Magento 2 GDPR Extension

Magento 2 GDPR Extension FAQ

• How to Update Given Privacy Consents via GDPR Data Privacy Center

  The Data Privacy Center introduced by Magento 2 GDPR, LGPD, and CCPA extensions, allows your website visitors to give and then update cookie consent preferences as well as checkboxes consents.

  A user can block previously allowed cookies or accept the previously declined preferences in a few simple steps. This feature ensures that your website complies with data privacy rules and regulations.

  How a Customer Can Update Cookie Consent Preferences

  A user can revise the consent preferences right from My Privacy Center accessed from My Account or the link in the footer:

  1. In Privacy Center, go to the Cookie Settings section.
  2. Click Accept All or Decline All to change all the consent preferences at once.
     
     
  3. If you want to change the consent associated with a specific cookie category, switch the toggle button next to the corresponding category.
  4. Click Confirm My Choices to save the changes.
     
     

  How a Customer Can Update the Checkboxes Consents

  A user can revise the consent preferences right from My Privacy Center accessed from My Account or the link in the footer:

  1. In Privacy Center, go to the My Consents section
  2. Check or uncheck the corresponding box and click Update.
     
     

  Please note that if a checkbox is set as required by the admin, it cannot be unchecked. Therefore, if a user wants to revoke consent, this can only be done by deleting the account.

  How a Customer Can Access Cookie and Privacy Policies

  A customer can easily access both Cookie and Privacy Policies pages from the Data Privacy Center.
  
  

  A website admin can set CMS pages for Cookie and Privacy Policies from the Magento Data Privacy extension configuration:

  • Go to Plumrocket -> Configuration -> Data Privacy -> Privacy Center Dashboard.
  • Make sure you have selected the correct CMS pages and click Save Config, as shown in the screenshot below.
    
    

  The above is complementary to the Data Protection measures implemented on your Magento store. Thus, you achieve an even better user experience and more complete GDPR compliance.

• How to Download and Remove Account Data via GDPR Data Privacy Center

  Magento 2 GDPR, LGPD, and CCPA extensions add the Data Privacy Center page to your store, allowing your website visitors to manage personal data in one place. For example, order history, addresses, reviews, and other personal information collected by your website can be downloaded or deleted in a few clicks, which becomes an easy and painless process for a customer.

  How Customers Can Download Personal Data

  A user can download personal data in CSV format right from the Data Privacy Center:

  1. In Privacy Center, go to the Download your Data section.
  2. Click Download My Data and provide an account password to confirm the identity.
  3. Open the downloaded file in Microsoft Excel, Google Sheets, or other similar services.

  How Customers Can Request a Data Removal

  1. In Privacy Center, go to the Delete your Account section.
  2. Click Delete My Account, and provide your account password to confirm the deletion.

  Please note that it takes up to 24 hours for the system to delete the data permanently. However, if a user logs in again within this time, the data removal is automatically canceled. Additionally, customers can contact the Data Protection Officer and ask to cancel the request. In this case, a website admin cancels the request from the backend in the Data Removal Requests grid.

  How to Contact the GDPR Data Protection Officer

  The GDPR requires eCommerce store owners to assign a Data Protection Officer and let customers easily contact them.

  A customer can email the Data Protection Officer right from the Data Privacy Center by clicking the corresponding tab. Please note that you have to set the email address of a contact person from the backend.

  Are you interested in how Data Privacy Center works? Check the article for more details!

• How GDPR Data Privacy Center Works

  What is Data Privacy Center

  Data Privacy Center is a part of Magento 2 GDPR Extension, as well as CCPA and LGPD modules designed to keep all data privacy settings and management options in one place. It helps your customers understand and see how you as a store owner handle their personal information. Additionally, the Magento privacy center is available for both logged-in users and unauthorized visitors.

  What Options are Available in Data Privacy Center

  GDPR Data Privacy Center allows your website visitors to manage their personal information used by your website and update their consents. In particular, your customers can:

  • Update cookie consent preferences
  • Update checkboxes consents
  • Download account data
  • Request a data removal
  • Contact data protection officer
  • View Cookie and Privacy Policies

  Where Customers Can Find Data Privacy Center

  All logged-in customers can access the Data Privacy Center in My Account -> My Privacy Center (see the screenshot below).

