> SAP Commerce Cloud under the GDPR: storefront cookies, EU hosting, legal bases for orders and marketing, third party transfers and consent guidance. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/sap-commerce-cloud E-commerce # SAP Commerce Cloud Preferences · [Official website](https://www.sap.com/products/commerce-cloud.html) SAP Commerce Cloud is an enterprise B2B and B2C commerce platform from SAP that hosts product catalogues, checkout and order management in the cloud, with EU hosting available on Microsoft Azure. [Block SAP Commerce Cloud until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Required - Documented cookies 3 - Third-party domains 3 - Servers European Union (Microsoft Azure West Europe), with optional regional hosting Overview ## What does SAP Commerce Cloud do? ## What SAP Commerce Cloud is SAP Commerce Cloud is the enterprise B2B and B2C commerce platform of SAP SE, the German software vendor headquartered in Walldorf. It runs on Microsoft Azure with EU regions available for European customers. Large retailers, manufacturers and wholesalers use it for catalogues, checkout, order management, B2B contracts and omnichannel experiences. ## Data and cookies set On the storefront, SAP Commerce Cloud sets JSESSIONID for the shopping session, an anonymous cart identifier and CSRF tokens. These are strictly necessary. Marketing, recommendation and personalisation modules add additional cookies that require consent. ## GDPR and ePrivacy implications The session and order data are processed under Article 6(1)(b) GDPR (performance of a contract). Marketing personalisation, behavioural recommendations and email tracking pixels require consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy. ## Consent requirements You do not need consent for the strictly necessary cookies, but the marketing and personalisation features must be gated behind a consent management platform that records valid consent before activation. The newsletter, push notifications and product recommendation cookies must default to off. ## Data transfers outside the EEA With Azure EU regions, customer data stays within the European Union by default. Sub processors should be reviewed: SAP support, Azure global support and any extension marketplace partner can introduce US access that needs SCCs and a transfer impact assessment. ## Practical compliance steps Pin the deployment to an Azure EU region, enable role based access control, integrate a CMP that blocks marketing scripts before consent, run a DPIA for personalisation modules, document SAP and Azure sub processors, and align checkout messages with the right consent or contract basis. Compliance ## SAP Commerce Cloud and the GDPR SAP Commerce Cloud is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Performance of a contract (Article 6(1)(b) GDPR) for order processing, plus consent (Article 6(1)(a) GDPR and Article 5(3) ePrivacy) for marketing cookies and personalisation - Risk level medium - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, French CNIL guidelines, German TDDDG, Spanish LSSI, PCI DSS ### Impact assessment (DPIA) A DPIA is recommended for the marketing personalisation and recommendation modules and for any integration that processes special categories of data or large volumes of payment information. EU hosting on Azure simplifies the third country analysis. ### Sample text for your banner > Our online store is powered by SAP Commerce Cloud, operated by SAP SE (Germany). Personal data needed to process your order is hosted on EU infrastructure on Microsoft Azure. Marketing and personalisation cookies are activated only with your prior consent. Cookies and trackers ## What SAP Commerce Cloud sets and contacts - Tracking method server\_side - Server location European Union (Microsoft Azure West Europe), with optional regional hosting ### Cookies set (3) | Name | Type | Duration | Purpose | | -------------- | ------------ | -------- | -------------------------------------------------------------------------------------------------- | | JSESSIONID | first\_party | Session | Maintains the visitor session with the SAP Commerce Cloud application server (strictly necessary). | | anonymous-cart | first\_party | 30 days | Stores the anonymous cart identifier so the visitor can resume shopping (strictly necessary). | | XSRF-TOKEN | first\_party | Session | CSRF protection token for secure checkout requests. | ### Third-party domains contacted (3) - `cx.eu.commerce.ondemand.com` - `api.eu.commerce.ondemand.com` - `launchpad.support.sap.com` Questions ## Frequently asked questions about SAP Commerce Cloud Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does SAP Commerce Cloud set? Strictly necessary cookies for the session (JSESSIONID), the anonymous cart and CSRF tokens. Marketing, recommendation and personalisation modules add consent based cookies. ### Do I need consent to use SAP Commerce Cloud? Not for the core checkout cookies, which are necessary to perform the contract. Yes for the marketing, recommendation and personalisation modules. ### What is the legal basis? Article 6(1)(b) GDPR for order processing, Article 6(1)(a) GDPR and Article 5(3) ePrivacy for marketing cookies and personalisation. ### Are any data transferred to the United States? In standard EU configuration, no. Customer data stays in the chosen Azure EU region. Watch for sub processors (SAP support, Azure global support, marketplace extensions) that may introduce US access. ### Is a DPIA needed? Recommended for personalisation, recommendation and any module processing special categories of data or large volumes of payment information. ### How do I implement compliance correctly? Pin to an Azure EU region, integrate a CMP, gate marketing and personalisation behind consent, run a DPIA for new modules, document SAP and Azure sub processors. ### What are the alternatives? Adobe Commerce (Magento), Salesforce Commerce Cloud, commercetools, Spryker, Shopify Plus and BigCommerce. EU based options simplify the third country analysis. ### How do I update the cookie policy? Run a scanner monthly across staging and production, document strictly necessary versus consent based cookies separately, and version the policy in your CMS. Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [Shopper Approved](https://www.flowconsent.com/en/services/ecommerce/shopperapproved) [ShopperApproved is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. ShopperApproved supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, ShopperApproved ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/shopperapproved) [Preferences](https://www.flowconsent.com/en/services/ecommerce/shopperapproved) · ### [Smartstore biz](https://www.flowconsent.com/en/services/ecommerce/smartstore-biz) [Smartstore biz is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Smartstore biz integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Smartstore biz helps organizations maintain robust websites that meet user expectations and technical.](https://www.flowconsent.com/en/services/ecommerce/smartstore-biz) [Preferences](https://www.flowconsent.com/en/services/ecommerce/smartstore-biz) · ### [Yelp Reservations](https://www.flowconsent.com/en/services/ecommerce/yelp-reservations) [Yelp Reservations is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Yelp Reservations provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Yelp Reservations helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/ecommerce/yelp-reservations) [Preferences](https://www.flowconsent.com/en/services/ecommerce/yelp-reservations) · ### [Argento](https://www.flowconsent.com/en/services/ecommerce/argento) [Argento is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Argento enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Argento empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/ecommerce/argento) [E-commerce](https://www.flowconsent.com/en/services/ecommerce/argento) · ### [WSHOP](https://www.flowconsent.com/en/services/ecommerce/wshop) [WSHOP is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. WSHOP integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, WSHOP helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/wshop) [Preferences](https://www.flowconsent.com/en/services/ecommerce/wshop) · ### [Fleksa](https://www.flowconsent.com/en/services/ecommerce/fleksa) [Fleksa is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Fleksa enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Fleksa empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/ecommerce/fleksa) [Preferences](https://www.flowconsent.com/en/services/ecommerce/fleksa) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)