Under GDPR, an online store can share customer data with partners only with a lawful basis, a clear notice to the customer and the right contract. The safest setup for joint promotions is to share no personal data at all: the customer clicks through to the partner on their own.
What counts as sharing data
Personal data is any information that identifies a person, directly or indirectly: name, email, phone, address, order number, device ID. Sharing happens whenever another company receives that data. You export a list, send it through an API, or embed a partner script on a page that reads order data.
The last case is easy to miss. If a partner script on your thank-you page receives the customer's email, or the order total together with an identifier, that is sharing too. Check exactly what each plugin and pixel sends.
Lawful bases
Article 6 of GDPR lists the bases for processing data. For sharing with partners for marketing, two are usually considered.
| Basis | When it fits | Limits |
|---|---|---|
| Consent (Art. 6(1)(a)) | The customer separately agrees to share their data with a specific partner | Must be freely given, separate from the order, and can be withdrawn |
| Legitimate interest (Art. 6(1)(f)) | The processing is expected by the customer and does not override their rights | Needs a balancing test; use with caution for passing data to third parties for marketing |
| Performance of a contract (Art. 6(1)(b)) | Sharing with the carrier or payment provider | Does not cover partner marketing |
Roles: controller, processor, joint controllers
- Processor (Art. 28): handles data on your instructions, for example an email service provider. You need a data processing agreement (DPA).
- Independent controller: the partner receives data and uses it for its own purposes. You need a basis for the transfer and a notice to the customer.
- Joint controllers (Art. 26): you and the partner decide the purposes and means together, for example a shared promotion with a shared form. You need an arrangement that splits responsibilities, and its essence must be available to the customer.
What to tell the customer
Article 13 of GDPR requires you to tell people, when you collect their data, who the controller is, why and on what basis you process it, who receives it (or which categories of recipients), how long you keep it and what rights they have. If you plan to share data with partners, this belongs in your privacy policy and in plain wording next to the form where the customer agrees.
If the partner is outside the EEA, the rules on international transfers (Chapter V of GDPR) apply too: an adequacy decision or standard contractual clauses.
Email marketing: GDPR plus LSSI
For email advertising in Spain, Article 21 of the LSSI applies on top of GDPR. Without prior consent, a store may email a customer only about its own products or services similar to what they bought, and every email must include a simple, free way to opt out.
The consequence: promoting partners by email on the basis of this soft opt-in does not work. You need explicit consent to receive partner offers. If you add a partner block to the order confirmation email, talk to a lawyer about the format, because part of that email becomes a commercial message.
Setups from risky to safe
| Setup | Risk | What you need |
|---|---|---|
| Exporting your customer list to a partner | High | Separate consent to share with that specific partner, and records of consent |
| Partner script reads order data | High | Consent, a contract, and a check of exactly what is sent |
| Shared promotion form with a partner | Medium | Joint controller arrangement and a notice to customers |
| Link to a partner offer without any data | Low | Only a non-personal click ID |
A safe setup for partner offers
The customer sees an offer, clicks through on their own and leaves their details on the partner's site, under the partner's privacy policy. The store passes only an anonymous click ID so the result can be credited. ThanklyClub works this way: the plugin does not send customer names, emails, addresses or phone numbers. To pick offers it uses product categories, an order total range, currency, country and language.
Common mistakes
- One shared checkbox for "I agree to the terms and to sharing my data with partners". Consent has to be separate and freely given.
- Pre-ticked consent boxes.
- Ad network pixels on the thank-you page that receive the customer's email or phone without consent.
- No list of recipients in the privacy policy.
- No contracts with email and analytics providers.
Example: a partner promotion without sharing data
A shoe store agrees with a fitness app to offer customers a free trial month. A block with the offer description and a button appears on the thank-you page and in the order confirmation email. The link contains only a non-personal click ID. A customer who is interested goes to the app and signs up there, accepting the app's own privacy policy.
The store shares no email, no name and no order contents. The app reports the signup by click ID, and the store gets paid. It is still worth updating the store's privacy policy: which services are involved in showing offers and what technical data they receive.
Retention and deletion
GDPR requires you to keep data no longer than the purpose needs. Set retention periods: order data according to accounting and tax rules, email consents for as long as they are valid and you can prove you received them, abandoned cart data for a short time. Check that your plugins actually delete data on those schedules.
Checklist
- List every plugin, script and pixel on your thank-you page and in your emails, and check what data each one receives.
- Define a role and a legal basis for every recipient.
- Sign a DPA with your processors.
- Update the privacy policy: recipients, purposes, retention periods.
- Keep consent to store emails separate from consent to partner offers.
- Take tricky cases to a lawyer or a data protection specialist.
FAQ
Can I give a customer's email to a partner for their newsletter?
Only with the customer's separate, freely given consent to share it with that partner. Consent to your own newsletter does not extend to partners.
Do I need consent to show a customer a partner offer?
If the partner receives no personal data and the customer clicks through on their own, showing the offer does not involve sharing data. Keep cookie and commercial communication rules in mind.
What are the fines under GDPR?
Article 83 sets fines of up to €20 million or up to 4% of worldwide annual turnover, whichever is higher, for the most serious infringements.
What is the difference between a processor and a controller?
A controller decides the purposes and means of processing. A processor acts on the controller's instructions and does not use the data for its own purposes.
Connect your store in 5 minutes
The plugin is free. You get 60% of the partner payout for every new customer.
