Syndeca

Syndeca is a US based shoppable content platform that helps retailers turn catalogs, lookbooks, flyers and product imagery into interactive, shoppable experiences embedded directly on their own website. When you add the Syndeca embed code, the platform loads its widget and its integrated Google Analytics, which together observe how visitors browse and interact with the embedded content. This page explains, in plain terms, what data the embed processes, the cookies it can set, and what European operators need to consider under the GDPR and the ePrivacy Directive.

What Syndeca is

Syndeca provides a hosted platform for digital catalogs, shoppable lookbooks, weekly ads and circulars, shoppable images and shoppable video. Retailers create content in the platform and publish it to their site with an embed code, so the experience feels native while the content and assets are served from Syndeca infrastructure on a content delivery network. The platform is designed to render across desktop, tablet and mobile devices, and it includes integrated analytics so merchandising and marketing teams can measure how each catalog performs.

Data and cookies collected

The embed processes visitor interaction and engagement data, such as which catalog pages, products and hotspots are viewed and clicked, how long visitors stay and which links they follow. Through its integrated Google Analytics, Syndeca can set first and third party cookies, including the Google Analytics _ga style identifiers used to distinguish visitors and sessions. These cookies, together with device and approximate location signals derived from the connection, allow the platform to attribute engagement and measure catalog performance over time.

GDPR and ePrivacy implications

Because Syndeca relies on cookies and analytics that are not strictly necessary to deliver the page, two legal regimes apply. The ePrivacy Directive requires informed, prior consent before such cookies are stored or read on a visitor device, and the GDPR governs the resulting processing of personal data, including the identifiers in those cookies. As the website operator you are typically the controller for this processing, so you remain responsible for transparency, lawful basis and honouring visitor choices, even though Syndeca acts as a processor and Google operates the analytics layer.

Consent requirements

The appropriate lawful basis for the analytics and marketing cookies set through the embedded catalog is consent under Article 6(1)(a) of the GDPR, given freely, specifically and on the basis of clear information. In practice this means the Syndeca embed and its Google Analytics should be blocked until the visitor actively accepts, and refusing should be as easy as accepting. A consent management platform that gates the embed script keeps you aligned with both the ePrivacy consent rule and the GDPR record keeping expectations.

Data transfers

Syndeca is hosted in the United States and serves its content from US based infrastructure, and the integrated Google Analytics also processes data on US systems. For visitors in the European Union and the wider European Economic Area, this means personal data is transferred to a third country. Such transfers should be covered by an appropriate mechanism, most commonly the EU US Data Privacy Framework where the recipient is certified, or Standard Contractual Clauses supported by a transfer impact assessment and supplementary safeguards.

Practical compliance steps

Start by mapping every cookie and data flow the embed creates, then load the Syndeca script only after consent through your consent management platform. Name Syndeca and its analytics in your cookie policy and privacy notice, describe the US transfer and the safeguard you rely on, and keep a processing agreement with the vendor. Set sensible retention limits, test that declining consent truly prevents the cookies, and review the setup whenever Syndeca or Google changes how the integrated analytics behaves.