Swym Wishlist Plus

The Swym tag sets a small set of first party cookies that identify the visitor (a pseudonymous Swym visitor ID), keep the local wishlist state on the device, and link the storefront session to a Swym server side context. A third party cookie on the swymrelay.com domain (or the merchant Swym subdomain) is set when the visitor interacts with cross device or notification features. All these cookies are non strictly necessary and require consent.

Yes. Swym writes identifiers and stores wishlist activity that go beyond the strictly necessary scope of Article 5(3) ePrivacy Directive, and it transmits personal data (including potentially email and phone) to the United States. The Swym tag must therefore remain blocked until the visitor accepts the relevant CMP category (functional or marketing depending on how strict the operator wants to be) or explicitly engages with a wishlist feature for the first time.

The default legal basis for the Swym tag, wishlist tracking and notification subscriptions is consent under Article 6(1)(a) GDPR. For wishlists bound to a logged in customer account, contract performance under Article 6(1)(b) GDPR can support the persistence of the wishlist data linked to the account, but the marketing notifications still rest on consent and on the ePrivacy direct marketing rules.

Yes. Swym Corporation is established in the United States and operates its production environment on AWS US regions. Personal data collected from EU visitors (identifiers, wishlist content, email and phone numbers if provided) is therefore transferred to the US. Swym signs Standard Contractual Clauses with merchants and, where applicable, is certified under the EU US Data Privacy Framework, which together cover the legal mechanism for the transfer.

A DPIA is normally not required for using Swym on a typical D2C store, because the volume and sensitivity of the data are modest. A DPIA becomes recommended when the merchant combines Swym with broader customer profiling, sells sensitive categories (health, financial services, adult content), targets minors, or enables high frequency SMS notifications that increase the intrusiveness of the processing.

Block the Swym JavaScript tag in your CMP until the visitor accepts the relevant category. Sign the Swym data processing agreement, list Swym Corporation in your privacy notice as a sub processor, and mention the US transfer with the applicable mechanism. Configure the integration to send only the data needed for the feature you actually use (avoid pushing full customer profiles), and surface a way to remove the wishlist when the visitor exercises their right to erasure.

For Shopify and BigCommerce stores, alternative wishlist apps include Wishlist Hero, Wishl, Smart Wishlist by Webkul, Growave and Wishlist King. From a GDPR perspective they all process broadly similar data; Growave is built by an EU based team but also processes data outside the EEA. EU hosted SaaS alternatives are rarer in this category, so the focus is on transparent disclosure and a strong consent gate.

Add a section to the cookie policy listing the Swym cookies (visitor ID, wishlist state, session, notification preferences) with their name, duration, purpose and Swym as recipient. Add Swym Corporation to the sub processor list in your privacy notice, describe the US transfer and reference the EU US Data Privacy Framework. Mention the right to withdraw consent at any time and the procedure for deleting the wishlist data.