Shopware

The Data Protection Officer

Variants are properly modelled — parent-child inheritance, a configurator assembled for each variant product, hierarchical categories — and payments sit on a documented handler architecture with synchronous and asynchronous flows, PayPal the one provider named. We found no public information on bundles, tiered pricing, guest checkout, or German-standard payment methods such as invoice and direct debit; customer-specific prices appear only in the Beyond tier. The checkout is clearly extendable, but the conversion machinery itself is not evidenced. 1 2 5 6

Report an error

The Data Protection Officer

What the platform itself does is expose tax settings in the administration and orchestrate external tax providers — since version 6.5 an app can be called during checkout with signed requests, priority ordering and a five-second timeout, its sums used as-is. The German-law work — destination VAT, OSS, reverse charge with VAT-ID validation, checkout legal texts, e-invoicing — rests on whichever tax app the merchant connects, and we found no public information on any of it being handled by the platform. That is configuration plus an extension point, not maintained correctness. 7 8

Report an error

The Data Protection Officer

The developer surface is real: plugins are Symfony bundles and Composer packages with a dependency model, the Store API is a documented service-based route system with decorators, and the payment flow is explicitly designed for headless use. The Community Edition is open source and self-hosted, so a team can run the whole thing. We found no public information on staging environments, theme version control or documented rate limits, and the documentation states plugins are not compatible with the cloud stores, where apps are required instead. 1 6 9 10

Report an error

The Data Protection Officer

The order model is workflow-built: three state machines for order, transaction and delivery with configurable, otherwise blocked transitions, and partial states throughout — shipped partially, returned partially, refunded partially — so partial shipments, returns and refunds are worked into the core. Multi-inventory arrives only with the Beyond tier, and shipping appears as an integration category without named carriers, label printing, or any named ERP or accounting system. We found no public information on fulfilment routing, dropshipping or operational reporting. 1 2 11 12

Report an error

The Data Protection Officer

Ownership is partly structural: the Community Edition is open source and self-hosted, orders are denormalised and persisted independently of the catalogue, and numerous data-portability and management tools are claimed. The Migration Assistant is documented in depth — connections, profiles, gateways, dedicated media handling, checksum-based deltas — but the captured pages describe migrating into Shopware; we found no public information on a documented export or exit path out, on deletion executing against order history, or on a data-return commitment. 1 11 14

Report an error

The Data Protection Officer

The contracting entity is solidly European — shopware AG, registered at the Amtsgericht Coesfeld, seat in Schöppingen, German VAT ID — and European data centres are claimed alongside self-hosting, PaaS and SaaS, with a data processing agreement on the EU Commission's standard contractual clauses plus ISO 27001 and SOC 2 Type II stated. We found no public information on a subprocessor list, on where the CDN, analytics or payment routing sit, or on confirmed data residence for the hosted offerings beyond a data-centre claim made in the context of the Copilot. A German entity with an unnamed processing chain — and a compliance statement that privacy standards in the USA and further markets are also met — leaves the checkout path unaccounted for. 1 3 4

Report an error

The Data Protection Officer

Tier prices are public with VAT treatment stated — Community Edition at € 0, Rise "Ab € 600 /Monat exkl. MwSt.", Evolve "Ab € 2.400 /Monat exkl. MwSt." — and the Intelligence+ add-on is priced per tier, with Nexus in a free introductory phase carrying a non-binding review limit of 10,000 requests per customer and calendar month. From-pricing and an individually quoted Beyond tier mean the annual invoice is not computable from the page, and we found no public information on transaction or revenue-share fees, order or revenue limits, minimum terms, or the cost of the extensions most shops need beyond that one add-on. 1 2

Report an error