GDPR Compliance Suite
Privacy rules only bite when someone asks you to prove what you did. This suite puts consent, cookies, data subject requests and the right of withdrawal inside your Magento store, and keeps a record for each one you can actually produce.
Latest version: 1.2.0 — changelog
Why it matters
- Consent that holds up. Every acceptance and refusal is logged with its lawful basis, timestamp and a minimised IP — the demonstrability Art. 7(1) asks for, rather than a banner that only looks compliant.
- Nothing loads before it is allowed. Cookies are denied by default and blocked in the response as well as in the browser, so an HttpOnly or proxy-set cookie cannot slip past a client-side script.
- Subject requests stop being manual work. Access, erasure and rectification run as a workflow with verification, deadlines and an export the shopper can actually read.
- Withdrawals handled properly. The 14-day cooling-off period, eligibility per order and item, and the refund flow are modelled — not left to email.
- Fewer surprises on audit. Processing activities, consent history and policy acceptances are all exportable from the admin.
What you get
| Feature | What it lets you do |
|---|---|
| Cookie Consent | Run a real banner with categories your shoppers can refuse, and have that refusal actually enforced |
| Consent Management | Ask for consent on registration, contact, newsletter and checkout, each with a recorded lawful basis |
| Data Subject Rights | Take access, erasure and rectification requests through verification to a delivered export |
| Right of Withdrawal | Give shoppers the withdrawal form the directive expects, and work the refunds from one grid |
| Privacy Policy | Version your policy and know exactly who accepted which version |
| Third-Party Embed Blocking | Stop YouTube, Vimeo, Maps and social embeds contacting their provider before consent |
| Privacy Center | Let customers see and act on their own data instead of emailing support |
| General GDPR Settings | Gate consent for minors under Art. 8 and set the store's compliance mode |
How it is built
- Hyvä-native. Nine Hyvä companion modules render every storefront surface as Alpine components that satisfy Hyvä's enforcing Content Security Policy — not a Luma theme bolted onto a Hyvä store.
- API-first. Six REST endpoints and a GraphQL schema cover policy consent and the full withdrawal flow, so a headless or PWA storefront gets the same behaviour as Luma.
- No SaaS. Everything runs inside your Magento install. No third-party consent service, no per-visitor pricing, no personal data leaving the store to make consent work.
- Translated. Ships German, Spanish, French and Polish alongside English.
Also available in: German, Spanish, French, Polish.
Requirements
PHP 8.1 through 8.5, and Magento Open Source or Mage-OS on the 2.4 line
(magento/framework ^103.0). Hyvä companions are optional and needed only on a
Hyvä storefront.
A note on what this does
The suite supports compliance with the GDPR and the EU consumer-rights directives: it gives you the mechanisms, the enforcement and the records. It does not certify your store, and no extension can — how you configure it, and what you do with the requests it surfaces, remains your responsibility.