Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Yampi is a Brazilian e commerce platform and checkout solution for online stores. It sets functional cookies for the storefront and checkout and can add analytics and marketing, and because it is operated from Brazil it raises consent and international data transfer obligations under the GDPR.
Yampi is a Brazilian e commerce platform that provides an online store builder and a hosted checkout used by merchants to sell products. It powers the storefront, cart, and payment flow, and can add marketing and analytics features to help merchants grow sales.
Yampi sets functional cookies for the storefront, cart, and checkout, and can add analytics and marketing cookies that track browsing and support remarketing. It processes the customer and order data entered during a purchase along with browsing data, which is personal data under the GDPR.
Functional store and checkout cookies are exempt under Article 5(3) ePrivacy, while analytics and marketing cookies require consent. Because Yampi is operated from Brazil, a country without an EU adequacy decision, personal data is transferred to a third country and you must put Standard Contractual Clauses and a transfer impact assessment in place.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Load only the strictly necessary store and checkout cookies by default and gate analytics and marketing behind consent. Inform customers that their data is processed in Brazil, and make sure no non essential tag fires before consent is given.
Sign a data processing agreement with the Standard Contractual Clauses, run a transfer impact assessment for the Brazil transfer, and disclose the cookies and the transfer in your policies. Set retention for customer and analytics data and review the configuration as the platform evolves.
Websites using Yampi Virtual store must obtain user consent under GDPR regulations.
DPIA considerations
Because Yampi transfers personal data to Brazil and can profile customers for marketing, a transfer impact assessment is required and a DPIA is advisable where it processes significant volumes of customer data. Document the safeguards and the necessity of the transfer.
Sample consent text
We use Yampi to run our online store and checkout. Analytics and marketing cookies, including transfers to Brazil, are only used if you accept them.
Third-party domains contacted
yampi.com.brcdn.yampi.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| yampi_cart | Functional | Session | Keeps the storefront and checkout session and cart |
| yampi_pref | Functional | 6 months | Remembers store preferences during the purchase process |
| yampi_analytics | Analytics | 1 year | Measures how visitors browse the store |
| yampi_mkt | Marketing | 90 days | Supports remarketing and campaign attribution |
Yampi Virtual store uses cookies for user preferences — inform visitors with a consent banner.
Yampi sets functional cookies for the storefront, cart, and checkout, and depending on configuration analytics and marketing cookies that track browsing and support remarketing. Only the store cookies are strictly necessary.
The functional store and checkout cookies are exempt under Article 5(3) ePrivacy, but the analytics and marketing cookies require prior consent and must stay blocked until the visitor accepts.
Running the store and checkout relies on performance of a contract under Article 6(1)(b), while analytics and marketing cookies rely on consent under Article 6(1)(a) and Article 5(3) ePrivacy.
Yes. Yampi is operated from Brazil, which has no EU adequacy decision, so personal data is transferred to a third country. You need Standard Contractual Clauses, a transfer impact assessment, and clear disclosure.
A transfer impact assessment is required for the Brazil transfer, and a DPIA is advisable where the store processes significant volumes of customer data or profiles customers for marketing.
Block non essential cookies until consent, sign a data processing agreement with the SCCs, complete a transfer impact assessment, disclose the cookies and Brazil transfer, and set retention for customer data.
EU hosted store and checkout platforms avoid the international transfer entirely and simplify compliance. Any platform that adds analytics or marketing cookies still requires consent for those purposes.
List the functional, analytics, and marketing cookies with their purpose and duration, state that data is transferred to Brazil, and name the safeguard. Keep the entry current as the platform changes.