Shopify customer data requests (GDPR)
When a customer in your Shopify store submits a GDPR request — either to receive a copy of their personal data or to have their data erased — Shopify sends a webhook notification to Ongoing WMS. These requests are automatically imported and matched to the relevant orders in your warehouse system.
This page explains how to find and handle these requests.
Table of contents
How it works
Shopify supports two types of customer data requests under GDPR:
- Data request — The customer wants a copy of all personal data you hold about them.
- Redact (forget) — The customer wants their personal data to be erased.
When a customer submits either type of request through your Shopify store, Shopify sends a webhook to Ongoing WMS. The system automatically checks for new requests, identifies which orders belong to the customer, and creates a data request entry for you to handle.
Finding requests
Lobby notification
When there are unhandled customer data requests, a notification card is displayed on your lobby page. Click the card to go directly to the customer data requests page.
Customer data requests page
You can also navigate directly to the customer data requests page from the admin menu.
The page shows a list of all incoming requests. You can filter by:
- Customer email — Search for a specific customer.
- Request type — Filter by data request or redact.
- Show handled — Toggle to include already handled requests.
Each row shows the customer email, customer number, the Shopify integration it came from, when the request was created, and whether it has been handled.
Click Select on a row to expand it and see which orders are connected to the request.
Handling a data request
When a customer has requested a copy of their data:
- Go to the customer data requests page.
- Check the checkbox on one or more data request rows.
- Click Download Customer Data.
The system exports the customer's personal data into Excel files containing:
- Orders — Order details including contact information, delivery dates, and references.
- Addresses — Delivery and invoice addresses.
- Order lines — What was ordered, including article details, quantities, and prices.
- Order history — A log of changes made to each order.
If you selected a single request, an Excel file is downloaded directly. If you selected multiple requests, the files are bundled into a ZIP archive.
Once downloaded, the request is automatically marked as handled. You can then send the exported file to the customer using a secure method.
Handling a redact (forget) request
When a customer has requested that their data be erased:
- Go to the customer data requests page.
- Check the checkbox on one or more redact rows.
- Click Forget Customer.
The system clears personal data (names, addresses, phone numbers, email, etc.) from all orders connected to the request. The request is then marked as handled.
Note: This action cannot be undone. Order references and non-personal warehouse data (article numbers, quantities, etc.) are preserved, but all personally identifiable information is permanently removed. See also personal data features for more information about GDPR compliance in Ongoing WMS.