Kickflip

What Kickflip is and how it works

Kickflip provides an embedded product configurator that renders 3D, real time previews of customizable products on merchant websites. The widget loads JavaScript and assets from Kickflip domains, captures user choices such as colors, materials, text, and dimensions, and sends those configurations back to merchant carts. It is widely used by manufacturers and e commerce stores in apparel, sports gear, furniture, and promotional goods. Because the configurator runs inside the visitor browser and exchanges data with Kickflip servers, integrating it into a website that targets EU or UK users brings the activity within the scope of GDPR, the ePrivacy Directive, and national cookie laws.

What data and cookies it collects

Kickflip typically sets first party cookies tied to the merchant domain to keep the configurator session, save in progress designs, and persist preferences across page loads. It may also store data in localStorage and IndexedDB for offline rendering and design caching. The platform processes IP addresses, device and browser identifiers, configuration payloads, uploaded images or text, and event metadata such as add to cart actions. Depending on the merchant setup, optional analytics events may be forwarded to a connected Google Analytics or marketing pixel, in which case those tools are responsible for their own cookies and identifiers.

GDPR and ePrivacy implications

Where the configurator is strictly necessary to deliver the requested service, for instance keeping a design across the checkout flow, processing can rest on legitimate interests under GDPR Art. 6(1)(f) and the strictly necessary exemption of ePrivacy Art. 5(3). However, any analytics, A/B testing, personalization, or advertising signals derived from configurator behavior fall outside that exemption and require prior, freely given, specific, informed, and unambiguous consent from EU and UK visitors. User generated uploads (logos, photos, names) can also include special category or children data, which raises the bar for documentation and minimization.

International data transfers

Kickflip operates from Canada and uses cloud infrastructure that may store and process data in Canada and the United States. EU and UK controllers must therefore document a valid transfer mechanism. Transfers to Canada benefit from a partial adequacy decision for commercial organizations subject to PIPEDA, while US transfers commonly rely on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework. A transfer impact assessment should evaluate the categories of personal data sent (IP, design payloads, images), the legal regime in the destination country, and any supplementary measures such as encryption in transit and at rest.

Consent, configuration, and merchant duties

Merchants embedding Kickflip should treat it as a third party processor and update their record of processing, privacy notice, and cookie banner accordingly. The strictly necessary part of the configurator can load before consent, but any optional analytics, retargeting, or session replay overlays must be gated behind an opt in. A consent management platform should block Kickflip scripts and cookies until the user accepts, or load a reduced version that does not perform analytics. The cookie policy should list the cookies set on the merchant domain along with their purpose and retention.

Practical steps to stay compliant

Start by signing a data processing agreement with Kickflip and identifying its sub processors. Map the data flows from the configurator widget to Kickflip APIs and any analytics or CRM integrations. Configure the cookie banner to load only strictly necessary configurator features by default and to enable analytics or marketing only after consent. Document the lawful basis for each processing purpose, set retention limits for saved designs, and offer users a clear way to delete their configurations. Review the setup regularly and re run a transfer impact assessment whenever Kickflip changes hosting regions or sub processors.