoopsE-commerce
- KickoffLabsE-commerce
- Loop ReturnsE-commerce
- AfterShipE-commerce
- SendcloudE-commerce
- ShipBobE-commerce
- BigblueE-commerce
Questions, answered.
What should I check before using an e-commerce tool under the GDPR?
Confirm the region and any transfer outside the EEA. Keep the agreement text you accepted and its date. List the provider in your privacy policy and your processing register.
Do I need a data processing agreement with an e-commerce provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which e-commerce tools does Privacyboard cover?
Shopify, BigCommerce, Shopware, Saleor, Swell, Foxy, EKM, Rebuy, GemPages, PageFly, Shogun, Zipify, LoyaltyLion, Referral Rock, Talkable, Referral Factory, Viral Loops, KickoffLabs, Loop Returns, AfterShip, Sendcloud, ShipBob, Bigblue. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.