Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Wins eCommerce is a Korean hosted e-commerce solution that powers online stores for SME and mid market retailers in South Korea, with growing usage by Korean brands selling internationally including in Europe. The platform sets strictly necessary session and cart cookies and offers optional analytics and marketing modules that require prior consent. Data hosted in Korea benefits from the EU adequacy decision adopted in 2022.
Wins eCommerce is a Korean hosted e-commerce platform aimed at SME and mid market retailers in South Korea. It is increasingly used by Korean brands exporting K beauty, K food, fashion and accessories to European audiences. The platform provides storefront templates, a checkout, an order management system and a marketplace integration layer for OTAs and global marketplaces.
The platform sets a session cookie, an authentication cookie and a persistent cart cookie. On the server it processes the order itself: customer name, billing and shipping address, payment metadata, email and phone. Optional modules add analytics, recommendation and marketing cookies which are non strictly necessary and require consent.
Session, cart and login cookies fall under the Article 5(3) ePrivacy strictly necessary exemption. Marketing, analytics and recommendation cookies require prior consent. Order, account and address data are processed under contract performance (Article 6(1)(b) GDPR), with the transparency obligations of Articles 13 and 14 GDPR. The transfer of EU customer data to Korean infrastructure relies on the European Commission adequacy decision for Korea (Implementing Decision (EU) 2022/254).
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Cart, login and order processing rely on contract performance (Article 6(1)(b) GDPR). Marketing, analytics and recommendation rely on consent (Article 6(1)(a) GDPR). Fraud prevention relies on legitimate interest (Article 6(1)(f) GDPR). Tax retention relies on legal obligation (Article 6(1)(c) GDPR). A data processing agreement between the merchant (controller) and Wins eCommerce (processor) is required under Article 28 GDPR.
Wins eCommerce hosts the platform in South Korea, which benefits from the EU adequacy decision. Operators must still document the transfer in the privacy notice, name the recipient and reference the adequacy decision, and verify any sub processors used (CDN, payment, fulfilment). Sub processors outside Korea must rely on Standard Contractual Clauses or the EU US Data Privacy Framework where applicable.
Sign the Wins eCommerce DPA, list Wins eCommerce in your privacy notice as a processor, cite the EU Korea adequacy decision and document the sub processor chain. Integrate a CMP with cart and login cookies always on and optional marketing or analytics cookies gated behind consent. Configure retention to align with EU tax and consumer protection obligations and provide a documented data subject rights procedure for customers in the EU.
Websites using Wins eCommerce must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is not generally required for a standard Wins eCommerce deployment because data processing is limited to typical e-commerce flows and the EU Korea adequacy decision mitigates the transfer risk. A DPIA becomes relevant when the operator combines Wins eCommerce with extensive profiling, sensitive product categories or large scale B2C campaigns targeting EU audiences.
Sample consent text
Our online shop runs on Wins eCommerce, a Korean commerce platform. Strictly necessary cookies operate the cart, login and checkout without your consent. With your permission we also activate optional analytics and marketing modules. Your order data is hosted in South Korea, which is recognised by the European Commission as offering an adequate level of data protection.
Third-party domains contacted
winsecommerce.comwins-commerce.kradmin.winsecommerce.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| WINSSESSID | first_party | Session | Server side session identifier set by Wins eCommerce to bind the visitor to a storefront session. |
| wins_cart | first_party | 30 days | Persistent cart cookie used by Wins eCommerce to retain the basket between visits. |
| wins_auth | first_party | 30 days | Authentication cookie set after sign in to maintain the customer session. |
Wins eCommerce uses cookies for user preferences — inform visitors with a consent banner.
A default Wins eCommerce storefront sets a session cookie, an authentication cookie after sign in and a persistent cart cookie. Optional analytics, recommendation and marketing modules add their own cookies which are non strictly necessary and consent gated.
Consent is not required for the strictly necessary cart, login and checkout cookies. Consent is required for any optional analytics, marketing and recommendation cookies enabled by the merchant.
Cart, login and order processing rely on contract performance under Article 6(1)(b) GDPR. Marketing and analytics rely on consent under Article 6(1)(a) GDPR. Fraud prevention relies on legitimate interest under Article 6(1)(f) GDPR. Tax retention relies on legal obligation under Article 6(1)(c) GDPR.
Yes, order data is transferred to South Korea where Wins eCommerce hosts the platform. The transfer is covered by the EU Korea adequacy decision (Implementing Decision (EU) 2022/254), so Standard Contractual Clauses are not required. Sub processors outside Korea may require SCCs or the EU US Data Privacy Framework.
Not generally. The data processed is limited to typical e-commerce flows and the adequacy decision mitigates the transfer risk. A DPIA becomes relevant when the operator adds extensive profiling, sensitive product categories or large scale B2C campaigns targeting EU audiences.
Sign the Wins eCommerce DPA, list Wins eCommerce as a processor in the privacy notice, cite the EU Korea adequacy decision and document the sub processor chain. Integrate a CMP with strictly necessary cookies always on and optional analytics or marketing cookies gated behind consent. Align retention with EU rules and provide a documented data subject rights procedure.
Korean alternatives include Cafe24, Imweb and Makeshop. International alternatives for similar use cases include Shopify, BigCommerce and Lightspeed eCom. EU alternatives such as Shopware (Germany) and PrestaShop (France) simplify the transfer chain.
List the strictly necessary cookies with names and durations. List optional analytics and marketing cookies with purpose, duration and recipient. Mention Wins eCommerce as a processor, describe the EU Korea transfer and cite the adequacy decision as the transfer mechanism.