Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Imweb is a popular Korean hosted website builder and e-commerce platform operated by Imweb in Seoul. It lets users build websites, landing pages and online stores without coding, with built in templates, payment integration and basic SEO and analytics. Sites are served from Imweb infrastructure in Korea. When EU visitors interact with an Imweb hosted page, their data is transferred to Korea under the EU Korea adequacy decision, with GDPR transparency and consent obligations still applying.
Imweb is one of the most popular hosted website and e-commerce builders in South Korea, run by Imweb in Seoul. It is used by Korean SMEs, creators and small commerce brands to publish corporate websites, landing pages and online stores without coding. Templates, payment integration, basic SEO, analytics and a hosted commerce engine are bundled in the platform. Korean export brands increasingly use Imweb to serve European audiences with K beauty, K food, fashion and design products.
An Imweb site sets a session cookie, a CSRF token cookie and, for commerce sites, a persistent cart cookie and an authentication cookie. The platform processes the site visit metadata, form submissions and commerce data: customer name, email, phone, address, payment metadata and order history. Optional marketing pixels (Facebook Pixel, Google Ads, Naver, Kakao) add their own cookies and transfer data to their providers.
Session, CSRF and cart cookies fall under the Article 5(3) ePrivacy strictly necessary exemption. Optional analytics and marketing cookies are non strictly necessary and require consent. Order and account data are processed under contract performance (Article 6(1)(b) GDPR), and the transfer of EU customer data to Imweb servers in Korea relies on the EU Korea adequacy decision (Implementing Decision (EU) 2022/254).
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Hosting and basic site analytics rely on legitimate interest (Article 6(1)(f) GDPR). Commerce features rely on contract performance (Article 6(1)(b) GDPR). Marketing pixels and remarketing rely on consent (Article 6(1)(a) GDPR). A data processing agreement under Article 28 GDPR between the operator (controller) and Imweb (processor) is required, alongside the documentation of any Korean specific safeguards required by the PIPC.
Imweb hosts the platform on AWS Korea regions in Seoul. Korea benefits from the EU adequacy decision (Implementing Decision (EU) 2022/254), so transfers from the EEA to Imweb do not require Standard Contractual Clauses. Operators must mention the transfer in the privacy notice, name Imweb as recipient and reference the adequacy decision. Marketing pixels can add additional transfers to the United States, requiring SCC or the EU US Data Privacy Framework.
Sign the Imweb DPA, mention Imweb as a processor in the privacy notice and cite the EU Korea adequacy decision. Block optional marketing pixels and analytics behind a CMP and align retention with EU rules. For commerce sites, limit the customer data to what is required for the order and provide a documented data subject rights procedure for EU customers.
Websites using Imweb must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is not generally required when Imweb is used to host a simple website or small online store. A DPIA becomes relevant when the operator uses Imweb to run high traffic campaigns, sells sensitive product categories or combines Imweb with extensive marketing pixels and remarketing flows that build long term visitor profiles.
Sample consent text
This website is built on Imweb, a Korean website and commerce platform. Strictly necessary cookies are used to keep your session, cart and checkout running; these do not require your consent. With your permission we also activate optional analytics and marketing cookies. Your data is transferred to South Korea, recognised by the European Commission as offering an adequate level of data protection.
Third-party domains contacted
imweb.meapp.imweb.mecdn.imweb.meCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| imweb_session | first_party | Session | Server side session identifier set by Imweb to bind the visitor to a server session. |
| imweb_csrf | first_party | Session | CSRF protection token used to safely submit forms and commerce actions. |
| imweb_cart | first_party | 30 days | Persistent cart cookie used on Imweb commerce sites to retain the basket between visits. |
| imweb_auth | first_party | 30 days | Authentication cookie set after the visitor signs in to an Imweb account. |
Imweb uses cookies for user preferences — inform visitors with a consent banner.
Session and CSRF token cookies on every page; persistent cart and authentication cookies on commerce sites. Optional analytics and marketing pixels add additional cookies.
Not for strictly necessary cookies (session, CSRF, cart). Yes for optional analytics, marketing pixels and remarketing cookies.
Hosting and basic site analytics rely on legitimate interest. Commerce flows rely on contract performance. Marketing pixels rely on consent. Statutory retention relies on legal obligation.
Yes, to South Korea. Covered by the EU Korea adequacy decision so SCC are not required for the core transfer. Marketing pixels may trigger additional transfers to the US, requiring SCC or DPF.
Not generally for a simple site or small shop. Recommended for high traffic deployments, sensitive product categories or extensive remarketing flows.
Sign the Imweb DPA, list Imweb as a processor, cite the EU Korea adequacy decision, block optional pixels behind a CMP and limit retention to what is necessary.
For website builders: Wix, Squarespace, Webflow, Tilda. For Korean alternatives: Cafe24, Makeshop, Wins eCommerce. EU based options simplify the transfer chain.
List the strictly necessary cookies with names and durations. Mention Imweb as a processor in Korea and cite the EU Korea adequacy decision. Document any optional analytics or marketing cookies separately.