Privacy with shop plugins: what stays in the shop and what does not

Four questions show what a plugin does with data

What is stored? Which data does the plugin record, and is personal data among it, such as names, e-mail addresses or IP addresses?

Where does it live? In your shop's database, in files on your server, or with a service of the provider?

How long does it stay? Are there fixed periods after which data is deleted or shortened, and can a single record be deleted on request?

Does anything leave the shop? Does the plugin call other servers, set cookies or store anything in your buyers' browsers?

A serious provider answers these questions in its documentation. You need the answers for your shop's privacy notice; whether your notice is complete with them, please clarify with your legal adviser.

Kaufquelle stores answers with order data

For every answer Kaufquelle stores the chosen answer and the answer to the follow-up question with their labels at the time of the answer, the texts the buyer types for “Other” or into a follow-up question's text field, the times of the answers, the order ID and the order number, the gross order value in the default currency with its code, the order time, customer group and language of the order. For every display of the survey: the same order data and a hash of the key with which only this survey can be answered.

Kaufquelle does not ask for names, e-mail addresses or IP addresses and does not store them; if a buyer types them into a text field, the text appears in the report as it is.

Kaufquelle deletes after 30 days and 24 months

Everything is in your shop's database, in the tables whose names begin with xplugin_ab_kaufquelle_. Kaufquelle sends no data to the plugin's provider or to third parties, sets no cookies and stores nothing in your buyers' browsers.

Displays without an answer are deleted after 30 days. After 24 months a daily cleanup removes an answer's link to the order: the order number, the order ID and the free texts are deleted. If an order is deleted through JTL-Wawi, Kaufquelle deletes its answer at once. If a buyer asks for deletion, you delete their answer by order number in the “Report” tab; the deletion is recorded with the order number and the admin name in the shop's log, and the entry stays for 90 days.

For your privacy notice there is a suggested paragraph in the help for Kaufquelle. It describes what Kaufquelle stores; whether it is enough for your shop, please clarify with your legal adviser.

Produktpass stores data about batteries, not about buyers

Produktpass stores the passports with their field values and documents, their published versions, the records of individual batteries, the rules of the Wawi mapping, the CSV imports with their reports and the settings. The only personal data is the backend user's name in the change log, with published versions and with CSV imports. Produktpass stores no data of buyers.

The data is in your shop's database, in the tables with the prefix xplugin_ab_produktpass_, and in the folder mediafiles/ab_produktpass/, which only the plugin serves. The public passport pages set no cookies and load nothing from other servers. CSV imports stay with their reports for 90 days; passports and versions stay until you delete them.

Neither plugin calls another server

Neither plugin calls other servers, and neither sends data to us or to third parties. That has a practical benefit: there is no further service that data from your shop goes to, and the plugins set no cookies that a cookie banner could describe. Which details your privacy notice needs overall, please clarify with your data protection adviser.

How the survey is built is explained in Where do my customers come from?; how to install a plugin and what happens to the data when uninstalling is in installing a JTL-Shop plugin.

Uninstalling follows different rules

With Kaufquelle, the shop deletes the tables on uninstalling if you leave the box “Also delete all plug-in tables from the database” ticked. Produktpass deletes its tables and files only if you waived the backup or exported all passports after the last change, so that printed QR codes do not lead nowhere.

Frequently asked questions

Sources

• Help for Kaufquelle: where the data is and how long it stays, text for your privacy notice
• Produktpass: data statement
• Regulation (EU) 2016/679 (GDPR), Art. 13, 17 and 21