Post #6 (Finale) in the sota.io EU E-Commerce Platform Series

Over the past five posts in this series, we examined the most widely used e-commerce platforms deployed by EU merchants: Shopify (Delaware C-Corp), WooCommerce (Automattic, San Francisco), BigCommerce (Nasdaq: BIGC, Austin TX), Adobe Commerce/Magento (Adobe Inc., Nasdaq: ADBE, San Jose), and Wix Stores (Wix.com Ltd., Israel/NASDAQ:WIX with Delaware subsidiary). Every one carries meaningful GDPR Chapter V data transfer risk.

This final post consolidates those findings, presents a complete comparison table, and provides detailed profiles of the five EU-native alternatives that EU merchants can deploy without third-country transfer exposure.

Why E-Commerce Data Is GDPR-Critical

E-commerce platforms process a dense concentration of personal data that sits at the intersection of GDPR Article 6 (lawfulness of processing) and Article 5(1)(f) (integrity and confidentiality):

• Customer identity data: Full name, email address, phone number, delivery address
• Payment data: Card details (processed by payment gateway), IBAN for SEPA, billing history
• Behavioural data: Browsing history, cart abandonment, product preferences, session tracking
• Transaction history: Order history, return records, purchase patterns — often retained for years
• Marketing consent records: GDPR-required consent logs, email marketing preferences
• Special-category adjacents: Medical device purchases, dietary supplements, adult products (revealing health or lifestyle information under Art. 9 interpretation)

Every US-controlled e-commerce platform creates a structural gap: 18 U.S.C. § 2713 (CLOUD Act) extends US disclosure obligations to data under a US person's possession, custody, or control — regardless of where the data is stored. An EU-resident Shopify merchant's customer database can be compelled by US law enforcement without the merchant's knowledge or consent, and without the data leaving EU servers.

The Five US Platforms: CLOUD Act Exposure Table

Key nuance on Shopify: Shopify Inc. is a Canadian corporation, not directly a US person under the CLOUD Act. However, Shopify Payments is powered by Stripe Inc. (San Francisco) — a US person with full CLOUD Act exposure. Every EU merchant using Shopify Payments channels payment data through a US-controlled processor. Additionally, Canada and the US have an MLAT (Mutual Legal Assistance Treaty) that enables US law enforcement requests for Shopify data held in Canadian jurisdiction. The practical risk profile is HIGH, though the legal mechanism differs from a pure CLOUD Act case.

Wix dual-jurisdiction: Wix.com Ltd. is incorporated in Israel, which holds a GDPR Article 45 adequacy decision — making it formally compliant for EU-Israel data transfers. However, Wix's US subsidiary (Wix.com, Inc., Delaware) handles North American operations and infrastructure. The Israel adequacy decision does not cover the Delaware entity. EU merchants whose store data is processed on US AWS infrastructure via Wix.com, Inc. face standard CLOUD Act exposure regardless of the parent company's Israeli incorporation.

GDPR Transfer Mechanism Analysis

The SCCs limitation: Standard Contractual Clauses are a necessary compliance step under GDPR Article 46, but they do not resolve CLOUD Act exposure. Schrems II (C-311/18, 2020) established that transfer mechanisms must provide "essentially equivalent" protection to EU law. Because US surveillance law (FISA §702, CLOUD Act) can override SCCs without the data controller's knowledge, SCCs alone are insufficient for high-sensitivity e-commerce data.

EU merchants using any of these platforms should have a Transfer Impact Assessment (TIA) documented per EDPB guidelines (June 2021). A TIA that honestly assesses CLOUD Act exposure for US-controlled platforms will typically identify a residual risk that must be accepted by the DPO in writing.

The Five EU-Native Platforms: Deep Dive

Shopware AG

Corporate structure: Shopware AG, Schöppingen, Germany (Aktiengesellschaft under German law) Supervisory jurisdiction: Germany — BayLDA / LDI NRW depending on data flows; BDSG natively applicable Infrastructure: Self-hosted or Shopware Cloud (Hetzner Germany, AWS Frankfurt — customer choice) Open source: Yes (Community Edition MIT license, plus Enterprise) Pricing: Community Edition free (self-hosted); Rise from ~€600/month; Evolve/Beyond on request GDPR position: Shopware AG is a German AG with no US corporate nexus. EU merchants self-hosting on German or EU infrastructure achieve full jurisdictional isolation. The Shopware Cloud option on Hetzner Frankfurt provides managed hosting with German law governing the DPA.

