OXID eShop Community Edition

What OXID eShop Community Edition is

OXID eShop is a German e-commerce platform developed by OXID eSales AG, headquartered in Freiburg im Breisgau. The Community Edition is the free, open source variant released under the OSL 3.0 licence. It is widely used by SMEs in Germany, Austria and Switzerland for B2B, B2C and B2B2C scenarios. OXID eShop CE is a PHP and MySQL application that is installed on infrastructure controlled by the merchant, which gives the operator a high degree of control over hosting region, data flows and security measures.

What data and cookies OXID eShop CE collects

A standard OXID eShop CE installation sets a PHP session cookie (typically named sid or sid_key), an authentication cookie once the user signs in, and a persistent basket cookie that retains the cart between visits. These cookies are first party and strictly necessary. The platform processes order data, addresses, payment metadata, customer accounts, support tickets and product browsing history. Optional modules from the OXID Exchange marketplace can add analytics, recommendation, marketing automation and chat features, with their own cookies and identifiers.

GDPR and ePrivacy implications

The session, cart and login cookies fall under the ePrivacy Article 5(3) strictly necessary exemption, so they do not require consent. Order and account data are processed under contract performance (Article 6(1)(b) GDPR), without needing consent, but with transparency obligations under Articles 13 and 14 GDPR. Analytics modules (Google Analytics, Matomo, Econda) and marketing modules (Google Ads, Meta Pixel, Criteo) introduce non strictly necessary cookies that require prior consent under section 25 TTDSG in Germany or its equivalents in other EU states.

Consent requirements and legal basis

The session, cart and authentication cookies rely on contract performance and ePrivacy strictly necessary exemption. Marketing, personalisation and analytics modules rely on consent under Article 6(1)(a) GDPR. Fraud prevention features (PSP risk scoring, address validation services) usually rest on legitimate interest (Article 6(1)(f) GDPR) with a documented balancing test. The merchant is always the controller; OXID eSales AG is not a processor by default because the platform is self hosted, but commercial support contracts may make it a processor for specific operations.

Data transfers and hosting

Because OXID eShop CE is self hosted, all transfers to third countries originate from choices made by the merchant: the hosting provider (often a German or Austrian web host with EU only data centres), the payment service provider, the shipping carrier, the analytics module and the marketing automation tool. A merchant who selects EU only hosting and EU only payment, analytics and CRM modules can run an OXID shop without any non EEA personal data transfer at all, which simplifies the privacy notice considerably.

Practical compliance steps

Inventory the modules installed on top of OXID eShop CE and classify each set of cookies into strictly necessary, functional, analytics and marketing. Keep cart, login and basket cookies always on, and block all non essential modules until consent is granted through a CMP. Map the third party providers (PSP, carriers, marketing tools) in your records of processing activities, sign DPAs with each of them and document the hosting region. Run a DPIA when the shop combines profiling with sensitive product categories.