Compliance
GDPR overview
Who is controller and processor for ShopAssist data, where data is processed and what you need to do as a merchant.
Not legal advice
These pages explain how ShopAssist works so you can meet your obligations. They are not legal advice; check your setup with your own adviser.
Roles
- You (the merchant) are the controller of your shoppers' data: conversations, leads, orders looked up in the chat and analytics.
- COEC (ShopAssist) is your processor under the Data Processing Agreement and processes that data only on your instructions.
- COEC is controller only for your team's account data (names, emails, sign-in records) and billing data. See the privacy policy.
- With your own AI key (BYOK) or a helpdesk integration, that provider is your processor under your own agreement with it, not COEC's sub-processor.
Where data is processed
ShopAssist runs in Germany. Managed AI uses EU processing where the provider offers it; each model's processing location is listed in the dashboard and on the sub-processors page. See data location and retention.
Your checklist
- Accept the DPA (an owner does this at signup or under Organization → Legal). The live widget stays disabled until it is accepted.
- Choose lawful bases for the processing you enable.
- Add the shopper privacy notice to your privacy policy.
- Connect your consent banner (CMP) and list the widget's storage in your cookie policy; see storage and cookies.
- Set retention for transcripts and leads.
- Know how to handle data subject requests.
- If your store is not a microenterprise, publish the accessibility service information.
Personal data the widget handles
| Data | When |
|---|---|
| Messages and attachments | every conversation (redaction removes card numbers and similar data before storage) |
| Name and email | when the shopper signs in, leaves contact details or asks for a handoff |
| Order numbers and statuses | when the shopper asks about orders |
| Widget session and visitor ids | session id always; the visitor id only with consent |
| Analytics events | aggregated; linked to orders only as described in attribution |
ShopAssist is not meant for special-category data or services for children; see sensitive verticals.
Last updated on