Shopware
Partially CompliantGerman commerce platform available self-hosted or as managed cloud, with an open source community edition.
GDPR Compliance Data
Not independently verified| GDPR Status | Partially Compliant |
| HQ Country | Germany |
| Ownership | European-owned |
| Foreign Disclosure Exposure | Not yet verified |
| Data Hosting Location | Unknown“Not published for the managed cloud. The Community Edition is self-hosted, so its location is the buyer's choice; Shopware's SaaS and PaaS tiers are vendor-hosted and no region is stated on the public site. Checked shopware.com/en/privacy and the trust centre (read 2026-08-24).” |
| EU Servers Available | |
| Data Processing Agreement | View DPA |
| Sub-processor List | Not verified |
| Schrems II Risk | Unknown |
| SCCs in Place | |
| Last Verified | 24 August 2026 |
How we reached this
shopware AG, Ebbinghoff 10, 48624 Schoeppingen, Germany, registered at Amtsgericht Coesfeld under HRB 11471, VAT DE261679493, per the legal notice. German-owned with no parent named. A data processing agreement is published at shopware.com/en/privacy/dpa/ and a trust centre exists. dataHostingLocation and extraterritorialExposure are UNKNOWN rather than EU because the classification depends on which product you buy: the open source Community Edition is self-hosted and carries no vendor hosting at all, while the commercial SaaS and PaaS tiers are Shopware-hosted with no region published. Buyers on a commercial tier should obtain the hosting region and sub-processor list in writing before signing.
About Shopware
The German Commerce Standard
Shopware is the platform a large share of German mid-market retail runs on, and it is unusual in treating B2B as a first-class case rather than a plugin: customer-specific pricing, quote workflows, order approvals and account hierarchies are part of the product rather than bolted on.
The architecture is API-first with a Symfony backend and a decoupled storefront, so a headless build and a conventional templated shop are both supported paths. The extension marketplace is large and largely German-speaking, which cuts both ways depending on your team.
Self-Hosted or Their Cloud
The Community Edition is open source and self-hosted. Deploy it to Hetzner, IONOS, OVH or your own racks and the data question is answered entirely by your own procurement, with no vendor in the path at all.
The commercial tiers offer SaaS and PaaS hosting run by Shopware. That is the version with a hosting location Shopware controls, and the region is not published on the public site. Buyers going that route should get the region and the sub-processor list in writing.
shopware AG is at Ebbinghoff 10, 48624 Schöppingen, registered at Amtsgericht Coesfeld under HRB 11471. German company, no foreign parent named. A data processing agreement is published, which is more than most platforms in this category manage.
Where It Fits
Against commercetools it is the less abstract, faster-to-launch option. Against PrestaShop it is heavier and more enterprise. If B2B is in scope at all, it is the strongest European candidate on this list.
More in ecommerce platforms.
Key Features
Pros & Cons
Categories
Shopware GDPR & data protection: common questions
Is Shopware GDPR compliant?
Partly. Shopware meets some of the requirements, with caveats worth reading before you commit. Shopware is a European company headquartered in Germany, and a Data Processing Agreement is published.
Where does Shopware store data?
Shopware states: "Not published for the managed cloud. The Community Edition is self-hosted, so its location is the buyer's choice; Shopware's SaaS and PaaS tiers are vendor-hosted and no region is stated on the public site. Checked shopware.com/en/privacy and the trust centre (read 2026-08-24).". Data is hosted in a location we have not been able to verify. An EU region is available.
Does Shopware offer a Data Processing Agreement (DPA)?
Yes. Shopware publishes a DPA at https://www.shopware.com/en/privacy/dpa/. A DPA is required under Article 28 GDPR whenever a provider processes personal data on your behalf.
What a DPA has to cover →Is Shopware a European company?
Yes. Shopware is headquartered in Germany and, as far as we can establish, European-owned.
Related Tools
PrestaShop
French open source ecommerce platform, self-hosted, whose own hosted services run on Google Cloud in the United States.
Saleor
Polish open source headless commerce API with a managed cloud, a published DPA and EEA data storage stated in its terms.
Sylius
Polish open source ecommerce framework built on Symfony, self-hosted, aimed at custom B2B and B2C builds.
Spotted something wrong?
Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.
If you work at Shopware and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.