The usual shop problems are cookies, emails and retention.
Shops collect a lot in a short time: an order, an address, a payment, a marketing preference, a tracking cookie. Customers and regulators tend to look first at the cookie banner, the privacy policy and what happens to data after the sale. Having those in order is what makes a shop look reliable.
Trackers start the trouble
Analytics, ad pixels and remarketing need the right consent set-up. The checklist covers what to check on product pages, checkout and thank-you pages.
Keep for tax, delete the rest
You must keep some order data for tax and legal reasons, but not everything forever. The retention guide separates the two, so deletion requests are easy to answer.
Order emails aren't marketing
An order confirmation and a promotional email follow different rules. The checkout notes show how to keep them apart and tell customers what you do with their data at the point of purchase.
Seven parts. One shop-ready baseline.
Each part stands on its own and also points to the next: the clauses name your tools, the checklists verify them, and the 30-day plan puts it all in order.
E-commerce-specific privacy policy clauses Ready to copy
Drop-in wording with fill-in placeholders, one block per topic.
- Order and customer account data
- Payment processing (Stripe, PayPal, etc.)
- Shipping and delivery information
- Marketing emails and abandoned cart messages
- Analytics, advertising pixels and remarketing
- Product reviews and customer content
- Retention of order history and customer accounts
Simple ROPA starter for a typical online shop
A pre-filled Record of Processing Activities. Edit, don't invent.
- Customer registration and account management
- Order processing and fulfilment
- Payment and invoicing
- Marketing and newsletters
- Analytics and advertising
- Customer support
- Returns and refunds
- Suggested legal bases, data categories, retention periods and recipient lists for each
Cookie & consent checklist for shops
What to set up, and where to look.
- Essential cookies (cart, checkout, login) vs. marketing cookies
- Recommended banner settings and text
- Common trackers used by shops
- Consent mode notes for advertising and analytics
- What to check on product pages, checkout and thank-you pages
Customer data & order retention guide
How long to keep what, and how to delete the rest.
- How long to keep order data, invoices and customer accounts
- When you can delete inactive accounts
- What to keep for tax or legal reasons
- A simple process for deletion and access requests from customers
Sub-processor & payment checklist
Know the tools that touch your customers' data.
- Common tools used by online shops: payments, shipping, email, analytics
- What to verify with each: DPA, location of data, transfer mechanisms
- Template email to request a DPA from a vendor
Checkout & forms compliance notes
Where customers hand over their data.
- What to include on order forms and contact forms
- Marketing consent vs. order confirmation emails
- Clear information about data use at the point of purchase
30-day action plan for an online shop
A short, prioritised list so the work actually gets done. See the plan below.
- Week by week, in the order customers notice
- Each week ends with something you can show a customer
Real wording, not a table of contents.
Two short excerpts from the pack. Highlighted fields are the parts you fill in for your own shop.
Marketing emails and abandoned cart messages
We send marketing emails, including reminders about items left in your basket, only if you have agreed to receive them. You can withdraw your consent at any time by using the unsubscribe link in any message or by writing to us, and we will stop. Order confirmations, delivery updates and other messages needed to complete your order are not marketing and are sent whether or not you subscribe.
We use [email provider] to send these messages. Questions can be sent to [privacy@yourshop.eu].
The full pack covers the alternative wording where national rules allow existing-customer marketing.
Order processing and fulfilment
| Purpose | Take, confirm, pack, ship and deliver customer orders |
|---|---|
| Legal basis | Art. 6(1)(b), performance of a contract |
| Data subjects | Customers and recipients of gifts |
| Categories | Name, email, phone, billing and delivery address, order contents |
| Recipients | Shop platform, payment provider, carrier, fulfilment partner |
| Retention | Order record: [statutory period], then delete |
Each of the seven activities also lists transfers and security measures.
These are shortened starting points. Your own policy and records must reflect what your shop actually does, and national rules on consent and retention vary. The pack shows you where to check.
From a basic template policy to a shop that handles data properly.
Prioritised for a small shop with no dedicated compliance person.
Policies first
- Update your privacy policy and cookie policy with shop-specific clauses
Fix the banner
- Review and adjust your cookie banner and consent settings
Record and check
- Create or update your ROPA
- Check your main sub-processors
Handle requests
- Set up a simple process for customer data requests
- Review retention
Who it's for, and who it isn't.
A good fit if you
- Run a shop on Shopify, WooCommerce or a similar platform
- Sell to customers in the EU or EEA
- Use standard tools: a payment provider, a carrier, an email platform, analytics
- Have no in-house privacy counsel
Not enough on its own if you
- Sell products where an order reveals health information (e.g. medical supplies)
- Run a marketplace with third-party sellers
- Need a signed, lawyer-reviewed contract; the pack is not legal advice
- Build shops for clients: see the Agency Compliance Pack
Seven parts. One payment.
Everything on this page, delivered together. Adapt it to your shop, publish your policies and answer the next customer question from the same documents.
- Shop privacy policy clauses
- ROPA starter with seven pre-filled activities
- Cookie & consent checklist
- Customer data & order retention guide
- Sub-processor & payment checklist
- Checkout & forms compliance notes
- 30-day action plan
Before you ask —
Who is the E-commerce Compliance Pack for?
Online shops on Shopify, WooCommerce and similar platforms that sell to customers in the EU and handle orders, payments and marketing.
What do I receive?
Seven parts: e-commerce privacy policy clauses, a pre-filled ROPA starter, a cookie and consent checklist, a customer data and order retention guide, a sub-processor and payment checklist, checkout and forms compliance notes and a 30-day action plan. You get your download page straight after checkout, with no account to create.
Does it work with Shopify and WooCommerce?
Yes. The pack is platform-neutral: the clauses, records and checklists describe what your shop does with customer data, whichever platform and plugins you use. Where a step depends on the platform, the checklist tells you what to look for in your settings.
How long do I have to keep order data?
It depends on the country: accounting and tax rules set minimum periods for invoices and order records, and these differ between EU member states. The retention guide explains how to separate what you must keep from what you can delete, and leaves the national period as a field for you to confirm.
Is this legal advice?
No. The pack is a practical starting point for online shops. The clauses and records are drafts you adapt to what your shop really does, and national rules vary. Have a qualified lawyer review anything you rely on.
What if it isn't what I expected?
Email hello@gdprgard.eu within 14 days for a full refund. No form to fill in.
Run a shop customers feel safe buying from.
Get the clauses, records, cookie checklist and retention guide in one pack and put your shop's data handling in order.
Get the Pack — €39