> Hit-Mall hosts e-commerce stores and sets session and authentication cookies. GDPR obligations, ePrivacy consent rules and international data transfers. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/hit-mall E-commerce # Hit-Mall Preferences · [Official website](https://www.hit-mall.jp) Hit-Mall is a hosted e-commerce platform widely used by online retailers in Russia and the Commonwealth of Independent States. It provides catalogue management, baskets, checkout, payment integrations and a marketing toolset. Hit-Mall stores cookies for session, basket, language and authentication, and processes data on infrastructure located outside the European Economic Area, which raises specific obligations under GDPR and the ePrivacy Directive when European visitors are concerned. [Block Hit-Mall until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Required - Documented cookies 4 - Third-party domains 3 - Servers Most Hit-Mall installations run on infrastructure located in the Russian Federation and the Commonwealth of Independent States, with optional content delivery via a global CDN. Overview ## What does Hit-Mall do? ## **What Hit-Mall is and how it works** Hit-Mall is a hosted e-commerce platform widely used by online retailers in Russia and the Commonwealth of Independent States. It provides catalogue management, customer accounts, baskets, checkout, payment integrations, marketing automation and a content management layer. Merchants subscribe to the platform, configure their store and run their business on Hit-Mall infrastructure rather than self hosting the application. Visitors interact with a JavaScript storefront that writes a small set of first party cookies, while the back office runs in the Hit-Mall data centres. ## **Cookies and personal data collected** The Hit-Mall storefront typically writes a session cookie (PHPSESSID or a renamed equivalent), a basket cookie that stores the anonymous cart reference, an authentication cookie for logged in customers and a language cookie. Optional modules add marketing, abandoned cart, retargeting and analytics cookies. The platform processes the customer name, billing address, shipping address, phone number, email and order history. Payment is usually delegated to a separate processor that returns a token, but the merchant remains responsible for the data flow. ## **GDPR and ePrivacy implications** The session, basket and authentication cookies fall under the strictly necessary exemption of Article 5(3) of the ePrivacy Directive, since they are required to deliver the shopping service explicitly requested by the customer. They can be loaded without consent. Marketing, analytics and retargeting modules trigger consent obligations and must be blocked by a Consent Management Platform until accepted. The privacy notice must list each module and the categories of data processed. ## **International data transfers and Schrems II by analogy** Hit-Mall infrastructure is mainly located in Russia, which has no European adequacy decision and which has been the target of EU sanctions and counter sanctions affecting personal data. Transfers from the European Economic Area must rely on Standard Contractual Clauses and on supplementary measures (strong encryption with keys held in the EU, pseudonymisation, restriction of administrative access, transparent reporting of any government access request). A Schrems II style Transfer Impact Assessment is mandatory and should conclude on the residual risk after the supplementary measures. ## **Compliance steps for European merchants** Sign Standard Contractual Clauses with Hit-Mall, document the supplementary measures and run a Transfer Impact Assessment. Block optional marketing and analytics modules behind a Consent Management Platform such as FlowConsent. Configure the cookies with Secure and HttpOnly with SameSite=Lax. Document the retention period of orders, customer accounts and abandoned baskets. Reference Hit-Mall in your privacy notice and reflect on whether a self hosted European platform such as Saleor, Sylius or Spryker would be a more proportionate choice. Compliance ## Hit-Mall and the GDPR Hit-Mall is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Strictly necessary cookies for cart, session and authentication can rely on the Article 5(3) ePrivacy Directive exemption and on contract performance under Article 6(1)(b) GDPR. Marketing, analytics and personalisation modules require consent under Article 6(1)(a). Third country transfers require Standard Contractual Clauses and supplementary measures. - Risk level high - Applicable regulations GDPR, ePrivacy Directive (2002/58/EC), national ePrivacy implementations (CNIL guidelines in France, TTDSG/TDDDG in Germany, LSSI and LOPDGDD in Spain), Schrems II case law applied by analogy to non adequacy countries, EDPB Recommendations 01/2020 on supplementary measures, Russian Federal Law 152 FZ for residents of the Russian Federation ### Impact assessment (DPIA) A merchant targeting European customers with a Hit-Mall store should consider a DPIA because data is transferred to a country without adequacy and the platform combines order, account, payment and marketing data. The DPIA should describe the transfer mechanism, the supplementary measures (encryption, pseudonymisation, EU mirror copy if available), the access rights of Russian support staff, the legal basis of each processing activity and the retention period. ### Sample text for your banner > This shop runs on the Hit-Mall platform. Strictly necessary cookies are written to keep your basket and session active. Order data, account information and payment metadata are processed by the platform on infrastructure located in the Russian Federation under Standard Contractual Clauses. Optional marketing or analytics cookies are activated only with your consent. Cookies and trackers ## What Hit-Mall sets and contacts - Tracking method Hosted SaaS e-commerce platform delivered through a JavaScript storefront and a server side checkout. The platform writes session, basket, language and authentication cookies in the visitor browser and exposes optional analytics, marketing and live chat modules. - Server location Most Hit-Mall installations run on infrastructure located in the Russian Federation and the Commonwealth of Independent States, with optional content delivery via a global CDN. - Data transferred outside the EU When merchants targeting European audiences run their store on Hit-Mall, the data is generally transferred outside the European Economic Area to Russia. Russia has no European adequacy decision, so transfers must rely on Standard Contractual Clauses and a thorough Transfer Impact Assessment. Local Russian data localisation rules (Federal Law 152 FZ) also apply to Russian residents and