Merchello

Merchello processes the customer data needed to fulfil an order: name, billing and shipping address, email, phone, order history and a tokenised payment reference when a PCI compliant gateway is used. In the browser it relies on the standard ASP.NET session identifier, a basket key, an antiforgery token and an authentication cookie if the visitor logs in. These cookies are first party, set by the merchant Umbraco application. Merchello does not phone home, does not send telemetry to a vendor cloud and does not set third party tracking cookies.

No. The cart, session, antiforgery and login cookies set by a Merchello powered Umbraco site fall under the strictly necessary exemption of Art. 5(3) of the ePrivacy Directive because they are required to deliver the online shop service explicitly requested by the visitor. The CNIL cookie recommendation of 2020, § 25(2) TDDDG in Germany and the AEPD Guía de Cookies confirm this position. Consent is only required for additional marketing, analytics or personalisation cookies the merchant might add alongside Merchello.

Performance of the sales contract under Art. 6(1)(b) GDPR is the primary basis for order processing. Art. 6(1)(c) (legal obligation) covers retention of invoices and accounting records. Art. 6(1)(f) (legitimate interest) supports fraud prevention and basic security logging. Art. 6(1)(a) (consent) is needed for marketing emails, loyalty profiling and personalised advertising. The merchant should document each purpose, basis and retention period in the Art. 30 record of processing activities and reflect them in the privacy notice.

Merchello itself does not transfer data to third countries since it runs on the merchant servers. Transfers depend on the merchant choices: hosting provider, payment gateway (Stripe, Braintree, PayPal often involve US transfers), email provider (Mailgun, SendGrid), shipping carrier APIs, and any analytics or marketing tool added separately. Each of these must be reviewed under Chapter V GDPR with Standard Contractual Clauses or reliance on the EU US Data Privacy Framework, and a Transfer Impact Assessment where applicable.

A formal DPIA under Art. 35 GDPR is generally not required for a Merchello shop that processes standard customer data on a moderate scale. It becomes recommended if the merchant deals with large volumes, special category data (for example a pharmacy or health store), automated decision making (credit scoring, fraud rules that block users) or large scale cross border transfers. The Art. 30 record of processing activities is mandatory and should map each Merchello dependency, processor and retention period.

Host the Umbraco application and database in an EU region you control. Apply ASP.NET hardening, enforce HTTPS, hash passwords with Identity, lock down the back office to a VPN or IP allowlist and patch Umbraco and Merchello dependencies regularly. Configure cart and account retention policies and run a nightly cleanup job. Sign data processing agreements with the hosting provider, payment gateway, transactional email vendor and shipping carrier. Publish a privacy notice and a clear data subject rights workflow.

Open source e commerce alternatives that integrate well with .NET and headless CMS include nopCommerce, Sitecore OrderCloud, SmartStore, Optimizely Commerce and Sana Commerce for the Microsoft stack, and PrestaShop, WooCommerce, Sylius or Saleor for PHP and Python or JavaScript stacks. Cloud SaaS options include Shopify, BigCommerce and Centra. Each carries different hosting, data residency and transfer profiles, so the choice should weigh data control, EU hosting availability, third party dependencies and the operational team capacity.

The cookie policy should list the strictly necessary cookies that Umbraco issues for the Merchello shop: ASP.NET session, basket key, antiforgery, authentication. State the name, purpose, type (session or persistent), duration and the fact that consent is not required because these cookies are necessary for the online shop service. Add a separate section for any analytics, marketing or personalisation cookies bolted on the shop and gate them behind a granular consent banner. Update the policy whenever you change payment, shipping or marketing providers.