# GDPR overview

> Who is controller and processor for ShopAssist data, where data is processed and what you need to do as a merchant.

Source: https://shopassist.coec.dk/docs/compliance/gdpr-overview · Updated 2026-10-01

> **Not legal advice:** These pages explain how ShopAssist works so you can meet your obligations. They are not legal advice; check your setup
> with your own adviser.

## Roles [#roles]

* **You (the merchant)** are the **controller** of your shoppers' data: conversations, leads, orders looked up in the chat and analytics.
* **COEC** (ShopAssist) is your **processor** under the [Data Processing Agreement](/docs/compliance/dpa) and processes that data only on your instructions.
* COEC is controller only for your team's account data (names, emails, sign-in records) and billing data. See the [privacy policy](/legal/privacy).
* With your own AI key (BYOK) or a helpdesk integration, that provider is **your** processor under your own agreement with it, not COEC's sub-processor.

## Where data is processed [#location]

ShopAssist runs in Germany. Managed AI uses EU processing where the provider offers it; each model's processing location is listed in the dashboard and on the [sub-processors page](/subprocessors). See [data location and retention](/docs/ai/data-location-and-retention).

## Your checklist [#checklist]

1. Accept the DPA (an owner does this at signup or under **Organization → Legal**). The live widget stays disabled until it is accepted.
2. Choose [lawful bases](/docs/compliance/lawful-bases) for the processing you enable.
3. Add the [shopper privacy notice](/docs/compliance/shopper-privacy-notice) to your privacy policy.
4. Connect your consent banner (CMP) and list the widget's storage in your cookie policy; see [storage and cookies](/docs/compliance/storage-and-cookies).
5. Set [retention](/docs/compliance/retention) for transcripts and leads.
6. Know how to handle [data subject requests](/docs/compliance/data-subject-requests).
7. If your store is not a microenterprise, publish the [accessibility](/docs/compliance/accessibility) service information.

## Personal data the widget handles [#data]

| Data                           | When                                                                                                                      |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------- |
| Messages and attachments       | every conversation (redaction removes card numbers and similar data before storage)                                       |
| Name and email                 | when the shopper signs in, leaves contact details or asks for a handoff                                                   |
| Order numbers and statuses     | when the shopper asks about orders                                                                                        |
| Widget session and visitor ids | session id always; the visitor id only with consent                                                                       |
| Analytics events               | aggregated; linked to orders only as described in [attribution](/docs/analytics/assisted-revenue-and-attribution#consent) |

ShopAssist is not meant for special-category data or services for children; see [sensitive verticals](/docs/compliance/sensitive-verticals).