Customer data in your shop: consent, data requests and deleting an account

Every order leaves in the shop a name, an address, a phone number and an e-mail. That is personal data, and whoever keeps it has duties: say what it is used for, not keep it longer than needed and answer anyone who asks to see or delete it. The exact rules depend on where your customers are, so here is only what WordPress and WooCommerce already provide, and where to find it. This is not legal advice.

What the shop already has for this

Tool Where it is What it is for
Export personal data WordPress, Tools, Export Personal Data Give a customer a copy of what the shop holds on them, on request.
Erase personal data WordPress, Tools, Erase Personal Data Delete or anonymise a customer's data, on request.
Accounts and privacy WooCommerce, Settings, Accounts and Privacy Policy text at checkout and registration; how long to keep orders and unused accounts.
Privacy page WordPress, Settings, Privacy Choose the page that the site and WooCommerce display.

What to do, in order

1 List what the shop collects and who receives it: the payment method, the courier, the e-mail program, the statistics. Each one is a destination for the data and has to be in the policy.
2 Write or review the privacy policy with that list. See the legal pages of a shop.
3 Ask only what checkout needs. If you sell digital goods, the address may not be needed. Every extra field is data to keep.
4 Keep the newsletter box separate. Accepting the terms of purchase is not agreeing to receive advertising. The subscribe box is unticked by default and is a separate choice. See e-mail marketing without burning your domain.
5 Decide how long you keep things. In Accounts and Privacy you can have inactive accounts and failed or cancelled orders cleared. Completed orders usually have to be kept for tax reasons: ask your accountant before setting a period.
6 Prepare the reply to a request. When someone asks for their data or its deletion, confirm it is that person, use the two tools above and answer in writing. Write down who does what.
7 Review the cookie notice. A shop with analytics or advertising needs it working properly: the cookie notice.
Deleting a customer does not delete the duty to keep the order. In many countries accounting law requires sales records to be kept for years. WooCommerce can anonymise personal data while keeping the amounts, which is what accountants usually advise. Do not delete orders in bulk without asking them.
Security is data protection too. A shop whose customer list is exposed through an out-of-date plugin is a leak. Keep everything updated and the backups working: see personal data protection on your website.

Was there access you do not recognise, or do you suspect customer data got out? Tell us now, with the address and what you saw, and we will look at the logs.

Open a support ticket

SEE ALSO

Personal data protection: what applies to your website

The legal pages an online shop needs

How to tell if your site has been compromised

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $6.59/mo (3-year plan, with coupon)

See plans
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

An online shop with local payment methods: WooCommerce and getting paid Selling through your website in Angola is no longer a big project. What stops most shops is not building the shop - it i...
Installing Magento for an online shop Magento is the heaviest shop platform in the cPanel installer. It installs in minutes like the others, but it does not b...
Making Magento run fast A freshly installed Magento is slow on purpose: it ships in developer mode, with caching off and nothing optimised, so t...
Recovering the Magento administrator password Magento is the only one of the big platforms in the installer where there is no button to change the administrator passw...
Installing PrestaShop PrestaShop sits between OpenCart and Magento: it arrives with catalogue, promotions, carriers and tax rules already buil...
Customising the WooCommerce order e-mails: wording, logo and what to say The “order received” e-mail is the message a shop's customer opens most. By default it goes out with WooCommerce's wordi...