GDPR in Online Retail

GDPR in Online Retail The two-day seminar for everyone who processes personal data in a shop and is responsible for it: you learn which legal basis you need, how to obtain consent properly and which documentation an audit expects. By the end you have a state you can prove.

GDPR in Online Retail at a glance

• Format: 2 days on site + self-learning track
• Level: basic to advanced
• Participants: max. 16 people
• Language: German (English on request)
• Certificate: AEI certificate of attendance
• Investment: €490.00 plus VAT

Data protection in a shop is rarely a knowledge problem but an order problem. Most companies know they need a privacy policy, should keep a record of processing and must document consent. What is missing is the proof that it happens.

In daily work the gaps appear quietly. A tracking tool is added, a newsletter form is changed, a provider is connected without a contract. After two years the policy no longer matches the shop — and nobody can say since when.

This seminar works on order. You sort your processing activities, check legal bases and consents, bring the policy up to date and build a record you can maintain. Legal foundations are explained plainly, without legalese.

What you take away

• A record of processing activities that you can maintain yourself.
• Clarity on the legal basis per activity — consent, contract, legitimate interest.
• A review of your consents and cookie settings.
• A privacy policy that matches the actual shop.
• A deletion concept and a procedure for data subject requests.

Your learning objectives

• You distinguish the legal bases and assign them correctly.
• You recognise when consent is valid and when it is not.
• You keep a record that survives an audit.
• You answer data subject requests within the deadline.
• You recognise processing on behalf and third-country transfers before they become a problem.

The levers at a glance

Order beats perfection. A plain record that is maintained is worth more than perfect documentation from two years ago that nobody updates. Audits ask about the process, not the volume.

Consent needs proof. Whoever cannot say when and how somebody agreed has no consent. Timestamp, version of the text and a withdrawal route are the core, not the decoration.

A cookie banner is no substitute for a check. A banner with everything preselected is not consent. What counts is which scripts run without permission — and that has to be measured, not assumed.

Deleting must be possible, not just intended. A deletion concept answers three questions: what, after which period, and who executes it. Without those three it is an intention.

The policy is not the shop. A privacy policy describes what should happen; the shop shows what does. Between the two sit scripts, plugins and settings that nobody has looked at for a year — and that gap is what a review measures.

Who is this seminar for?

For people responsible for data processing in a shop.

• E-commerce and shop managers without their own legal department.
• Data protection officers of small companies.
• Marketing leads running tracking and newsletters.
• IT owners connecting service providers.

No legal background is required. The rules are explained plainly during the seminar; the task is organisation.

The seminar is not legal advice on an individual case. It enables you to establish and prove the state and shows where external advice is needed.

Investment and dates

Participation costs €490.00 plus VAT, including the self-learning track, materials and certificate of attendance. There are six dates per year in Berlin, Hamburg, Cologne, Munich and live online, plus an in-house variant for teams. You will find all dates in the list on this page.

For the exercises bring your privacy policy and a list of the tools in use if possible. Anyone without them works on a sample case.

After the seminar

You keep the materials, a template for the record and a 32-point checklist for the shop. With that you can establish a reliable state within a month.

The checklist goes area by area: contact form, newsletter, tracking, payment providers, shipping, reviews, applications. Whoever works through it once usually finds three to five gaps.

Two deadlines structure the work: the response to a data subject request and the notification of a breach. Both are short, and both are impossible to meet without a prepared process and a person who knows where the data is.

Two weeks after the seminar you receive a short follow-up: the gaps you closed and the ones that remain open.

For teams the seminar is available as an in-house event with your own processing activities. The procedure stays the same, the examples come from your shop.

Programme: 2 days

Day 1 – GDPR fundamentals

• Why data protection
• Basic principles
• Legal bases
• Data subject rights
• Privacy policy and consent
• Cookies and tracking

Day 2 – Website and shop

• Processing on behalf
• Third-country transfers
• Record and deletion concept
• Data protection in daily work

Both days run from 09:00 to 16:15 with breaks in the morning, at midday and in the afternoon. Short self-checks sit between the blocks so you can test where you stand before moving on.

Each day has three parts: an introduction to the pattern, an exercise on your own shop and a review in the group. At the end of day one you have classified one activity completely; on day two you have started your record.

The seminar includes a self-learning track. It contains the patterns from both days as short units with examples and one self-check each. You can work through it before the date to clarify terms, or afterwards to repeat what stuck and what did not.

Our approach

We work on your shop, not on a reading of the statute. At the start of each exercise you decide which activity you are checking and which purpose sits behind it; at the end stands a classification with a reason and a to-do.

The exercises are short and repeat in variations. That is deliberate: legal order does not come from listening but from repeatedly applying it to your own situation.

Every block ends with a sentence you could show a colleague: which activity, which basis, and what you will change this week.

We work in pairs, in small groups and in plenary, with changing partners. Every participant gets feedback on their classification, not just on their question. Group level and participant count are deliberately limited: with 16 people no anonymous lecture is possible.