Technical profile:

• PHP/Symfony-based, headless-ready via Shopware API
• Native B2B features (customer groups, graduated pricing, request for quote)
• Strong German retail features: SEPA Direct Debit, German tax handling, Afterbuy integration
• Plugin marketplace with 3,000+ extensions; active German developer community
• Shopware 6 is a complete rewrite from Shopware 5 — modern API-first architecture

GDPR-specific strengths:

• Art. 28 DPA with Shopware AG straightforward under German law
• Hetzner hosting option means compute and storage in Germany under strict BDSG constraints
• No US cloud providers required at the platform level (hosting choice remains with merchant)
• BDSG Section 26 (employee data processing) handled natively for German merchants

Limitations: Less international payment gateway breadth than Shopify out of the box; lower brand recognition outside DACH market; smaller English-language partner ecosystem.

Best for: German/Austrian/Swiss merchants, B2B e-commerce, regulated-product retailers requiring strict data governance, merchants migrating from Magento/Adobe Commerce.

PrestaShop SA

Corporate structure: PrestaShop SA, Paris, France (Société Anonyme under French law) Supervisory jurisdiction: France — CNIL; French data protection law applies Infrastructure: Self-hosted or PrestaShop cloud (OVHcloud France / EU) Open source: Yes (OSL 3.0 and AFL 3.0 for core; commercial modules available) Pricing: Open source free (self-hosted); PrestaShop Essentials/Business from ~€25/month GDPR position: PrestaShop SA is a French corporation. OVHcloud (Roubaix, France) is EU-native cloud infrastructure. EU merchants using PrestaShop on OVHcloud achieve clean EU-to-EU data flows with no third-country transfer exposure.

Technical profile:

• PHP-based, large global community with 300,000+ merchants
• 3,000+ modules on PrestaShop Addons marketplace
• Native multi-store, multi-language, multi-currency support
• Good native multi-carrier shipping integration (Mondial Relay, Colissimo, DHL EU)
• REST and GraphQL APIs available in PrestaShop 8.x

GDPR-specific strengths:

• CNIL has published guidance for PrestaShop deployments (French language, practically applicable)
• Native cookie consent module GDPR-compliant by default
• Art. 17 (right to erasure) tooling available via module ecosystem
• OVHcloud DPA straightforward: French SA to French SA, no SCCs required
• Strong French-language documentation and legal template resources

Limitations: Hosting infrastructure management falls on merchant for self-hosted deployment; commercial module ecosystem can be fragmented; smaller headless/API-first developer community than Shopware or Medusa.

Best for: French merchants, EU SMEs with 500–50,000 SKUs, merchants needing French-language support and CNIL-compliant tools out of the box.

Medusa Commerce ApS

Corporate structure: Medusa Commerce ApS, Copenhagen, Denmark (Anpartsselskab under Danish law) Supervisory jurisdiction: Denmark — Datatilsynet Infrastructure: Self-hosted (any EU cloud provider) or Medusa Cloud (AWS EU regions) Open source: Yes (MIT license for core) Pricing: Open source free (self-hosted); Medusa Cloud Pro from $1,000/month GDPR position: Medusa Commerce ApS is a Danish corporation. Self-hosted deployments on EU infrastructure (Hetzner, Scaleway, OVHcloud, or sota.io) have no third-country transfer requirement at the platform level.

Technical profile:

• Node.js/TypeScript headless commerce engine — API-first by design
• Modular architecture: plug in any payment gateway, fulfillment provider, search engine
• Native support for Stripe, PayPal, Klarna, and EU-native providers (Mollie, Adyen)
• React-based storefront starter (Next.js) with full customisation
• Strong developer experience: modern toolchain, TypeScript throughout, excellent documentation

GDPR-specific strengths:

• Headless architecture means no vendor lock-in on data layer — full control of data schema
• No SaaS vendor with access to your customer database by default (self-hosted)
• Datatilsynet (Danish DPA) is one of the more active EU supervisory authorities — Medusa ApS operates under its direct oversight
• MIT license means auditability of full codebase for security/compliance reviews

Limitations: Requires developer resources to deploy and maintain; not a click-and-go SaaS for non-technical merchants; Medusa Cloud (managed) is relatively new and more expensive than PrestaShop/Shopware managed options.

