CubeCart

By default CubeCart only sets first party cookies that are strictly necessary to operate the shop: PHPSESSID (or CubeCart-Session) for the PHP session, a cart identifier referencing the current basket, a customer authentication cookie for logged in users, an admin session cookie for the back office and a small preference cookie for currency or language. No analytics, advertising or social cookies ship with the core product. The merchant database stores order details, customer profile, billing and delivery addresses and order history.

Consent is not required for the strictly necessary cookies that operate the cart, checkout, login and admin panel, because they are exempt under Art. 5(3) ePrivacy. Consent is required as soon as the merchant enables optional integrations: Google Analytics, Meta Pixel, Hotjar, live chat, marketing automation or social login. In that case, install a Consent Management Platform that blocks the relevant scripts until the visitor opts in, and offer reject all, accept all and granular per category choices.

The merchant relies on contract performance under Art. 6(1)(b) GDPR for cart, checkout and order management, including delivery addresses and invoicing. Legitimate interest under Art. 6(1)(f) GDPR can support fraud prevention and basic web security cookies. Consent under Art. 6(1)(a) GDPR is the basis for optional analytics, advertising, newsletter sign ups and any non essential personalisation. Legal obligations (Art. 6(1)(c) GDPR) apply to invoice retention and tax reporting, typically for ten years depending on the EU country.

The core CubeCart application does not transfer customer data abroad: storage location depends on the merchant hosting choice. Transfers happen through merchant integrations: PayPal, Stripe and Authorize.Net for payments, Google Analytics or Mailchimp for marketing, Royal Mail or shipping APIs for logistics. Each recipient must be covered by an appropriate transfer tool: the EU US Data Privacy Framework for certified US partners, EU Standard Contractual Clauses for others, and the adequacy decision when data flows to the United Kingdom.

A formal DPIA is generally not required for a standard CubeCart shop because the processing is necessary for contract performance and limited to typical e commerce data. A DPIA becomes appropriate when the merchant runs large scale behavioural advertising, sells sensitive products (health, religion, sexual orientation), profiles customers across channels, uses automated fraud scoring with significant effects, or processes data of a large number of children. Document the screening decision in your data protection file regardless.

Pick an EU based hosting provider with a signed Data Processing Agreement, force HTTPS on all pages, configure Secure and SameSite=Lax on session cookies, restrict admin access with IP filtering and strong authentication, and back up the database inside the EU. Install a CMP plugin that gates every optional integration, publish a clear privacy notice and a cookie policy, and configure customer rights workflows using built in account management. Audit installed plugins quarterly and remove anything that you do not actively use.

Other self hosted EU friendly e commerce platforms include WooCommerce on European hosting, PrestaShop (France), Sylius (PHP, France), Spree (Ruby), Drupal Commerce, OpenCart and Magento Open Source. For managed solutions, consider Shopware (Germany), Shopify with EU hosting selected or Lightspeed eCom (Netherlands). None of these remove the consent requirement for analytics and marketing add ons, but the choice impacts hosting location, the available Data Processing Agreement and the maturity of native consent integrations.

List the strictly necessary CubeCart cookies (PHPSESSID, cart, customer auth, admin session, currency or language) with purpose and duration, then add a section for every optional integration: analytics, marketing pixels, chat, social login, payment gateways. Include transfer information (EU US Data Privacy Framework, Standard Contractual Clauses, UK adequacy) for any non EU recipient and the link to the partner privacy policy. Review the policy whenever a plugin is added or removed, at least every six months, and archive previous versions for accountability.