Review shop information, access and retention settings so they match how you actually use customers' data.

This guide is for whoever manages personal data in an Abicart shop, whether Go, Plus or Pro. GDPR applies to information about identifiable people, including contacts at business customers. One setting or checkbox does not automatically make the entire business compliant.

Inventory the data you use and why: for example contact details, order history, IP addresses, images and support notes. Separate order processing, customer accounts, accounting and marketing. Choose and document a lawful basis for each purpose before using data. Consent is one possible basis, rather than a requirement for all processing.

You are responsible for your processing of shop customers' data. When Abicart processes data on your behalf, this is governed by the data processing agreement. As shop owner, open My profile → Agreements to read available agreements and see their signature status. Read the current agreement and its appendices; general subscription terms are a different document.

If a business customer needs security documentation, collect the specific questions and contact Abicart with the correct shop ID. Check current information about storage, subprocessors, security measures and recovery. Do not describe a certification or recovery promise as verified merely because a general GDPR guide exists.

Create or update a page under Pages with your privacy information. Describe your identity, contact route, data, purposes, lawful bases, recipients, relevant transfers, retention and how people exercise their rights. Adapt it to the payment, delivery, analytics and marketing services you actually use. Do not copy an old standard list as if every shop collected identical data.

Have a process to identify someone requesting access, correction or erasure. Erasure is not unconditional: some data may need to be retained for a legal obligation, for example. Distinguish customer records from information on orders and in connected systems.

Use a clear, voluntary signup, such as “Yes please, I want newsletters”. Do not preselect consent or make optional marketing a compulsory purchase condition. Retain evidence of signup and handle unsubscribes in all relevant mailing services. A past signup does not automatically need repeating merely because it is old; assess whether it remains valid for the current purpose.

The Wants newsletters setting controls the built-in mailing audience. An account, purchase or customer group is not itself a newsletter subscription. The built-in sending function requires Plus or Pro.

Distinguish necessary cookies from other purposes such as analytics and marketing. Non-essential cookies normally require active consent before use. Check that visitors can reject and later change their choice, and that external scripts respect it. An information banner alone does not prove this.

In Diversity themes, Demand consent can show cookie choices as a modal and prevent further use until the visitor accepts or rejects. The name does not mean visitors must accept every cookie. Modal presentation is not itself a general legal requirement or proof that scripts are blocked correctly. Check the shop's actual consent solution and distinguish it from TPL's separate Consent Manager.

There is no general GDPR rule allowing every shop to retain customer addresses for exactly one year, or always allowing a particular industry four to five years. Set periods according to purpose and other applicable requirements. Ended marketing and accounting records can therefore need different treatment.

Swedish accounting information normally must be retained through the seventh year after the calendar year in which the financial year ended. This is not always the same date as seven years after an order. Ensure necessary accounting information is preserved in a complete, readable archive before personal data is anonymised.

Under Orders → Settings you can find the period for retaining order personal data. It can trigger automatic anonymisation. Check the period against your documented process and retention obligations before saving, including individual sub-shops where relevant. This is not a general deletion of customer records, external copies or all integration data.

Under Customers → Customers , the Last active before filter can help identify records for assessment. It is a technical selection, rather than an automatic decision that all results may be deleted. Review the selection before choosing Remove selected customers. Check which rows are actually selected and the page size; normally 50 appear at a time. A larger page size does not itself authorise deletion of more data.

Business terms, privacy information, newsletters and cookies are separate matters. A privacy policy informs people about processing; do not introduce compulsory marketing consent by calling it acceptance of the policy.

For a Diversity theme offering the function, first create the page to link to. Then open Appearance → Themes → Edit → Content → Checkout → Mandatory approvals. Add a checkbox, enter its title and link text, select the actual page under Link URL → Pages and save. Check the shop's actual checkout: an external checkout may handle conditions and fields differently.

If an unexpected text field appears in checkout, identify whether it comes from these approvals, customer fields, the theme or the payment provider before changing anything. Do not remove a required detail merely because it is absent from the theme's approval list.

Personal data responsibilities apply to all subscriptions. Built-in newsletters are available in Plus and Pro. The theme and checkout determine visible controls; a visual label cannot replace a lawful assessment or actual script handling.