may require a primary database in Russia. ### Cookies set (4) | Name | Type | Duration | Purpose | | ---------- | ------------ | -------- | ------------------------------------------------------------------------------------------------------------------ | | PHPSESSID | first\_party | Session | Stores the session identifier used to keep the cart, login state and language preference active across page loads. | | hm\_basket | first\_party | 30 days | Stores the anonymous reference to the active shopping basket so that cart contents persist across visits. | | hm\_auth | first\_party | Session | Stores the encrypted authentication ticket of customers who have logged into their account on the storefront. | | hm\_lang | first\_party | 1 year | Stores the language and locale chosen by the visitor so that returning visits load the right localised version. | ### Third-party domains contacted (3) - `hit-mall.ru` - `static.hit-mall.ru` - `cdn.hit-mall.ru` Questions ## Frequently asked questions about Hit-Mall Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Hit-Mall write? By default the storefront writes a session cookie (typically PHPSESSID), a basket cookie that holds the anonymous cart reference, an authentication cookie for logged in customers and a language cookie. Optional modules add marketing, retargeting and analytics cookies that require consent. ### Do I need user consent for the default Hit-Mall cookies? No. Session, basket, language and authentication cookies fall under the strictly necessary exemption of Article 5(3) of the ePrivacy Directive, since they are required to deliver the shopping service explicitly requested. Optional marketing, retargeting and analytics modules require an explicit opt in. ### What is the legal basis for processing personal data through Hit-Mall? Order processing, account management and authentication rely on contract performance under Article 6(1)(b) GDPR. Marketing and retargeting require consent under Article 6(1)(a). Anti fraud and security logs may rely on legitimate interest under Article 6(1)(f). Document each basis in your record of processing. ### Are data transferred to Russia or to other third countries? Yes. Hit-Mall infrastructure is mainly located in Russia, which has no European adequacy decision. Transfers must rely on Standard Contractual Clauses with supplementary measures (encryption with EU based keys, pseudonymisation, restriction of administrative access). A Schrems II style Transfer Impact Assessment is mandatory. ### Do I need a Data Protection Impact Assessment for Hit-Mall? In most cases yes. The combination of large scale order data, financial information, marketing modules and a transfer to a country without adequacy meets several criteria of Article 35 GDPR and the EDPB Guidelines on DPIA. Document the supplementary measures and the residual risk before launching the store. ### How do I implement Hit-Mall in a fully compliant way? Sign Standard Contractual Clauses with Hit-Mall, run a Transfer Impact Assessment, deploy strong encryption with EU based keys, restrict administrative access, block optional marketing and analytics modules behind a Consent Management Platform such as FlowConsent, document the data flows and reflect on whether a self hosted European platform would be more proportionate. ### What are the alternatives to Hit-Mall? European alternatives include Shopify (Canada with EU options), PrestaShop (France), Sylius (France), Saleor (Poland), Spryker (Germany), Adobe Commerce (Magento), Shopware (Germany) and Bagisto. Each platform has a different hosting model and integrations, but all provide a stronger EU privacy posture than a Russian hosted store. ### How should I update my cookie policy when I deploy Hit-Mall? List the strictly necessary cookies (session, basket, authentication, language) with their purpose and lifetime, document the data transfer to Russia, reference the Standard Contractual Clauses and supplementary measures, list every optional module that writes additional cookies, and provide a clear consent management link with a working revocation flow. Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [OrderPort](https://www.flowconsent.com/en/services/ecommerce/orderport) [OrderPort is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. OrderPort integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, OrderPort helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/orderport) [Preferences](https://www.flowconsent.com/en/services/ecommerce/orderport) · ### [RomanCart](https://www.flowconsent.com/en/services/ecommerce/romancart) [RomanCart is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. RomanCart supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, RomanCart ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/romancart) [Preferences](https://www.flowconsent.com/en/services/ecommerce/romancart) · ### [Briqpay](https://www.flowconsent.com/en/services/ecommerce/briqpay) [Briqpay is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Briqpay integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Briqpay helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/briqpay) [Preferences](https://www.flowconsent.com/en/services/ecommerce/briqpay) · ### [WooCommerce Multilingual](https://www.flowconsent.com/en/services/ecommerce/woocommerce-multilingual) [WooCommerce Multilingual is a website translation and localization platform that helps businesses reach global audiences by delivering content in multiple languages. It provides automated translation, human editing workflows, and seamless CMS integration. WooCommerce Multilingual supports dynamic content translation, multilingual SEO optimization, and locale-specific formatting. With language detection and visitor routing, WooCommerce Multilingual ensures every user receives content in their preferred language.](https://www.flowconsent.com/en/services/ecommerce/woocommerce-multilingual) [Preferences](https://www.flowconsent.com/en/services/ecommerce/woocommerce-multilingual) · ### [Bahooosh](https://www.flowconsent.com/en/services/ecommerce/bahooosh) [Bahooosh is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Bahooosh integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Bahooosh helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/bahooosh) [E-commerce](https://www.flowconsent.com/en/services/ecommerce/bahooosh) · ### [makeshop](https://www.flowconsent.com/en/services/ecommerce/makeshop) [MakeShop is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. MakeShop integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, MakeShop helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/makeshop) [Preferences](https://www.flowconsent.com/en/services/ecommerce/makeshop) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)