Can zen-cart customer register feature be disabled?

My website only accepts paypal, I understand from the past that when using zen-cart when a customer has to purchase a product they have to register for account and the feature could not be disabled at all, i was wondering since it been awhile if you can disable this feature from your store setting because i will have no use for it, if i where to use zen-cart again.

There will be an account created by the time a purchase is completed; this is essential to the cart function. You can use wording to disguise this - it is not deceptive, because the store must keep records of transactions, and the records include the "account" information in any case, whether it is called an account or not. The only essential difference to the customer is whether a password is asked for, and the COWOA mod can eliminate that while allowing true account creation if desired.

gjh42, What yos say may be the case in USA but it is not, I believe, good advice in UK, and possibly many other countries.

As I understand it, legally, if an account is opened in somone's name, whether they are aware of it or not, I must,

1. Be registered with the appropriate govenment office (Information Commisoners Office?); and

2. Inform the customer the account has been created and inform them of their right to access all the information I hold about them on request.

I do not have to do this if the information is held ONLY as part of the sales record.

For me, the creation of accounts "on the fly" is not just deceptive it is plain wrong. Personally, I hate when a website requires you to open an account - or, worse, creates one without forewarning - and I will invariably shop elsewhere if I can.
It is certainly something I would like to avoid on my own site if possible and, whilst I have not looked into it yet, I imagine there must be some way of removing the customer database entirely and simply storing all the information in the orders database instead.

In the meantime, my advice to hangman21 (and those in the UK who wish to avoid data protection issues) is to use the COWOA add-on, routinely download your sales to your financial accounts package or some other storage medium, and then clear the customer database.

@bjewelled

You don't avoid data protection issues by destroying data and pretending you never had it. You're more likely to create one. Registering with the Information Commissioner is inexpensive, very easy and obligatory if you're handling personal information for business purposes. And in e-commerce you are, whether you subsequently destroy it or not.

And it simply doesn't make good business sense not to keep records of the people with whom you've dealt remotely. Paypal or Credit card transactions can be charged back some time after the transaction takes place and the goods have been shipped. If you've destroyed your customer records, your records are now incomplete, which would make it difficult to defend these (though in practise the the information would have been snapshotted to your Zen Cart orders table, so with or without an account you are still holding personal information).

And then, what if your store were used for fraudulent transactions, from a stolen credit card for example. You may be an innocent bystander, but if somebody's going down for it and you've destroyed the evidence of where the goods were shipped, guess who's now in the firing line. Your actions would look very suspicious in that circumstance. And how would you prove that you weren't complicit?

It's perfectly legitimate for an e-commerce store to collect sufficient personal information to fulfill an order, and to keep that for a reasonable period for legitimate business purposes, including further Marketing unless the customer requests otherwise, and to support information submitted to HMRC and use in HMRC audits. Whether we call that an account or not, is just a matter of semantics.

Take heed of Kuroi's advice - ALL webshop owners, not just UK.

The scenario described by Kuroi:-

And then, what if your store were used for fraudulent transactions, from a stolen credit card for example. You may be an innocent bystander, but if somebody's going down for it and you've destroyed the evidence of where the goods were shipped, guess who's now in the firing line. Your actions would look very suspicious in that circumstance. And how would you prove that you weren't complicit?
... actually happened to a client of ours and the customer record archive was crucial in the subsequent investigation that followed.

@bjewelled needs to get a grip on the reality of eCommerce, the obligations of store owners, and the potential consequences of sloppy record-keeping and auditing.

Actually, the Data Protection Act deals specifically with the storage of personal data with particular emphasis on electronic storage; if I do not keep any there are no data protection issues.

But, yes, it does seem a bit like semantics; however, the act does allow for simple data processes for business purposes without the need for registration, and the storage of a customer's name and address, solely as part of a sales invoice, falls under that category. On the other hand, storing information about a person, based on identity or some personally identifiable characteristic does require registration.

Put simply, as it was once explained to me, if I keep all my sales records organized by date or invoice number, say, I probably do not have to register. But, if they were organised by customer name then I certainly would. Semantics, perhaps, but isn't that what interpretion comes down to?

Incidentally, I did not mean to suggest, or imply, that anyone should totally destroy their sales data - that would just be silly.

And, by the way, I have been running an online retail site for over five years now without using customer accounts or finding any need to store customer information. Just keep a copy of the invoice - it's how we used to do it in the days before computers! - and clear the database regularly. (of course, it all depends on the type and size of business, but it works fine for me.)

schoolboy:

... actually happened to a client of ours and the customer record archive was crucial in the subsequent investigation that followed.

@bjewelled needs to get a grip on the reality of eCommerce, the obligations of store owners, and the potential consequences of sloppy record-keeping and auditing.

Been there and got the t-shirt:smile: - the sales records were perfectly adequate to deal with the problem.

Keeping customer records is not an obligation of store owners and not keeping digital records does not imply sloppy record keeping or auditing, nor that I have tenuous grip of reality (though some may say otherwise!)

:oops: Seems we are all wrong! The comments prompted me to revisit, some five years later, the Information Commisioners Office website and go through the assessment process once again. I am still exempt as is any small business that only processes data for "core business purposes", i.e. staff administration, advertizing, marketing and public relations, accounts and records. Here is the actual exemption clause for the latter,

ACCOUNTS AND RECORDS

This is processing for the purposes of keeping accounts relating to any business or other activity carried on by you, or deciding whether to accept any person as a customer or supplier, or keeping records of purchases, sales or other transactions for the purpose of ensuring that the requisite payments and deliveries are made or services provided by you or to you in respect of those transactions, or for the purpose of making financial or management forecasts to assist you in the conduct of any such business or activity.

This exemption covers the administration of customer and supplier records.

It includes processing relating to making a decision about whether or not to do business with a particular customer or supplier but specifically excludes personal data processed by or obtained from a credit reference agency.

It excludes data controllers who are providing accounting services for their customers.

Your data subjects are restricted to
Any person the processing of whose personal data is necessary for your accounts and records.

Examples are: past, existing or prospective customers or suppliers

Your data classes are restricted to
Data which are necessary for your accounts and records. This excludes personal data processed by or obtained from a credit reference agency.

Examples are: name, address, credit card details.

Your disclosures other than those made with the consent of the data subject are restricted to
Those third parties which are necessary for accounts and records.

For example: external auditors

Retention of the Data
The personal data are not kept after the relationship between you and the customer or supplier ends, unless and for so long as it is necessary to do so for your accounts and records.

So, sorry for creating any confusion (seems we can keep accounts records without registering?) but thanks for making me do the legwork.

I agree. It had been several years since I'd looked at this too and I think I see more common-sense in the regulations now than the sledgehammer approach when they were first introduced.

I'd still come down on the side of keeping good business records, including about customers, if for no reason other than that my most successful clients are the ones who have structured programmes for developing developing long-term relationships with their customers, rather than seeing them simply as the other side of a completed transaction - but there are some businesses that are genuinely one-off purchases and where this has less validity.