Best for: Developer-first e-commerce teams, composable commerce architectures, merchants building custom storefronts with Next.js, headless B2C or D2C brands needing EU compliance by design.

sota.io angle: Medusa Commerce on sota.io (Hetzner Frankfurt) is a natural pairing — deploy Medusa's Node.js backend on sota.io managed PaaS, attach a PostgreSQL database on Hetzner, front with a Next.js storefront. Full EU data residency, no CLOUD Act exposure, managed infrastructure.

Sylius sp. z o.o.

Corporate structure: Sylius sp. z o.o., Poznań, Poland (Spółka z ograniczoną odpowiedzialnością under Polish law) Supervisory jurisdiction: Poland — UODO (Urząd Ochrony Danych Osobowych) Infrastructure: Self-hosted (any EU provider) Open source: Yes (MIT license for Sylius core) Pricing: Community Edition free; Sylius Plus (commercial enterprise features) on request GDPR position: Sylius sp. z o.o. is a Polish legal entity. Self-hosted on EU infrastructure achieves clean EU-jurisdiction data flows.

Technical profile:

• PHP/Symfony-based — deeply integrated with Symfony framework
• Designed for complex e-commerce: configurable product variants, multi-channel, advanced promotions
• API-first (API Platform integration) with REST and GraphQL
• Strong B2B configuration options
• Active community: 7,000+ GitHub stars, maintained by European Symfony ecosystem

GDPR-specific strengths:

• UODO-supervised entity — Polish data protection authority has EU-equivalent powers under GDPR
• Symfony community is heavily European with strong GDPR awareness
• Full codebase auditability (MIT license, no hidden SaaS components)
• No mandatory third-party services in core platform

Limitations: Smaller commercial ecosystem than PrestaShop or Shopware; less plug-and-play for non-developer merchants; Sylius Plus pricing not transparent; smaller English-language documentation compared to Medusa.

Best for: Symfony-experienced PHP developers, complex catalogue management (fashion, electronics with many variants), EU B2B e-commerce platforms.

Odoo SA

Corporate structure: Odoo SA, Liège, Belgium (Société Anonyme under Belgian law) Supervisory jurisdiction: Belgium — APD (Autorité de protection des données / Gegevensbeschermingsautoriteit) Infrastructure: Self-hosted or Odoo.sh (Belgian/EU cloud) Open source: Yes (LGPL for Community Edition core; Odoo Enterprise is commercial) Pricing: Community Edition free; Enterprise from €24.90/user/month; Odoo.sh from €27.50/month GDPR position: Odoo SA is a Belgian corporation. Odoo.sh (managed hosting) runs on OVHcloud infrastructure with EU data processing. Self-hosted Community Edition on any EU provider achieves full jurisdictional isolation.

Technical profile:

• Full ERP suite including e-commerce, inventory, accounting, CRM, HR — all integrated
• Python/JavaScript-based, modular architecture
• Odoo Website/eCommerce module includes product catalogue, cart, checkout, customer portal
• Native integration across ERP modules: e-commerce order → inventory → accounting → CRM without external connectors
• Active global community; Odoo Enterprise tier supported by Odoo SA directly

GDPR-specific strengths:

• APD (Belgian DPA) oversight — Belgium has proactive GDPR enforcement history
• Full ERP integration reduces third-party processor surface: fewer external SaaS tools needed, fewer Art. 28 DPAs to maintain
• Odoo.sh provides DPA under Belgian law directly with Odoo SA
• Community Edition: full source code audit possible, no mandatory SaaS connections
• GDPR module available (data subject request management, consent tracking, retention policies)

Limitations: E-commerce module less polished than Shopify/WooCommerce for pure merchant UX; best value when multiple Odoo modules are deployed together; Community Edition has feature limitations compared to Enterprise; migration complexity when Odoo becomes primary ERP.

Best for: SMEs and mid-market companies wanting to consolidate e-commerce, inventory, and accounting on a single EU-native platform; manufacturers with direct-to-consumer channels; EU companies replacing US ERP + e-commerce combinations.

Master Comparison Table

*WooCommerce as a WordPress plugin is open-source and can be self-hosted on EU infrastructure with no CLOUD Act exposure at the platform level, but Automattic's US incorporation creates risks for WooCommerce.com-hosted Jetpack, stats, and commercial extensions that call home to Automattic's US servers.

