Selless

What Selless is and how it powers online stores

Selless is a Russian all-in-one e-commerce platform that positions itself as a social auto-commerce engine for high-volume merchants. Stores built on Selless combine a hosted storefront, checkout, cart, inventory and a marketing layer designed to convert traffic coming from social networks, messengers and paid acquisition. The platform is delivered as a managed service, so the merchant configures products and campaigns inside the Selless dashboard while the underlying servers, databases and tracking endpoints are operated by the vendor.

From an integration standpoint, Selless is typically embedded by pointing a merchant domain at Selless infrastructure or by loading a script that bootstraps the store. Either way, the merchant brand appears in the browser address bar while the actual processing happens on Selless servers. This first-party setup is convenient for conversion rates, but it has direct consequences for GDPR scoping because cookies set under the merchant domain are still controlled by Selless from a regulatory perspective.

Data and cookies that Selless collects

Selless relies on cookies for several purposes. Strictly necessary cookies hold the session identifier and the cart payload so a visitor can browse, add items and proceed to checkout without losing state. Functional cookies remember language and merchandising preferences. Marketing and conversion cookies attach a visitor identifier that survives across pages and campaigns, allowing the platform to attribute purchases back to a traffic source and to power the social auto-commerce features that are central to the product.

Beyond cookies, Selless captures the IP address, the user agent, page paths, time on page, products viewed, checkout steps reached, order totals and any contact details provided at checkout. For merchants connecting paid channels, conversion events are also forwarded to Selless analytics endpoints. Personal data is therefore involved well before a purchase is completed, which means GDPR applies to a large share of the visitor journey, not only to the order itself.

GDPR and ePrivacy implications

Under Article 5(3) of the ePrivacy Directive, any storage of or access to information on a user device requires prior consent unless the cookie is strictly necessary to deliver a service the user explicitly requested. Cart and session cookies fall under that exemption, but conversion, marketing and functional preference cookies do not. They must be blocked until the visitor has provided a freely given, specific, informed and unambiguous opt-in via a compliant consent banner.

Under GDPR, Selless is a processor acting on behalf of the merchant for order data and a joint or independent controller for the platform analytics that feed its product. A signed data processing agreement is therefore mandatory, and the merchant must list Selless in the record of processing activities and in the privacy notice. The retention period for cart, behavioural and conversion data must be defined and documented, and visitors must be able to exercise access, deletion and objection rights against both the merchant and Selless.

International data transfers to Russia

This is the most sensitive issue with Selless for EU operators. The platform processes data on infrastructure located in the Russian Federation, and the European Commission has not adopted an adequacy decision for Russia. Article 46 GDPR therefore requires a valid transfer mechanism, typically the 2021 Standard Contractual Clauses, together with a documented Transfer Impact Assessment that evaluates lawful access risk under Russian legislation and the effectiveness of supplementary measures such as encryption and pseudonymisation.

Following the Schrems II reasoning, the controller must assess whether local authorities can compel disclosure of EU personal data and whether the data subject has effective remedies. Given the current geopolitical and legal context, many EU data protection authorities consider transfers to Russia as carrying an elevated baseline risk. The merchant must be able to demonstrate that supplementary measures actually neutralise that risk, or accept that the transfer should not take place and adopt an EU-hosted alternative.

Consent banner and DPIA

Because conversion and marketing cookies are involved and because data leaves the EU to a non-adequate country, a Data Protection Impact Assessment is strongly recommended. The DPIA should map the data categories, the actors, the retention periods, the cookie inventory and the transfer chain, then assess the residual risk after technical and organisational measures. The consent banner must offer a reject option as prominent as accept, must avoid pre-ticked boxes and must clearly mention that data is transferred to the Russian Federation.

Practical compliance steps and alternatives

Concretely: load the Selless conversion and marketing tags only after consent, keep the strictly necessary cart and session cookies running, sign and archive the data processing agreement, complete the Transfer Impact Assessment, and add Selless to the cookie table of the privacy policy. Mention Russia explicitly in the international transfers section. If the residual risk remains high, consider migrating to an EU-hosted e-commerce platform such as Shopware, PrestaShop on EU infrastructure or a Shopify store with EU data residency commitments.