Wix.com Ltd
- Complaint filed
- 23.04.2026
- Decision
- 17.06.2026
- Time to decision
- 55 days
- Decision number
2.1-1/26/769-1568-3- GDPR articles
- 12, 15, 21, 57
f9f0efd5eaf95d56b0cd37a516d9ad8dc1b894a26f40d03c73822bb570a6eb84The document is published in full. The complainant's personal data (email address) has been removed from the document.
Grounds for refusal
- Art. 57(1)(f) — handled "to the appropriate extent"
- the GDPR does not oblige issuing an order
- no public interest / an individual request
- the lead authority is another country (Art. 56)
What was in the complaint
Art. 21(3) — direct marketing after a formal objection. The complainant filed an Art. 21 objection to direct marketing on 4 March 2026. Wix continued to send marketing emails — with the complainant’s name and photo — six times from 4 to 25 March. Art. 21(3) is unconditional: after an objection, processing must stop immediately. Wix did not do so for at least 21 days.
Art. 15 — an incomplete reply. The archive was provided on 29 March. An examination of the archive itself showed that Wix’s systems hold data that was not disclosed: a Google OAuth refresh token (access to Google Business without a legal basis) and payment card data (MasterCard, full billing address).
Articles: 21(2)(3), 15, 5(1)(f), 32, 44–46.
What AKI decided
Proceedings discontinued. Grounds: Art. 57(1)(f); the controller is in a third country (Israel).
Analysis
The strongest point here is Art. 21(3). This is one of the few unconditional provisions of the GDPR: after an objection to direct marketing, processing stops immediately, without any balancing of interests. Six emails in three weeks after a formal objection is a direct, unambiguous breach.
On top of that, the finding in the archive itself: Wix stores an access token to the complainant’s Google account and their card data, but did not disclose them in the reply to the request. The evidence was extracted from a document the company itself provided.