Payment Processing: The Hidden GDPR Layer

Platform jurisdiction is only half the compliance picture for EU e-commerce. Payment processing introduces a second layer of third-country transfer risk independent of the storefront platform.

*Klarna AB is Swedish but has undergone UK restructuring (Klarna Group Plc) and filed for US IPO. Risk remains LOW for EU payment processing but warrants DPA review.

Recommendation: EU merchants deploying EU-native e-commerce platforms should pair them with EU-native payment processors (Mollie or Adyen for online, SumUp for POS) to achieve end-to-end EU jurisdiction across the entire transaction flow.

GDPR Compliance Checklist for EU E-Commerce Operators

Regardless of platform choice, EU e-commerce operators must address:

Article 13/14 — Transparency

• Privacy notice listing all processors and sub-processors including payment gateway, shipping carrier, analytics, email marketing
• Processing purposes and legal basis for each data category (Art. 6 + Art. 9 where applicable)
• Data retention periods per category

Article 28 — Data Processor Agreements

• DPA required with every processor: hosting provider, payment gateway, email service, analytics, customer support tool
• EU-native processors: DPA under home-country law; straightforward for Shopware/PrestaShop/Medusa
• US processors: DPA must include SCCs (Module 2: Controller → Processor) plus Transfer Impact Assessment

Article 32 — Security Measures

• Encryption at rest and in transit for customer and payment data
• Access controls limiting who can export customer databases
• Regular security testing of self-hosted infrastructure
• Incident response procedure (72-hour notification to supervisory authority under Art. 33)

Cookie Consent (ePrivacy Directive + GDPR)

• Cookie consent before analytics tracking fires
• No pre-ticked boxes, granular consent by category
• Consent log stored per user session
• All major EU-native platforms have compliant cookie banner modules; US SaaS platforms vary

Right to Erasure (Art. 17)

• Automated erasure workflow or documented manual process
• Scope: customer account, order history (subject to retention obligations), marketing consent, analytics identifiers
• Retention exceptions: accounting/tax obligations under national law typically require 7-10 year order record retention

Recommendations by Merchant Profile

German/Austrian/Swiss Merchants (DACH)

Primary recommendation: Shopware AG — German AG, BDSG-native, strong DACH payment/shipping integration, large German partner network, active development community. Community Edition for self-hosted; Shopware Cloud on Hetzner for managed. Pair with Mollie or Klarna for payment processing.

ERP integration: Combine with Odoo SA (Belgian) for full ERP if needed — both EU-native, eliminates US processor surface entirely.

French Merchants

Primary recommendation: PrestaShop SA — French SA, CNIL-supervised, strong French merchant community, OVHcloud hosting option provides French-to-French data flow. PrestaShop Essentials on OVHcloud is the most accessible fully-GDPR-compliant managed e-commerce stack for French SMEs.

Developer-First / Headless Commerce

Primary recommendation: Medusa Commerce ApS — MIT license, Node.js/TypeScript, headless-first, Danish ApS. Deploy on sota.io (Hetzner Frankfurt) for managed EU PaaS. Next.js storefront on sota.io creates a fully-EU-native composable commerce stack. No third-country transfers at any layer.

Complex B2B E-Commerce

Primary recommendation: Sylius sp. z o.o. for complex product catalogues with deep Symfony integration, or Shopware AG for German market B2B with native B2B features. Both EU-native, both support advanced product variant and pricing models.

E-Commerce + ERP Integration

Primary recommendation: Odoo SA — Belgian SA, single-vendor EU-native ERP + e-commerce. Eliminates integration overhead between US CRM/ERP and e-commerce platform. Odoo.sh on OVHcloud provides managed hosting with Belgian DPA. Best ROI for companies currently paying for Shopify + HubSpot + QuickBooks as three separate US tools.

Migrating from Shopify or WooCommerce

From Shopify to Shopware

Shopware provides a Shopify Migration Assistant plugin available in the marketplace. It covers:

• Product catalogue, variants, images
• Customer accounts and order history
• Collections → Shopware categories
• Redirects for existing URLs (critical for SEO)

Migration complexity: Medium. Allow 2-4 weeks for a production-ready migration including theme rebuild.

From WooCommerce to PrestaShop

PrestaShop's Migration Pro module handles WooCommerce exports (WooCommerce → PrestaShop via XML/CSV). Product data, customer accounts, and order history transfer; theme and plugin functionality requires rebuild.

