# Lawful bases

> Suggested GDPR lawful bases for each kind of processing the ShopAssist widget does, for your record of processing.

Source: https://shopassist.coec.dk/docs/compliance/lawful-bases · Updated 2026-10-01

As the controller you decide the lawful basis for each processing purpose. These are our suggestions; confirm them with your adviser.

| Processing by the widget                                                           | Suggested basis                                                                                                                                                  |
| ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Answering shopper questions, product search, recommendations                       | Art. 6(1)(b) GDPR (steps at the shopper's request before a contract) or Art. 6(1)(f) (legitimate interest in customer service)                                   |
| Order status, cancellations and return requests for signed-in or verified shoppers | Art. 6(1)(b) (performance of the purchase contract)                                                                                                              |
| Handoff to your support team or helpdesk                                           | Art. 6(1)(b) or (f); the shopper sees and accepts your share notice first                                                                                        |
| Transcript email, back-in-stock alert                                              | Art. 6(1)(b) (a service the shopper asked for)                                                                                                                   |
| Newsletter and marketing email opt-in                                              | Art. 6(1)(a) consent, plus national marketing law (for example the Danish markedsføringsloven § 10): prior, specific consent, no pre-ticked boxes, double opt-in |
| Visitor id, cross-session attribution, proactive-message frequency caps            | ePrivacy consent through your consent banner (CMP), and Art. 6(1)(a)                                                                                             |

## How ShopAssist supports this [#support]

* Consent-based storage is written only after your CMP reports consent; see [consent and CMP](/docs/widget/consent-and-cmp).
* Newsletter consent is collected with an unticked checkbox, the exact text is stored with its version, and sign-ups are confirmed by double opt-in; see [lead capture and consent](/docs/engagement/lead-capture-and-consent).
* Handoff consent (the share notice) is recorded per conversation.

Describe these purposes in your privacy policy, for example with the [shopper privacy notice](/docs/compliance/shopper-privacy-notice).