Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Shine Commerce is a UK based eCommerce platform focused on fashion and retail merchants, offering catalogue management, checkout, customer accounts and integrations with shipping and marketing tools.
Shine Commerce is a UK based eCommerce platform that powers online stores for fashion, lifestyle and retail brands. The platform provides catalogue management, customer accounts, order processing, checkout, payment integrations, content management and a back office. It is offered as a SaaS service hosted in the United Kingdom with EU fallback, aimed at merchants that need reliable European hosting and dedicated retail features such as product variants, lookbooks and size guides.
Shine Commerce sets first party cookies for session continuity, the shopping cart, the customer login, currency, language and CSRF protection. Optional features add their own cookies: built in analytics, recently viewed products, A/B testing and recommendations. When merchants enable third party tags (Google Analytics, Klaviyo, Meta), those vendors deposit their own cookies in addition.
Cookies needed for the cart, checkout and customer authentication are strictly necessary under the Privacy and Electronic Communications Regulations (PECR) and the ePrivacy Directive, and do not require consent. Analytics, advertising, personalisation and remarketing cookies require informed, prior, granular and revocable consent under PECR, the UK GDPR and the GDPR for EU customers.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Deploy a CMP that blocks non essential tags until the visitor accepts. Record consent with timestamp and version, propose granular categories, offer an equally accessible refuse button and a persistent way to withdraw consent. Align with both ICO guidance (UK) and EDPB cookie guidelines (EU) since Shine Commerce often serves a cross border audience.
Shine Commerce hosting in the UK benefits from an EU adequacy decision, so EU UK transfers are permitted without additional safeguards. Transfers from the UK perspective to the EU are also covered by mutual adequacy. Transfers to US analytics, advertising or fulfilment vendors require the EU US Data Privacy Framework or Standard Contractual Clauses and a transfer impact assessment.
Sign the data processing agreement with Shine Commerce, list it in your record of processing activities, document every cookie, deploy a CMP that blocks non essential tags by default, define retention for orders and abandoned carts, audit integrations regularly, restrict admin access and publish a clear cookie and privacy policy linked from every page.
Websites using Shine Commerce must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended for Shine Commerce stores that handle large catalogues, run personalised marketing campaigns, process sensitive product categories or combine in store and online customer data.
Sample consent text
We use essential cookies to operate the store and your cart. With your consent we also use analytics, personalisation and marketing cookies to improve your shopping experience. You can adjust your choices at any time from the cookie preferences link.
Third-party domains contacted
shinecommerce.co.ukcdn.shinecommerce.co.ukcheckout.shinecommerce.co.ukadmin.shinecommerce.co.ukCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| shine_session | first_party | Session | Server side session identifier used to maintain the shopper's state between page views. |
| shine_cart | first_party | 30 days | Identifier of the shopping cart that persists items added to the basket between visits. |
| shine_customer | first_party | 30 days | Reference of the logged in customer for account access, wishlist and order history. |
| shine_currency | first_party | 1 year | Stores the shopper's currency preference for multi currency stores. |
| shine_csrf | first_party | Session | Anti CSRF token that protects form submissions from cross site request forgery. |
| shine_consent | first_party | 12 months | Stores the cookie consent choice and the version of the consent notice presented to the shopper. |
Shine Commerce uses cookies for user preferences — inform visitors with a consent banner.
Shine Commerce sets first party cookies for session, cart, customer login, currency, language and CSRF protection. The merchant's back office also relies on cookies. Optional internal modules (analytics, A/B testing, recommendations) and any enabled third party tags deposit additional cookies.
Strictly necessary cookies for cart, checkout and login do not need consent. Consent is required under PECR and the UK and EU GDPR for analytics, advertising, personalisation and remarketing cookies, including those triggered by integrated tools such as Klaviyo or Meta Pixel.
Order processing relies on the performance of a contract (Article 6(1)(b)). Fraud prevention and security can rely on legitimate interest (Article 6(1)(f)). Analytics, marketing and profiling rely on consent (Article 6(1)(a)) combined with the cookie rules in PECR or Article 5(3) of the ePrivacy Directive.
The core Shine Commerce platform is hosted in the UK with EU fallback, both covered by adequacy decisions in either direction. Transfers to the US can still occur when the merchant enables US analytics, advertising or fulfilment vendors. These require the EU US Data Privacy Framework or SCCs and a transfer impact assessment.
A DPIA is recommended for stores with large catalogues, intensive personalisation, profiling, sensitive product categories (for example wellness or health adjacent goods), or when in store and online customer data are combined to build unified profiles.
Sign the DPA with Shine Commerce, list each sub processor, deploy a CMP that blocks non essential tags by default, document every cookie, define retention for orders and abandoned carts, enforce least privilege on admin accounts, and publish a clear cookie and privacy policy linked from every page.
Alternatives focused on fashion and retail include Centra (Sweden), Hipicon and Lightspeed (Netherlands), Shopify Plus with EU residency, Adobe Commerce on EU hosting, Salesforce Commerce Cloud with EU data centers and self hosted solutions such as Sylius (France) or Shopware (Germany).
List the new cookies, purpose, retention, recipients and any transfer to a third country. Update the CMP categories, refresh the consent banner so shoppers are asked again, version the cookie policy with the publication date and notify the data protection officer if applicable.