  How Guests Can Access Data Privacy Center

  GDPR Extension allows all unauthorized visitors to access the Magento Privacy Center. Guests can view and manage all collected information that is associated with their email address. They should go to the Privacy Center in the page footer that redirects to another page where the visitor should enter the email.

  After clicking on the Privacy Center link in the footer, unauthorized users are prompted to enter their email addresses in order to access their collected personal data. Once provided, they will get an email with instructions and a token-based link. The link takes users to the Privacy Center dashboard, allowing them to view and manage all collected data associated with the provided email address.

  Sometimes, users may see a popup window informing that there is no data associated with the entered email address.

  To sum up, Data Privacy Center provides all the necessary details for your customers in one place that can be accessed either by logging in to their account (for logged-in customers) or providing an email address (for guest users).

  Do you have any other questions? Feel free to contact our Customer Support!

• How to Set Up Magento 2 GDPR Extension for EU Visitors Only

  The General Data Protection Regulation (GDPR) requires you, as an online store owner who collects customer data, to ask EU customers for consent to process their personal information. The best way to implement the proper GDPR compliance into your store is to use our Magento 2 GDPR plugin.

  The GDPR Extension helps your Magento 2 store meet the GDPR requirement. It includes GeoIP functionality allowing you to automatically detect the country where a user is located and personalize the data for that viewer. If you work with international customers, you can benefit from the GeoIP restrictions and collect privacy consents from EU visitors only.

  How to Display Cookie Notice to European Union Visitors Only

  Some countries do not require website visitors to accept or decline cookies, and there is no need to disturb such users with a cookie notice. The Geo-Targeting functionality within our GDPR Extension allows you to show cookie consent notice only to EU visitors. You can configure it in a few simple steps:

  1. In your Magento 2 backend menu, go to Plumrocket -> Cookie Consent -> Configuration.
  2. Expand the Main Settings tab.
  3. Set the Geo Targeting option to Only visitors from EU countries.
  4. Click Save Config to apply changes.
     
     

  How to Enable Consent Checkboxes for European Union Visitors Only

  The GDPR also requires merchants to get customer consent to use the personal data they provide on the website. Our module displays consent checkboxes on the Newsletter subscription popup, Registration, and Checkout pages, as well as other pages where customers can provide their personal information.

  By default, the consent checkboxes are set to be displayed to all website visitors. However, you may want to set them up to be shown to EU viewers only. Here is how to do it quickly with Magento 2 GDPR Extension:

  1. In your Magento 2 backend menu, go to Plumrocket -> Data Privacy -> Consent Checkboxes. Then, click Edit on the appropriate checkbox.
  2. Ensure that the Required option is enabled to collect all customer consents, which is needed to meet the GDPR requirements.
  3. Set the Geo-Targeting option to Only visitors from EU countries.
  4. Click Save Checkbox.
     
     

  Setting up geotargeting helps companies to conduct their business in the European Union legally. If you are concerned about the difficulty of ensuring proper GDPR compliance to your Magento 2 store, our GDPR Extension will do it all for you. We have considered all the essential details that help protect you as a seller and your site visitors.

  If you have any other questions regarding our Magento 2 GDPR Extension, please contact our support team!

• When Does GDPR Come Into Force

  The General Data Protection Regulation (GDPR) comes into effect on May 25, 2018.

• How do I know if General Data Protection Regulation (GDPR) is applicable to my business

  GDPR applies to your business if your company does business in the European Union or offers goods or services directly to individuals in the EU. So, for example if your company is located in the USA and doing business or processing the data of any individuals within the EU, you must comply with GDPR.

