Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Eaglecart is an all in one ecommerce platform that unifies an online store, point of sale and inventory, with built in payment and social selling integrations.
Eaglecart is an all in one commerce platform that lets businesses launch an online store, run point of sale and manage inventory from a single dashboard. It includes a no code website builder, warehouse management, courier integrations and buy now pay later options. Merchants can also sell through Meta and TikTok with campaign tracking, while payments run through providers such as Stripe and PayPal.
A storefront on Eaglecart processes shopper identity, contact, shipping, order and payment related data. The platform sets strictly necessary cookies to keep the basket and checkout working, and depending on configuration it can also set analytics and marketing cookies, including pixels from connected channels such as Meta and TikTok. Payment data is handled by the integrated payment provider rather than stored in the cart in plain form.
As the merchant you are the controller for your shoppers and Eaglecart is your processor, so a data processing agreement is essential. Strictly necessary cart cookies do not need consent, but analytics and marketing cookies and advertising pixels do under the ePrivacy Directive. You must give shoppers clear information about who receives their data and a lawful basis for each processing purpose under the GDPR.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Deploy a consent banner that blocks non essential cookies and marketing pixels until the shopper opts in. Meta and TikTok tags in particular should only fire after consent, and conversion tracking should respect that choice. Keep the essential cart and checkout cookies always on, and record consent so you can demonstrate it later.
Eaglecart infrastructure and several of its integrated partners operate in the United States, so shopper data may be transferred there. Payment, analytics and advertising sub processors such as Stripe, Meta and TikTok also process data outside the EEA. These transfers should rely on the EU Standard Contractual Clauses, the EU US Data Privacy Framework where a partner is certified, and a transfer risk assessment.
Sign the Eaglecart data processing agreement and map every connected integration in your record of processing. Configure a consent banner that gates analytics and advertising pixels, document the lawful basis for each purpose, and disclose payment and marketing partners in your privacy notice. Review retention settings and confirm shoppers can exercise access, erasure and objection rights.
Websites using Eaglecart must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is advisable because Eaglecart processes shopper identity, order and payment related data across an online store, point of sale and connected marketing channels. Assess the cart and analytics cookies, the integrations with Stripe, PayPal, Meta and TikTok, and the transfer of data to United States infrastructure.
Sample consent text
Our store runs on Eaglecart. With your consent, it may set analytics and marketing cookies and share data with payment and advertising partners. Essential cart cookies are always active. Manage your choices in cookie settings.
Third-party domains contacted
eaglecart.comeaglecart.comstripe.compaypal.comconnect.facebook.netanalytics.tiktok.comgoogle-analytics.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| session | Necessary | Session | Maintains the shopper session so the user stays recognized while browsing and checking out. |
| cart_id | Strictly necessary | 30 days | Stores the shopping basket contents so items persist between pages and visits. |
| ec_session | Strictly necessary | Session | Maintains the authenticated session and checkout flow on the storefront. |
| cart | Necessary | Session to persistent | Stores shopping cart contents so items remain in the cart through the purchase flow. |
| preferences | Functional | Up to 12 months | Remembers store preferences such as language or display settings for a smoother experience. |
| _ga | Analytics | 2 years | Google Analytics cookie that distinguishes visitors to measure store traffic, set only after consent. |
| _fbp | Marketing | 3 months | Meta pixel cookie used for conversion tracking and advertising, set only after consent. |
| analytics | Analytics | Up to 24 months | Optional analytics that measure store usage to help improve the storefront, set only with consent. |
| _ttp | Marketing | 1 year | TikTok pixel cookie used for ad measurement and audience building, set only after consent. |
Eaglecart uses cookies for user preferences — inform visitors with a consent banner.
EagleCart sets first party session and cart cookies that keep a shopper logged in and preserve cart contents through checkout. These are strictly necessary cookies. If an analytics add on is enabled, additional optional analytics cookies may also be set. The store always sets the necessary cookies, while optional ones depend on store configuration.
Consent is not required for the strictly necessary cart and session cookies, since they are essential to provide the shopping service. Consent is required for any optional analytics or marketing cookies enabled as add ons. A compliant store should present a banner that lets visitors accept or decline those optional categories before they load.
The legal basis for necessary cookies and order handling is performance of the sales contract with the customer. Optional analytics and marketing cookies rely on the visitor consent. Store operators should reflect both bases in their privacy notice so customers understand why each category of data is processed.
Whether EagleCart store data reaches a third country depends on the hosting region chosen for that store. The platform itself does not impose a fixed transfer destination, so operators should confirm where their store is hosted. If data leaves the European Economic Area, appropriate safeguards such as standard contractual clauses should be in place.
For a standard online store, a full data protection impact assessment is usually not required because the processing is ordinary retail activity. A DPIA becomes advisable when a store does large scale profiling, sells sensitive product categories, or runs extensive marketing analytics. Document the data collected at checkout and the retention periods to support that assessment.
Start by inventorying the cookies EagleCart sets and classifying them as necessary or optional. Add a consent banner that blocks optional analytics until the shopper agrees, and publish a privacy notice covering catalog, cart, and checkout processing. Confirm the hosting region so you can describe any third country transfers accurately.
Other hosted ecommerce and shopping cart platforms offer similar catalog, cart, and checkout features, so the right choice depends on your scale, integrations, and hosting needs. When comparing options, look at how each platform classifies cookies, where it hosts data, and how it supports consent management. The compliance principles described here apply broadly across hosted store platforms.
Review the cookies your EagleCart store currently sets, including any analytics add ons you have enabled, and list each one with its purpose and duration. Update your published cookie policy to match this inventory and align it with your consent banner categories. Repeat this review whenever you enable new features so the policy stays accurate.