Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Hosted ecommerce store builder that lets merchants create and run an online shop, with cart and session cookies plus optional analytics and marketing tools.
GoodEshop is a hosted ecommerce store builder that lets merchants create and operate an online shop without managing their own infrastructure. It provides storefront templates, product catalogs, a shopping cart and checkout, and usually integrates with payment and shipping providers. Like any online store, it relies on cookies to keep a cart and session working across pages.
The core of the platform uses strictly necessary cookies for the cart, session and security, which keep the shop working and do not generally require consent. On top of that, a merchant can enable optional analytics, advertising and personalization tools that set their own cookies and process visitor data. Order and account data such as names, addresses and payment references are processed to fulfil purchases.
Running a shop with GoodEshop involves processing personal data of customers, so the merchant is a controller and the platform is typically a processor. Strictly necessary cookies are exempt from consent under ePrivacy, but optional analytics and marketing cookies are not. The merchant must provide clear privacy and cookie information and respect data subject rights.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You do not need consent for the cart, checkout and security cookies that make the store function. You do need prior consent for any analytics, advertising or personalization cookies you switch on, collected through a banner before those tags fire. Make sure optional tools stay disabled until the visitor opts in.
Where customer and order data is processed depends on where GoodEshop hosts the store and which integrations are active. If hosting or any analytics, payment or marketing partner is outside the EEA, the data may be transferred to a third country and needs a valid transfer mechanism. Confirm the hosting region and add Standard Contractual Clauses where required.
Sign a data processing agreement with GoodEshop, confirm the hosting region and list every optional tracker you enable. Use a consent banner for non essential cookies, publish accurate cookie and privacy notices, and provide a way to exercise data subject rights. Review integrations periodically so your disclosures match what the store actually does.
Websites using GoodEshop must obtain user consent under GDPR regulations.
DPIA considerations
A full DPIA is usually not required for the core shop functions, which rely on strictly necessary cart and session cookies. A DPIA becomes relevant if a merchant enables extensive analytics, profiling or marketing integrations, or processes special category data. Assess which optional trackers are active, where customer and order data are hosted, and whether any transfers leave the EEA.
Sample consent text
We use necessary cookies to run your cart and checkout. With your permission we also use analytics and marketing cookies to improve our store and show relevant offers. Do you accept these optional cookies?
Third-party domains contacted
goodeshop.comcdn.goodeshop.comassets.goodeshop.comcheckout.goodeshop.comwww.google-analytics.comfonts.gstatic.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ge_session | Functional | Session | Maintains the visitor session so the store can keep the user signed in and consistent across pages |
| ge_cart | Functional | 7 days | Stores the contents of the shopping cart so items remain available during the visit |
| ge_csrf | Functional | Session | Provides a security token to protect forms and checkout against cross site request forgery |
| ge_consent | Functional | 1 year | Remembers the cookie consent choices made by the visitor |
| _ga | Analytics | 2 years | Optional analytics cookie that distinguishes visitors when a merchant enables web analytics |
| ge_mkt | Targeting | 90 days | Optional marketing cookie used for remarketing when a merchant enables advertising integrations |
GoodEshop uses cookies for user preferences — inform visitors with a consent banner.
GoodEshop sets strictly necessary cookies for the session, cart and security so the shop works, and a consent cookie to remember choices. If a merchant enables analytics or marketing tools, those add optional cookies such as an analytics identifier or a remarketing cookie. The exact list depends on which features and integrations the merchant turns on.
Consent is not required for the strictly necessary cart, session and security cookies that make the store function. Consent is required before any optional analytics, advertising or personalization cookies are set. You should present a banner that keeps optional cookies off until the visitor agrees.
Necessary shop functions rely on contract performance and legitimate interest, since they are needed to deliver the store and process orders. Optional analytics and marketing cookies rely on consent under the ePrivacy rules and the GDPR. Document which basis applies to each category of processing.
It depends on where GoodEshop hosts the store and which integrations are active. If the hosting region or an analytics, payment or marketing partner sits outside the EEA, customer data may be transferred to a third country. Confirm the hosting region with the provider and put Standard Contractual Clauses in place where needed.
A DPIA is usually not required for the core shop functions, which use strictly necessary cookies and standard order processing. It becomes relevant if you enable extensive profiling, marketing or analytics, or process special category data. Assess the optional trackers you activate and any transfers outside the EEA.
Sign a data processing agreement, confirm where data is hosted, and keep optional trackers disabled until the visitor consents. Publish clear cookie and privacy notices that list the cookies actually in use and provide a way to exercise data subject rights. Review enabled integrations periodically so your disclosures stay accurate.
Alternatives include other hosted store builders and self hosted open source ecommerce platforms that give more control over hosting location and trackers. EU hosted options can simplify transfer questions. The right choice depends on your technical capacity and your data protection requirements.
Review the cookies your store actually sets whenever you enable or disable an integration or change theme. Update your cookie policy and consent banner to reflect new cookies, durations and purposes. Keep a record of the optional tools you have switched on so the disclosures remain accurate.