Migration complexity: Medium. PrestaShop's template system differs from WordPress themes. Allow 3-6 weeks for theme parity.

From WooCommerce to Medusa

Medusa's headless architecture means migration involves:

1. Export WooCommerce product/customer/order data (via WooCommerce REST API)
2. Import into Medusa via Admin API
3. Build or customise Next.js storefront (Medusa provides a starter template)

Migration complexity: High (requires developer). Duration: 4-8 weeks for initial deployment; ongoing storefront development.

The sota.io Connection

sota.io is a managed EU PaaS hosted exclusively on Hetzner Germany infrastructure. For EU e-commerce operators choosing EU-native platforms, sota.io provides:

• Managed Node.js/Docker deployment for Medusa Commerce backends
• Managed PostgreSQL for Medusa, Sylius, or custom e-commerce databases
• EU data residency — all compute and storage on Hetzner Frankfurt (Germany)
• German hosting contract — DPA under German law, BDSG-compliant
• No US cloud provider in the infrastructure stack

A typical stack on sota.io for GDPR-compliant headless e-commerce:

• Storefront: Next.js (sota.io static hosting or Vercel EU region)
• Backend: Medusa Commerce (sota.io Node.js deployment)
• Database: PostgreSQL (sota.io managed database)
• Payments: Mollie or Adyen (EU-native, no CLOUD Act)
• Email: Brevo/Sendinblue SAS (French SA, CNIL-supervised)
• Analytics: Plausible.io (Estonian OÜ, EU-native, no cookies)

This stack achieves complete EU jurisdictional coverage across every layer of the e-commerce infrastructure — no third-country transfers, no CLOUD Act exposure, no Schrems II TIA required.

What This Series Has Established

Across six posts in the EU E-Commerce Platform Series, we examined:

1. Shopify (Post #1) — Canadian corporation, but Shopify Payments via Stripe (US) creates CLOUD Act exposure for payment data. MLAT risk for platform data.
2. WooCommerce (Post #2) — Automattic Inc. (San Francisco) controls the plugin ecosystem. Self-hosted deployments can isolate platform data, but Automattic's commercial extensions (Jetpack, WooCommerce.com services) introduce US processor exposure.
3. BigCommerce (Post #3) — NASDAQ: BIGC, Austin TX. Full CLOUD Act exposure. EU data residency available but does not address jurisdiction.
4. Adobe Commerce / Magento (Post #4) — Adobe Inc. (NASDAQ: ADBE, San Jose). CLOUD Act + Adobe Experience Cloud AI/analytics US processing. Magento Open Source self-hosted can isolate platform data; Adobe Commerce Cloud cannot.
5. Wix Stores (Post #5) — Wix.com Ltd. (Israel, EU adequacy) plus Wix.com, Inc. (Delaware, CLOUD Act). Dual-jurisdiction complexity; Delaware subsidiary exposes US infrastructure usage to CLOUD Act.

The common thread: Every major US-origin or US-listed e-commerce platform processes EU merchant and customer data under a legal framework that does not provide GDPR-equivalent protection against government access. E-commerce data — transaction history, customer PII, payment flows — is among the most sensitive personal data EU businesses process. The jurisdictional mismatch that Schrems II identified is not theoretical for e-commerce; it is structural.

EU merchants who have not conducted Transfer Impact Assessments for their current e-commerce platform are operating with open GDPR Article 46 compliance gaps. Those assessments should precede any platform migration decision — they quantify the actual risk profile and inform whether migration is operationally justified.

For merchants choosing their initial stack or planning a rebuild: EU-native platforms (Shopware, PrestaShop, Medusa, Sylius, Odoo) provide the cleanest compliance posture with no TIA overhead, no ongoing SCCs maintenance, and no residual CLOUD Act risk to manage.

Related Posts in This Series

• Shopify EU Alternative 2026: Delaware C-Corp, CLOUD Act, and GDPR Risk for EU Merchants
• WooCommerce EU Alternative 2026: Automattic Delaware and CLOUD Act Risk
• BigCommerce EU Alternative 2026: NASDAQ-Listed US Corp and GDPR Exposure
• Adobe Commerce / Magento EU Alternative 2026: Adobe Inc. and CLOUD Act Risk
• Wix EU Alternative 2026: Israeli Corporation, NASDAQ-Listed, AWS Infrastructure