BigCommerce B2B Edition

What BigCommerce B2B Edition delivers

BigCommerce B2B Edition is the wholesale tier of the BigCommerce hosted commerce platform. It layers a B2B specific feature set, customer specific price lists, multi-level account hierarchies, quote management, sales rep dashboards and a self service buyer portal, on top of the standard BigCommerce storefront. The platform is delivered as software as a service: BigCommerce, Inc. operates the application, the database and the storefront CDN, while the merchant retains control over catalog, branding and the buyer experience. All storefront traffic, admin sessions and API calls terminate on BigCommerce infrastructure hosted on Google Cloud Platform in the United States.

Data and cookies set by the storefront

The storefront writes several first party cookies: SHOP_SESSION_TOKEN to maintain the shopping cart, fornax_anonymousId to identify the visitor across pages, CART_URL for cart recovery, XSRF-TOKEN for CSRF protection and an authentication cookie for logged in buyers. These cookies are strictly necessary for the contract performance covered by Article 6(1)(b) GDPR. In parallel the merchant may enable analytics (Google Analytics, BigCommerce Insights), marketing pixels (Meta, TikTok, LinkedIn) and personalisation engines, each of which sets its own cookies and requires prior consent under ePrivacy Article 5(3).

GDPR and ePrivacy implications

BigCommerce, Inc. acts as a data processor for the merchant under Article 28 GDPR. The Data Processing Addendum (DPA) bundled with the platform contract reflects the processor obligations and lists sub processors. Strictly necessary commerce cookies (session, cart, authentication) do not require consent because they are essential to deliver the service the buyer has explicitly requested. Analytics and marketing cookies always do. Merchants must therefore wire a CMP into the storefront and block non essential vendors until consent is captured. B2B portals that target named buyers may also rely on contract or legitimate interest for first party behavioural analytics, but a documented balancing test is then required.

International data transfers and the DPF

Because BigCommerce processes buyer accounts, orders and storefront analytics in the United States, every European merchant must rely on a Chapter V transfer mechanism. BigCommerce maintains an EU US and UK extension Data Privacy Framework certification, considered adequate by the Commission and recognised by the UK ICO. The DPA also offers the 2021 EU Standard Contractual Clauses for merchants that prefer not to depend on the DPF. A Transfer Impact Assessment should review the impact of FISA Section 702 and Executive Order 12333 on buyer account data, particularly when the catalog contains sensitive procurement information.

Consent, DPIA and security controls

For B2B portals that store extensive buyer profiles or expose pricing intelligence, a DPIA is advisable. The assessment should cover the categories of buyers and procurement contacts, the retention of order history, the use of behavioural analytics inside the B2B portal and the impact of the US transfer. BigCommerce holds PCI DSS Level 1 certification and SOC 2 Type II reports that can be referenced in the DPIA. Single sign on, IP allowlists and two factor authentication on the admin should be enabled as technical safeguards.

Practical compliance steps and alternatives

Wire a CMP such as Didomi, Cookiebot or OneTrust into the storefront and use BigCommerce Script Manager to conditionally fire analytics and marketing scripts only after consent. Document the DPF certification number and the SCCs in the cookie policy. Refresh the cookie scan after every storefront theme update. EU based alternatives include Shopware (Germany), Spryker (Germany), commercetools (Germany) and Centra (Sweden) for merchants who must keep all processing inside the EU/EEA.