ecforce

What ecforce is and how it works

ecforce is an all-in-one e-commerce platform operated by SUPER STUDIO Inc., a Tokyo-based company founded in 2014. It serves the Japanese direct-to-consumer market, with a particular strength in subscription commerce: beauty, food and beverage, supplements, pet products. ecforce combines a storefront builder, a checkout, a subscription engine, a CRM, fulfilment integrations, and a marketing automation layer in a single SaaS offering.

Merchants run their store on ecforce.jp domains or on a custom domain. The platform handles recurring billing logic, customer segmentation, drip campaigns, and detailed cohort analytics aimed at maximising lifetime value.

Data and cookies collected

ecforce sets first-party cookies for cart state, login session, CSRF protection, and a customer identifier. Optional analytics cookies are set to feed the in-platform reporting and cohort analytics. Merchants can also enable Google Tag Manager, Meta Pixel, LINE tag, Yahoo! JAPAN Tag, and Karte connectors inside ecforce, each of which adds its own cookies and pixel calls.

Personal data handled by ecforce typically includes name, e-mail, postal address, phone, payment instrument reference, order and consumption history, subscription cadence, marketing preferences, and browsing data. Sensitive categories are not collected by default but can appear in custom fields if the merchant adds them.

GDPR and ePrivacy implications

For EU customers, strictly necessary cookies (cart, session, CSRF) are exempt from consent. Analytics and marketing cookies, including any pixels connected through ecforce, require informed prior consent. The legal basis for the checkout itself is performance of the contract; consent is the basis for analytics, marketing automation and remarketing.

Transfers to Japan and the adequacy decision

Japan benefits from a European Commission adequacy decision adopted in 2019, supplemented by binding Supplementary Rules issued by Japan's Personal Information Protection Commission. These rules raise APPI protection to a level deemed essentially equivalent to the GDPR for personal information transferred from the EU. As a result, transfers to ecforce do not require Standard Contractual Clauses, provided the data falls within the scope of the decision.

Controllers should still document the transfer in their record of processing, inform data subjects in the privacy notice, and verify that ecforce treats EU data in accordance with the Supplementary Rules.

Consent and DPIA

A DPIA is advisable when ecforce is used at scale for EU customers because of the combination of recurring billing, behavioural profiling for lifetime value optimisation, marketing automation, and a transfer to Japan. The DPIA should cover the data flow, the legal basis stack, the consent design, and the safeguards built into the adequacy decision.

Practical compliance steps

Sign a data processing addendum with SUPER STUDIO, document the transfer to Japan as covered by the adequacy decision, gate analytics and marketing cookies behind your consent banner, disable advertising connectors for visitors who refuse marketing, set a retention policy for subscription and consumption history, and provide a clear privacy notice that names ecforce as the processor and explains the Japan transfer.