GDPR checklist for configurator hosting

A product configurator collects personal data as soon as a customer sends a request: name, email, phone, address and often photos of their home, so GDPR applies just as it does to any form. The practical checklist is EU hosting, a signed processing agreement, stripped photo metadata, a stated retention period and consent-gated tracking. This guide explains each point and gives you a list to tick off on a vendor call.

Why this applies to a configurator specifically

A 3D product configurator isn’t just a visual tool. The moment a customer submits a quote request, it’s collecting personal data: name, email, phone number, often a delivery or installation address, and increasingly photos of the customer’s own terrace or home uploaded with the request. If the configurator supports a measuring-visit booking, it’s also handling a scheduled home visit tied to that address. Under GDPR, you (the merchant) are the data controller for this information, and your configurator vendor is a data processor acting on your behalf, which brings a specific, checkable set of obligations.

This isn’t unique to configurators. Any contact form carries the same basic obligations. It’s worth stating plainly here because configurators collect more and richer data than a simple contact form (photos, exact addresses, device and browsing signals for tracking), which raises the stakes of getting it wrong.

The checklist

Keep this list open on a vendor call. A vendor used to enterprise or EU customers will have straightforward answers to all seven items without hesitation.

Hosting location and the processor agreement

GDPR doesn’t strictly require EU hosting. It requires a lawful basis for any transfer outside the EU/EEA (adequacy decisions, standard contractual clauses, and so on) when data does leave. In practice, EU hosting removes the question entirely and is the simpler compliance story for a small or mid-size merchant without in-house legal counsel managing international transfer mechanisms. If a vendor hosts outside the EU, ask specifically what transfer mechanism applies, in writing.

Separately, and this applies regardless of hosting location, you need a signed data processing agreement (DPA) with the vendor, as required under GDPR Article 28 whenever a processor handles personal data on a controller’s behalf. A vendor serving EU merchants as a matter of course should have a standard DPA ready to sign, not something you have to negotiate from scratch.

Customer photos: the easy-to-miss risk

Photos a customer uploads with a quote request (of their terrace, their existing fence line, the wall a structure will attach to) are personal data, and photos taken on a phone commonly carry EXIF metadata including GPS coordinates: the exact location the photo was taken, embedded invisibly in the file. Stored and forwarded as-is, that’s a real exposure if the photo ever leaks or is mishandled. Effectively a customer’s home address attached to an image file.

The fix is straightforward and should be standard in any configurator handling customer uploads: decode the image, validate it’s actually an image (not a disguised file type, a basic security hygiene step as well as a privacy one), resize it to a sane maximum, and re-encode it, which strips EXIF/GPS and other embedded metadata in the process. Ask a vendor directly: “are customer photos re-encoded server-side, or stored exactly as uploaded?” The answer should be the former.

Retention

GDPR’s storage-limitation principle means personal data shouldn’t be kept indefinitely “just in case.” A configurator vendor should be able to state (and let you configure, within reason) how long request data, quotes and photos are retained, and that deleted/declined requests and expired quotes are actually removed rather than kept forever by default. If a vendor has no stated retention policy, that’s a gap worth asking about directly rather than assuming it’s handled.

Consent for tracking pixels

Most configurators fire conversion tracking (Google Ads, Meta, TikTok) on quote requests, since the request is the natural “conversion” event for an outdoor-structure business running ads. These pixels are themselves subject to cookie-consent rules in the EU (ePrivacy, enforced alongside GDPR). They should only fire after the visitor has given consent, not by default on page load. Check that the configurator’s tracking snippets are consent-gated (and, if embedded on your existing site, that this gating is respected inside the embed too, see embedding a configurator in WordPress, Shopify or Webflow) rather than firing unconditionally.

Export and deletion on request

A customer has a right to access and a right to erasure under GDPR. Confirm the configurator lets you find and export a specific customer’s data (their requests, quotes, photos) and delete it on request, within a practical timeframe. This is a basic operational capability a platform handling customer data should already have, not a custom development request you’d need to raise.

Putting it together

None of this is exotic once it’s laid out. It’s the same category of diligence you’d (hopefully) already apply to any form or CRM holding customer data. The configurator-specific additions are the photo-metadata question and the richer data a measuring-visit booking carries (a confirmed home address and appointment time, not just an email address). Run through the checklist above with any vendor before your customers’ data starts flowing through it. It’s a five-minute conversation that’s much easier to have before launch than after a data request from a customer or a query from a supervisory authority.

For the fuller buying decision this checklist sits inside, see the 3D configurator buyer’s guide, or book a 30-minute walkthrough that covers hosting and data handling directly.