GoKwik

What is GoKwik?

GoKwik is an Indian conversion intelligence platform, incorporated as GoKwik Solutions Pvt. Ltd. in Gurugram, Haryana, that targets direct to consumer (D2C) e commerce merchants. It bundles a one click hosted checkout (KwikCheckout), an address intelligence layer (KwikPass) and a cash on delivery (COD) risk engine on top of a merchant's Shopify, Magento or custom storefront. The SDK loaded from sdk.gokwik.co replaces the native checkout, identifies returning customers across stores in the GoKwik network and prevents fraudulent COD orders using device, network and behaviour signals.

Cookies and data collected

On a typical Shopify or Magento store, GoKwik writes first party cookies on the merchant domain (gk_visitor, gk_session, gk_kwikpass) and a localStorage object with the GoKwik visitor ID, a returning customer hash, the chosen shipping pincode and the COD risk band. The SDK transmits shipping address fragments, phone number hashes, IP, user agent, device fingerprint and prior order patterns to api.gokwik.co for scoring. KwikPass also enables cross store checkout, so the same shopper hash can be recognised across multiple GoKwik powered storefronts.

GDPR and ePrivacy implications

Under the GDPR, GoKwik is a processor for the merchant (controller) when running the checkout flow, and a controller for its cross store network. The COD risk engine and KwikPass are forms of automated decision making under Art. 22 GDPR because they can decline cash on delivery or trigger upfront payment requirements. Under Art. 5(3) ePrivacy, gk_visitor and gk_kwikpass are not strictly necessary for the requested page view, so they require consent before they are set.

Consent and implementation

EU merchants should gate the GoKwik SDK behind a CMP. A pragmatic option is to load only a stub before consent (the Add to cart button stays native), then load the full SDK after the analytics or marketing category is accepted. Inside the checkout itself, strictly necessary data processing required to complete the order may rely on contract performance, but the cross store recognition and COD risk profiling need consent or a strong legitimate interest balancing test.

International data transfers

GoKwik processes data on AWS Mumbai. India is not covered by an EU adequacy decision. The GoKwik DPA includes the EU Standard Contractual Clauses (modules 2 and 3) and aligns with India's Digital Personal Data Protection Act, 2023. EU merchants should run a Transfer Impact Assessment that looks at Indian access laws (CERT IN, the IT Act, the DPDP Act exemptions), encryption in transit and at rest and the residual risk for EU customers.

Practical compliance steps

Sign the GoKwik DPA, gate the SDK behind a CMP, separate strictly necessary checkout data from cross store profiling in your privacy notice, give EU customers a meaningful right to object to automated COD scoring, document the international transfer to India with SCCs and a TIA, list gokwik.co and sdk.gokwik.co in your Content Security Policy and complete a DPIA that covers fraud scoring and cross store recognition.