Loading...

Last updated: Jun 19 2018

Episerver Commerce

Collecting data

  • Contact Data. E-commerce customer registers or is registered by the Customer Service Department.
  • Order Data. E-commerce customer completes a purchase or is registered by the Customer Service Department.
  • Shopping Cart. E-commerce customer add items to shopping cart. This is viewable by different default admin roles in Commerce Manager.

Note: Avoid at all times storing this data in other custom locations, or you will be responsible for keeping track of PII data that could be susceptible to GDPR compliance.

Any page requesting input of PII data should be using HTTPS protocol, TLS 1.2 or later.

Asking for consent

You should by default enable double opt-in informing the end user of their rights and asking for consent. An example of double opt-in is available in the Episerver Commerce reference site Quicksilver. 

Storing data

On-premise installations require encryption of your database instance TDE and encryption at rest.

In Episerver DXC, TDE is enabled by default.

Using data

You should inform the end user about how the user data is used and to what purpose.

Fetching data

You should be able to fetch most types of data by querying the Commerce database. A request to the Managed Services team for fetching data about a user can be made in cases where you cannot fetch the data yourself.

Deleting data

You should be able to delete most types of data by querying the Episerver Commerce database. A request to the Managed Services team  for deleting data can be made in cases where you cannot delete the data yourself.


Do you have feedback on this documentation? Send an email to documentation@episerver.com. For development-related questions and discussions, refer to our Forums on https://world.episerver.com/forum/