BigCommerce

The default Stencil storefront sets SHOP_SESSION_TOKEN for the shopping session, SHOP_TOKEN for authenticated customers, fornax_anonymousId for cart attribution and PHPSESSID for the underlying PHP session. Optional analytics and marketing pixels (BigCommerce Analytics, Google Analytics, Meta Pixel, TikTok Pixel) are added when the merchant connects them through Channel Manager.

Cart, checkout and authentication cookies are strictly necessary and exempt under Article 5(3) ePrivacy. All BigCommerce Analytics, connected ad pixels and any third party script loaded through Scripts Manager require prior, freely given, specific, informed and unambiguous consent under GDPR and ePrivacy.

Cart and checkout cookies rely on Article 6(1)(b) GDPR (contract). Order management, fraud prevention and security rely on Article 6(1)(f) GDPR (legitimate interest). Analytics, marketing and personalisation cookies require Article 6(1)(a) GDPR consent. BigCommerce processes data as a processor under Article 28 GDPR.

Yes. BigCommerce Inc. is established in the US and processes data on Google Cloud Platform with US primary regions. The company self certifies under the EU US Data Privacy Framework, providing an adequacy basis. Standard Contractual Clauses are included in its DPA as an additional safeguard.

A small DTC store using only cart and checkout cookies usually does not need a DPIA. It becomes recommended for large stores, B2B portals processing big customer datasets, behavioural personalisation, multi channel retargeting or programmes combining loyalty, CRM and offline data.

Sign the BigCommerce DPA, document the US transfer, list every cookie in your cookie policy, connect a consent management platform that intercepts tags injected through Scripts Manager and Channel Manager, enable IP anonymisation for connected analytics, and surface BigCommerce data subject request tools to your customers.

EU based hosted ecommerce alternatives include Shopware (Germany), Lightspeed eCom (Netherlands and Canada), PrestaShop Cloud (France) and Centra (Sweden). Self hosted alternatives include WooCommerce, Magento Open Source, PrestaShop and Sylius. All require their own cookie audit.

Run a fresh cookie scan after each Channel Manager or Scripts Manager change, list each storefront cookie with name, purpose, duration and provider, document analytics and marketing pixels, link to BigCommerce, Google, Meta and TikTok privacy notices, and update the EEA transfer information whenever the regional setup changes.

A default Stencil storefront sets strictly necessary cookies for the session and the cart (SHOP_SESSION_TOKEN, CART_URL, fornax_anonymousId, XSRF-TOKEN), security cookies for bot mitigation (_abck, bm_sz) and, if enabled, BigCommerce Analytics cookies plus any third party cookies from channels such as Google Analytics 4, Meta Pixel, TikTok Pixel or Klaviyo.

Consent is not required for cart and checkout cookies that are strictly necessary to fulfil the order, which fall under the ePrivacy exemption. Consent is required for BigCommerce Analytics, marketing pixels and any optional A/B testing or personalization scripts before they are loaded, in line with Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive.

Order processing and account management rely on the performance of a contract under Article 6(1)(b) GDPR. Fraud prevention and platform security rely on legitimate interest under Article 6(1)(f) GDPR. Analytics, marketing pixels, personalization and re marketing rely on consent under Article 6(1)(a) GDPR collected through a consent management platform.

BigCommerce signs the EU Standard Contractual Clauses under Article 46(2)(c) GDPR with merchants via its Data Processing Addendum and confirms participation in the EU US Data Privacy Framework. Supplementary technical measures include TLS 1.3, encryption at rest, AWS regional isolation, PCI DSS Level 1 certification and SOC 2 Type II audits.

A DPIA is recommended when BigCommerce is used to systematically profile EU shoppers (advanced segmentation, behavioural triggers, abandoned cart automation), when the storefront serves regulated sectors (financial services, health, alcohol) or when sensitive data is collected at checkout. A DPIA is generally not necessary for a small storefront limited to standard order and contact data.

Sign the BigCommerce Data Processing Addendum, list BigCommerce in your record of processing activities, configure a consent management platform integrated with the storefront, gate BigCommerce Analytics and channel pixels behind that consent, document retention rules for orders and customer accounts, and use the BigCommerce GDPR endpoints to handle access, rectification and deletion requests.

European merchants often consider Shopify (CA, US data residency), Shopware (Germany), Sylius and Sulu (open source, EU hosting), PrestaShop (France) and headless options like commercetools (Germany) or Saleor (Poland). The right choice depends on hosting requirements, B2B features, total cost of ownership and the depth of channels integrations needed.

List BigCommerce Holdings Inc. as the processor of the storefront, describe the categories of cookies set by Stencil (functional, security, analytics, marketing), mention the United States hosting and the SCC plus DPF safeguards, link to the BigCommerce Privacy Notice and explain how to withdraw consent through your consent management platform.