OXID eShop
Partially CompliantGerman open source ecommerce platform from Freiburg, self-hosted, with over twenty years of B2B and B2C deployments.
GDPR Compliance Data
Not independently verified| GDPR Status | Partially Compliant |
| HQ Country | Germany |
| Ownership | European-owned |
| Foreign Disclosure Exposure | None known |
| Data Hosting Location | European Union“Self-hosted. The vendor runs no managed cloud for this product, so the hosting location is whichever provider the buyer deploys to. EU hosting is therefore available by default, which is why dataHostingLocation is EU, but deploying to a US cloud would reintroduce CLOUD Act reach over the host.” |
| EU Servers Available | |
| Data Processing Agreement | Not verified |
| Sub-processor List | Not verified |
| Schrems II Risk | Low Risk |
| SCCs in Place | |
| Last Verified | 24 August 2026 |
How we reached this
OXID eSales AG, Freiburg, Germany, Registernummer HRB 701648, VAT DE231450866, per the Impressum. EU-owned with no parent named. The product is self-hosted: OXID operates no cloud for the shop application, so commerce data never reaches the vendor. Exposure NONE and Schrems II risk LOW on the basis of a European deployment, which is the normal case for this platform's German customer base; deploying to a US cloud would change that and is the merchant's decision. GDPR status is PARTIAL because no DPA is published covering OXID's own processing of customer and support data, and no sub-processor list is published for the commercial services.
About OXID eShop
Twenty Years of German B2B Commerce
OXID eShop is one of the older German commerce platforms and its customer base shows it: industrial suppliers, wholesalers, medical products, machinery. Complex B2B catalogues with customer-specific pricing, approval workflows and ERP integration are the normal deployment rather than the exception.
The community edition is open source under GPL; Professional and Enterprise add multi-shop, B2B modules and commercial support. A German partner network handles most implementations.
Self-Hosted, Which Settles the Question
OXID does not host your shop. The application runs on infrastructure you choose, so customer and order data never reaches OXID eSales AG at all.
For a German or European merchant that is the simplest possible compliance answer: install it on a German host, and there is no processor to contract with for the commerce data, no sub-processor list to audit, no transfer to document and no foreign disclosure regime with any purchase on it. That position is available to every self-hosted platform on this list and it is worth more than most vendor promises.
The company is OXID eSales AG, Freiburg im Breisgau, registered under HRB 701648 with VAT number DE231450866.
The Trade
OXID is not a fashionable choice and the developer pool is smaller than for Shopware or Symfony-based platforms. Documentation and the partner network are German-first. If the requirement is a modern headless architecture, Saleor or Medusa are the better starting points. If the requirement is a serious B2B catalogue running on German infrastructure with a twenty year track record, this is a real option that almost no international directory lists.
More in ecommerce platforms.
Key Features
Pros & Cons
Categories
OXID eShop GDPR & data protection: common questions
Is OXID eShop GDPR compliant?
Partly. OXID eShop meets some of the requirements, with caveats worth reading before you commit. OXID eShop is a European company headquartered in Germany, data is hosted within the European Union.
Where does OXID eShop store data?
OXID eShop states: "Self-hosted. The vendor runs no managed cloud for this product, so the hosting location is whichever provider the buyer deploys to. EU hosting is therefore available by default, which is why dataHostingLocation is EU, but deploying to a US cloud would reintroduce CLOUD Act reach over the host.". Data is hosted within the European Union.
Does OXID eShop offer a Data Processing Agreement (DPA)?
We could not locate a published DPA for OXID eShop. That does not mean one is unavailable. Many vendors provide it on request or inside the account area rather than publishing it. Ask before you sign.
What a DPA has to cover →Is OXID eShop a European company?
Yes. OXID eShop is headquartered in Germany and, as far as we can establish, European-owned.
Related Tools
Shopware
German commerce platform available self-hosted or as managed cloud, with an open source community edition.
PrestaShop
French open source ecommerce platform, self-hosted, whose own hosted services run on Google Cloud in the United States.
Saleor
Polish open source headless commerce API with a managed cloud, a published DPA and EEA data storage stated in its terms.
Spotted something wrong?
Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.
If you work at OXID eShop and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.