GDPR Ultimate (100% GDPR compliant)

Features

Data controller

In accordance with article 37 of the GDPR, LPSGDPR module allows you to define one or more data controllers who will be the only people authorized to access this module.

It will be necessary to define at least one data controller and an email to process requests relating to personal data, to unlock all the features of LPSGDPR module.

Automated sending email to the data controller in the event of an attempt to access LPSGDPR module by an unauthorized employee.

Data management

LPSGDPR module allows you to view all the modules installed on your store which are in compliance with the GDPR and require no action on your part.

In the event that modules collecting personal data do not appear in this list, it is advisable to make them compliant as soon as possible.

Consent management

In accordance with article 6 of the GDPR, processing is only lawful if the data subject has consented to the processing of his personal data for one or more specific purposes.

LPSGDPR module allows you to adapt the various forms of your store to make them comply with the GDPR (account creation form, contact form, newsletter subscription, ...).

• Add checkbox for consent requests
• Add "More info" link (CMS page on personal data protection)
• Customization of consent request message (multilingual compatibility)
• Consent request for old customer accounts
• Reinforced security of the password (account creation form)
• Add information message on user rights (account creation form)
• Customization of consent requests for all compliant modules

Rights management

LPSGDPR module allows your customers to exercise their rights relating to their personal data directly from the "My account" page of your store.

You have the possibility to group all GDPR requests via a single form OR display independent tabs for each right.

• Right to data access (article 15 of the GDPR): the customer can exercise his right to data access directly from his customer account and download a copy of all his data in PDF format.
• Right to data rectification (article 16 of the GDPR): the customer can exercise his right to data rectification directly from his customer account by modifying his personal information.
• Right to be forgotten (article 17 of the GDPR): the customer can exercise his right to be forgotten directly from his customer account by making a request using the dedicated form.
• Right to restriction of processing (article 18 of the GDPR): the customer can exercise his right to restriction of processing directly from his customer account by making a request using the dedicated form.
• Right to data portability (article 20 of the GDPR): the customer can exercise his right to data portability directly from his customer account and export a copy of all his data in CSV or JSON format.
• Right to object (article 21 of the GDPR): the customer can exercise his right to object directly from his customer account by making a request using the dedicated form.

Cookies management

LPSGDPR module allows you to display a warning banner meeting the latest requirements of European regulations on cookies, customizable and configurable in a few clicks.

In accordance with article 7 of the GDPR, allow your customers to withdraw their consent to the deposit of cookies at any time by adding a link on your store.

You can also select the modules for which you want to block the deposit of cookies as long as the user has not given his consent (audience measurement, marketing, social networks, advertising, etc.). During the installation of the module, some modules are blocked by default and require no action on your part. Modules strictly necessary for the proper functioning of your store are excluded by default because they do not require prior agreement.

Important: do not forget to create a CMS page "Cookies policy" gathering information relating to the use of cookies on your store.

Consent history

LPSGDPR module allows you to find all the consents given by your customers in order to be able to provide evidence of the consent of the person concerned in case of dispute.

You can also export the consent register in CSV or PDF format.

Request history

LPSGDPR module allows you to find all the requests relating to the rights of your customers to their personal data formulated directly from their customer account via the tab provided for this purpose.

You can also export the GDPR request register in PDF format.

Customers and the data controller will automatically receive emails relating to GDPR requests.

• Right to data access: the data controller can download a copy of the data by clicking on the "Download as PDF" button, send it to the customer by email and close the request by clicking on the "Close request" button.
• Right to data rectification: the data controller can modify the customer's data from the PrestaShop back office and close the request by clicking on the "Close request" button.
• Right to be forgotten: the data controller can download a copy of the customer's invoices by clicking on the "Download all invoices" button and then anonymize all data relating to this customer by clicking on the "Anonymize customer" button or reject the request by clicking on the "Reject request" button.
• Right to restriction of processing: the data controller can limit the processing by clicking on the "Disable customer" button or reject the request by clicking on the "Reject request" button.
• Right to data portability: the data controller can export a copy of the data by clicking on the "Download CSV" or "Download JSON" button, send it to the customer by email and close the request by clicking on the "Close request" button.
• Right to object: the data controller undertakes to delete the customer's email address from its commercial prospecting and close the request by clicking on the "Close request" button.

Data anonymization

In accordance with article 5 of the GDPR, personal data may not be stored indefinitely: a retention period must be determined by the data controller according to the purpose that led to the collection of this data. Beyond this period, the data must be deleted or anonymized.

LPSGDPR module allows you, on the one hand, to anonymize personal data of a customer (without an order in progress) following a request made directly from his customer account via the tab provided for this purpose, and on the other hand, to automatically anonymize customers who have been inactive for X days (1095 days by default or 3 years, value of X can be set from the module configuration) via the execution of 3 CRON tasks that you can easily schedule in the free PrestaShop module "Cron tasks manager".

Automated sending email to inactive customers Y days before the automated anonymization of their personal data (value of Y can be set from the module configuration) containing a link to reconnect to their customer account.

You can also configure the order status for which you want to allow the anonymization of a customer account as well as the minimum period from which an account can be anonymized for orders with the selected status.

Important: LPSGDPR module does not support the removal of personal data shared with third party service, you must delete them manually.

Compliance plan

To go further, our team is at your disposal to support you in the GDPR compliance of your PrestaShop store.

Compatibility

LPSGDPR module is multistore and multilingual compatible.

What your customers will like

• GDPR - Right to information
• GDPR - Right to data access
• GDPR - Right to data rectification
• GDPR - Right to be forgotten
• GDPR - Right to restriction of processing
• GDPR - Right to data portability
• GDPR - Right to object

Recommendations

• Uninstall the official PrestaShop GDPR module before installing LPSGDPR module
• Anonymization is an IRREVERSIBLE AND DEFINITIVE operation. All data and all the advantages possibly acquired by the customer will be PERMANENTLY LOST and can no longer be restored. It is recommended that you SAVE ALL YOUR ACCOUNTING DOCUMENTS (invoices, merchandise returns, credit slips) before any anonymization.
• It is recommended that you perform a FULL BACKUP OF YOUR DATABASE before enabling "Automated anonymization" option.
• It is recommended that you run CRON jobs for automated anonymization EVERY DAY (preferably at a time when the site is low-traffic, at night for example).
• During the installation of the module, a new customer account was created: Customer ANONYMOUS. This anonymous account is required for the correct functioning of the module, do not delete it.