  Here is the list of countries in the EU affected by this regulation:

  • Austria
  • Belgium
  • Bulgaria
  • Croatia
  • Republic of Cyprus
  • Czech Republic
  • Denmark
  • Estonia
  • Finland
  • France
  • Germany
  • Greece
  • Hungary
  • Ireland
  • Italy
  • Latvia
  • Lithuania
  • Luxembourg
  • Malta
  • Netherlands
  • Poland
  • Portugal
  • Romania
  • Slovakia
  • Slovenia
  • Spain
  • Sweden
  • United Kingdom
• How to Make my Magento Store Fully GDPR Compliant

  Please review the following GDPR checklist to determine if your Magento store is fully GDPR compliant:

  • Install the Plumrocket GDPR extension for Magento
  • Map your data - establish what data your business collects and where. This may include any third-party extensions or services your company is using. 
    • Contact the third party services you are using to confirm that they are fully GDPR compliant
    • Contact vendors of the third-party extensions you are using, to ensure that their extensions are GDPR compliant. Ask them if their extensions record any personal customer data in your Magento database. If they collect any personal data, they may become GDPR compliant by integrating their plugins with Plumrocket GDPR Extension using the provided API. 
  • Update your Privacy Policy. Ensure your privacy policy is updated to address the GDPR. Describe what, why and how you collect and use personal information of your customers, how you protect it and how customers can contact you.
  • Make your consent process clear, specific and transparent. Use the built-in consent functionality of Plumrocket GDPR extension to ensure that all customer opt-ins are recorded in the consent log.
  • Update your Cookie Policy and enable Magento cookie notice. 
  • Name a Data Protection Officer (DPO). It is a good business practice to appoint someone responsible for data protection within your company. Specify the email of the DPO in Plumrocket GDPR extension settings.
  • Put security measures in place:
    • Ensure your website is using HTTPS.
    • Guard against data breaches.
    • Store and process the information you collect on computer systems with limited access, which are located in controlled facilities. Ensure that your webhosting uses best-practice physical, environmental and digital security systems.
• How does GDPR translate into my language
  • Danish - Persondataforordningen
  • Dutch - Algemene verordening gegevensbescherming (AVG)
  • Bulgarian - Общият регламент относно защитата на данните (ОРЗД)
  • Croatian - Opća uredba o zaštiti podataka (GDPR)
  • Czech - Obecné nařízení o ochraně osobních údajů (ONOOÚ)
  • Estonian - Isikuandmete kaitse üldmäärus
  • Finnish - Yleinen tietosuoja-asetus
  • French - Règlement général sur la protection des données (RGPD)
  • German - Datenschutz-Grundverordnung (DSGVO)
  • Hungarian - Általános adatvédelmi rendelet
  • Irish - An Rialachán Ginearálta maidir le Cosaint Sonraí
  • Italian - Regolamento generale sulla protezione dei dati
  • Latvian - Vispārīgā datu aizsardzības regula
  • Polish - Ogólne rozporządzenie o ochronie danych (RODO)
  • Portuguese - Regulamento Geral sobre a Proteção de Dados (RGPD)
  • Slovak - Všeobecné nariadenie o ochrane osobných údajov
  • Slovenian - Splošna uredba o varstvu podatkov
  • Spanish - Reglamento General de Protección de Datos (RGPD)
  • Swedish - Dataskyddsförordningen, allmänna dataskyddsförordningen, DSF
  • Ukrainian - Загальний регламент про захист даних
• Which Cookies Are Disabled by Plumrocket GDPR Extension

  The Recital 30 of the GDPR states: 

  Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

  The idea is relatively simple: cookies can be used to uniquely identify a person, therefore they should be treated as personal data. It will affect those identifiers used for analytics and advertising, but also those used for functional services like chats and surveys.

  However, there is a difference between cookies. Cookies that are essential for normal website functioning cannot be disabled. The non-essential cookies should be disabled. The Plumrocket GDPR extension uses native Magento "Cookie Restriction Mode" functionality which, by default, allows only essential cookies to be created. The essential cookies are those necessary for providing the information requested by the user. All the other cookies are considered non-essential. Included here are identifiers used for analytics, cookies from advertisers or third parties, including affiliates and those that identify a user when he returns to the website. The GDPR is meant to target the non-essential category.

  The essential Magento cookies are strictly necessary for the normal website functions. These cookies cannot be switched off because the Magento store wouldn’t work properly anymore. However, these identifiers do not store any personal data. Try disabling ALL cookies in Magento and your website will become unusable. Customers will not be able to add products to a cart, login, etc.. 

  To summarize - the Plumrocket GDPR Extension will block all non-essential cookies until visitor consent is given. Only after the visitor consent is given (eg: "Allow Cookies" button is pressed), will the non-essential cookies will be created.