Lawful bases

Suggested GDPR lawful bases for each kind of processing the ShopAssist widget does, for your record of processing.

As the controller you decide the lawful basis for each processing purpose. These are our suggestions; confirm them with your adviser.

Processing by the widget	Suggested basis
Answering shopper questions, product search, recommendations	Art. 6(1)(b) GDPR (steps at the shopper's request before a contract) or Art. 6(1)(f) (legitimate interest in customer service)
Order status, cancellations and return requests for signed-in or verified shoppers	Art. 6(1)(b) (performance of the purchase contract)
Handoff to your support team or helpdesk	Art. 6(1)(b) or (f); the shopper sees and accepts your share notice first
Transcript email, back-in-stock alert	Art. 6(1)(b) (a service the shopper asked for)
Newsletter and marketing email opt-in	Art. 6(1)(a) consent, plus national marketing law (for example the Danish markedsføringsloven § 10): prior, specific consent, no pre-ticked boxes, double opt-in
Visitor id, cross-session attribution, proactive-message frequency caps	ePrivacy consent through your consent banner (CMP), and Art. 6(1)(a)

How ShopAssist supports this

Consent-based storage is written only after your CMP reports consent; see consent and CMP.
Newsletter consent is collected with an unticked checkbox, the exact text is stored with its version, and sign-ups are confirmed by double opt-in; see lead capture and consent.
Handoff consent (the share notice) is recorded per conversation.

Describe these purposes in your privacy policy, for example with the shopper privacy notice.