> Spreadr and the GDPR: US data transfers in dropshipping, customer data shared with suppliers, SCCs and how to mention Spreadr in your privacy policy.
>
> Canonical: https://www.flowconsent.com/en/services/ecommerce/spreadr

E-commerce

# Spreadr

Preferences · [Official website](https://spreadr.co)

Spreadr is a US-based dropshipping and product import platform for e-commerce stores, particularly Shopify. It enables store owners to import products from Amazon and other marketplaces and forward orders to suppliers for fulfilment. Customer order data including names, shipping addresses, and purchase details are transmitted to US infrastructure. SCCs and a DPA with Spreadr are required.

[Block Spreadr until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan)

At a glance

- Category

  [E-commerce](https://www.flowconsent.com/en/services/ecommerce)

- Consent

  Preferences

- Prior consent

  Not required

- Documented cookies

  4

- Third-party domains

  3

- Servers

  United States (Spreadr is a US-based service)

Overview

## What does Spreadr do?

## **What is Spreadr?**

Spreadr is a dropshipping app for e-commerce platforms, primarily Shopify, that enables store owners to import products from Amazon and fulfil orders through Amazon FBA or third-party suppliers. When a customer places an order, Spreadr forwards the order data to the relevant supplier for fulfilment.

## **GDPR and order data sharing**

Customer name, address, and order data are shared with Spreadr (US) and then with Amazon or third-party suppliers for fulfilment. This is a controller-to-processor transfer for Spreadr and potentially a controller-to-controller transfer for the end supplier. SCCs are required. Customers must be informed of data sharing with fulfilment partners.

## **Practical compliance steps**

Disclose in your privacy policy that order data is shared with Spreadr and fulfilment partners for order processing. Sign DPA with Spreadr. Implement SCCs. Limit data shared with suppliers to what is strictly necessary for delivery. Provide customer contact for data subject rights requests.

Compliance

## Spreadr and the GDPR

- Legal basis

  Contract performance (Art. 6(1)(b)) for order fulfilment is the primary basis for transmitting customer data to Spreadr and suppliers. Customers must be informed in the privacy policy about data sharing with fulfilment partners.

- Risk level

  medium

- Applicable regulations

  GDPR, ePrivacy Directive

### Impact assessment (DPIA)

A DPIA may be required for large-scale dropshipping operations involving significant volumes of EU customer data transmitted to multiple US suppliers.

### Sample text for your banner

> This store uses Spreadr for order fulfilment. Your order data (name, address) is shared with our fulfilment partners in the US under Standard Contractual Clauses to deliver your purchase. See our privacy policy.

Cookies and trackers

## What Spreadr sets and contacts

- Tracking method

  E-commerce product import and dropshipping platform, order forwarding, customer data transmission to suppliers

- Server location

  United States (Spreadr is a US-based service)

- Cookieless mode available

  Yes

- Data transferred outside the EU

  Spreadr is a US-based dropshipping and product import service for e-commerce platforms. Customer order data including names, addresses, and purchase details are forwarded to US infrastructure and potentially to third-party suppliers. SCCs and DPAs are required.

### Cookies set (4)

| Name               | Type          | Duration | Purpose                                                                                            |
| ------------------ | ------------- | -------- | -------------------------------------------------------------------------------------------------- |
| \_spreadr\_session | functionality | Session  | Maintains the authenticated session for the Spreadr product import and order management dashboard. |
| \_spreadr\_store   | functionality | 30 days  | Identifies the connected Shopify store for product synchronisation and order forwarding.           |
| \_spreadr\_track   | analytics     | 6 months | Tracks product import activity and order conversion metrics for merchant reporting.                |
| \_spreadr\_csrf    | security      | Session  | Provides CSRF protection for order forwarding and product management actions.                      |

### Third-party domains contacted (3)

- `app.spreadr.app`
- `api.spreadr.app`
- `cdn.shopify.com`

Questions

## Frequently asked questions about Spreadr

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### What cookies does Spreadr set?

Spreadr is a Shopify app for importing and syndicating Amazon products. It sets session cookies to manage the integration between your Shopify store and Amazon product listings. Additional cookies may be used for affiliate tracking and product synchronization states.

### Is consent required to use Spreadr?

Consent requirements depend on how Spreadr is configured. If the app sets cookies on visitors' browsers for affiliate tracking or analytics purposes, prior consent is required under the ePrivacy Directive. Cookies strictly necessary for the store's checkout functionality may be exempt from consent.

### What is the legal basis for using Spreadr?

For essential ecommerce functionality, legitimate interest under Article 6(1)(f) GDPR can apply. For affiliate tracking cookies and any non essential data collection, consent under Article 6(1)(a) is required. Review which Spreadr features set optional versus necessary cookies.

### Does Spreadr transfer data to third countries?

Yes, Spreadr connects your store to Amazon's infrastructure, which involves data transfers to the United States. Ensure that your data processing agreement with Spreadr includes Standard Contractual Clauses and that your privacy policy discloses these transfers to visitors.

### Is a DPIA required for Spreadr?

A DPIA is generally not mandatory for standard Spreadr usage. However, if you combine Spreadr with extensive user profiling, behavioral tracking across multiple stores, or large scale affiliate monitoring, conducting a DPIA would be prudent under Article 35 GDPR.

### How do I implement compliance with Spreadr?

Configure your Shopify consent management to block Spreadr's non essential cookies until consent is granted. Ensure your privacy policy mentions Amazon product syndication and affiliate tracking. Review Spreadr's data processing practices and include them in your Records of Processing Activities.

### Are there privacy friendly alternatives to Spreadr?

Consider product import solutions that do not set third party cookies or rely on affiliate tracking. Manual product listings eliminate external data flows entirely. Some Shopify apps offer server side product syndication without client side tracking scripts.

### How do I update my cookie policy for Spreadr?

Document all cookies Spreadr sets, including affiliate tracking identifiers, session cookies, and any Amazon related cookies. Specify their purposes, durations, and whether they are first party or third party. Include Spreadr in the list of third party services in your cookie declaration.

Same category

## More services: E-commerce

[See the whole category](https://www.flowconsent.com/en/services/ecommerce)

### [American Express](https://www.flowconsent.com/en/services/ecommerce/american-express)

[American Express is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. American Express supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, American Express ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/american-express)

[Preferences](https://www.flowconsent.com/en/services/ecommerce/american-express)

·

### [Vagaro](https://www.flowconsent.com/en/services/ecommerce/vagaro)

[Vagaro is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Vagaro supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Vagaro ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/vagaro)

[Preferences](https://www.flowconsent.com/en/services/ecommerce/vagaro)

·

### [Simple Goods](https://www.flowconsent.com/en/services/ecommerce/simple-goods)

[Simple Goods is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Simple Goods integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Simple Goods helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/simple-goods)

[Preferences](https://www.flowconsent.com/en/services/ecommerce/simple-goods)

·

### [Bandwango](https://www.flowconsent.com/en/services/ecommerce/bandwango)

[Bandwango is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Bandwango offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Bandwango empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/ecommerce/bandwango)

[Analytics](https://www.flowconsent.com/en/services/ecommerce/bandwango)

·

### [Foratable](https://www.flowconsent.com/en/services/ecommerce/foratable)

[Foratable is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Foratable provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Foratable helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/ecommerce/foratable)

[Preferences](https://www.flowconsent.com/en/services/ecommerce/foratable)

·

### [GLAMI](https://www.flowconsent.com/en/services/ecommerce/glami)

[Glami is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Glami provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Glami helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/ecommerce/glami)

[Marketing](https://www.flowconsent.com/en/services/ecommerce/glami)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)