If your online store is based in the EU (European Union) or your store targets shoppers in the EU, then GDPR applies to you. EU General Data Protection Regulation (GDPR) is an update to regulations for the processing of data and private information online. This will apply to online stores based in the European Union or those that do extensive business in Europe. GDPR places the responsibility on businesses to give individuals more control over their personal data. If your online store violates the regulations, you could face penalties. As an eCommerce platform, StoreHippo is compliant with GDPR and provides the various features that make it compliant. Now, there may be some requirements your business will need to take to make your store fully compliant.
CREATE A GDPR COMPLIANT PRIVACY POLICY
Privacy Policy page is one of the most important pages. This page ensures that you have a Privacy Policy page on your store and informs the users of how the data is processed, collected, stored, and used. Create a GDPR compliant privacy policy and ask the user to read while signing up.
EXPLICITLY ASK FOR CONSENT IN SIGN-UP
For account sign-up forms, you can include a required checkbox for a consent to your privacy policy as shown in the image above.
ENABLE BUILT-IN COOKIE CONSENT SETTINGS
Another most important thing is that none of the user's data should be taken without his consent. Cookie consent tracking will prompt your customers for their consent to use cookies and other technologies while shopping on your storefront.
CHECK YOUR APPS, PLUGINS AND INTEGRATIONS
There are certain plugins and apps that you use, collect the user’s email addresses without their consent which is against the GDPR rules. Any app that you use with your online business will also need to be compliant. In case of such plugins, make sure to add them to the list of "third parties" that get access to user data in your Privacy Policy, check or ask the plugin developers how they are going to implement GDPR compliance. If the app or integration does not explicitly say their product is compliant, you will have to reach out to the vendor directly to confirm if they meet GDPR requirements for compliance.
EXPLICITLY ASK FOR CONSENT TO MARKETING COMMUNICATIONS
GDPR generally requires that you obtain the prior affirmative consent of shoppers to send them marketing communications. You should request such consent in a separate checkbox, rather than include the request in your privacy policy or other terms. At checkout you can enable a checkbox to request specific consent from shoppers to receive your communications.
REPORT SECURITY BREACHES
Take steps to make sure your customers' data is secure, and if there's a breach, disclose it to the Supervisory Authority within 72 hours. For any change in the user’s data, such as a password or unauthorized login attempt, the user should be informed about that either via email or message.
