Customer Data and GDPR
Overview
When navigating data privacy laws, such as the General Data Protection Regulation (GDPR), Shoplift is committed to ensuring that merchants can stay compliant effortlessly while still benefiting from powerful A/B testing and revenue optimization tools.
In this article, we will explain Shoplift’s role as a data processor, how merchants are responsible as data controllers, and the steps we take to ensure that data collection is only done with visitor consent.
We will also discuss how Shoplift uses a blend of essential and analytics tracking methods to maintain a seamless website experience, even when consent is declined.
For a full overview of our data collection practices, see our Data Processing Addendum.
Data controllers and data processors
Firstly, it's important to understand the distinction between data controllers and data processors under GDPR:
Merchants as Data Controllers
Merchants who use Shoplift are considered data controllers, meaning they determine the purpose and legal basis for collecting and processing visitor data. This also means that merchants are responsible for obtaining visitor consent in regions where it is required (such as the European Union) before any data is collected.
Shoplift as a Data Processor
Shoplift acts as a data processor, meaning we handle data on behalf of merchants based on the permissions and consent that merchants obtain from their visitors. Our responsibility is to process data securely and only in line with the merchant’s instructions and the applicable privacy laws.
Obtaining consent for data collection
Depending on the regions in which a you operate your store, GDPR and other privacy laws may require explicit visitor consent before any data collection occurs. Shoplift makes it easy for merchants to stay compliant out of the box.
1. Shopify's Customer Privacy API
By default, Shoplift leverages Shopify’s Customer Privacy API, which determines whether a visitor has granted analytics consent to collect data. If you use Shopify's data compliance tools, then no action is required to ensure Shoplift remains compliant with customer privacy laws:
If analytics consent is granted, Shoplift collects anonymized event data to run and measure experiment performance.
If analytics consent is declined, Shoplift ensures that no visitor data is collected, logged, or stored in any way, allowing merchants to respect the privacy choices of their visitors.
This process is seamless, meaning that merchants can focus on running their business without worrying about GDPR compliance.
2. Third-Party Consent Management Tools
If you use third-party tools to manage consent, Shoplift will be compliant out-of-the-box as long as your consent management platform is able to hook into Shopify's Customer Privacy API.
If you use a third-party consent management platform that does not hook into Shopify's Customer Privacy, we provide a method in our JavaScript API that can be called to set a boolean value for analytics consent:
Tracking methods to ensure compliance
To provide the best possible user experience, Shoplift uses a combination of essential tracking and analytics tracking:
Essential tracking ensures that the website operates smoothly and delivers necessary functionality, regardless of consent.
Analytics tracking is only activated if analytics consent is granted by the visitor. This allows us to collect valuable, anonymized data to drive A/B testing, personalization, and optimization efforts.
Shoplift’s approach ensures that there is no “flicker” effect—an undesirable momentary disruption in the website’s appearance or performance—when conducting tests. Even if consent is denied, Shoplift maintains a stable and optimized user experience, ensuring your website performs at its best while respecting user privacy.
Does Shoplift collect identifiable information about website visitors?
When collecting data about website visitors, Shoplift does not log or store any personal identifiable information (PII). This includes information like name, email, phone number, IP address, or location.
Why does Shopify say Shoplift needs access to sensitive customer data when I install the app?
In order to access web pixel events from Shopify's servers, our app requires access to Shopify's Customer Event data.
In order to access this Customer Event data, Shoplift needs to request the necessary access scopes. The scopes required to access to this anonymized event data are bundled in with access to PII data like name, address, and phone number. This is why Shopify will display a message informing you of access to sensitive customer data during install.
Shoplift does not collect, log, or store any personal identifiable information from customers.
Last updated