Initial situation
EM-1 ran an online sale of medical supplies via an older shop platform. Each order meant five manual steps: payment receipt, customer contact, delivery note creation, courier handover and invoicing. As volume grew this became a bottleneck for replying to customers in a reasonable time.
Goal
Build a modern e-shop that:
- accepts payments via a Slovak payment gateway with low fees,
- automatically hands over to the courier without manual intervention,
- issues an invoice and payment receipt in a single pipeline,
- communicates with the customer via branded emails,
- complies with GDPR including the new EDPB Recommendation 2/2025 for cookieless analytics.
Solution
Frontend: Astro 5 + React 19 islands — static product pages for fast LCP, dynamic cart and checkout via React components. Self-hosted Geist fonts (no Google Fonts → GDPR-friendly even without a consent banner).
Backend: FastAPI with three external integrations:
- Comgate (payment gateway) — chosen for the lowest fees on the SK/CZ market and good HUF support. Full refund flow, webhook validation, 3D Secure.
- MuFis API → Fullpost (Štúrovo, 30 km from EM-1) — automatic creation of delivery documents, labels, shipment tracking.
- Stalwart Mail (self-hosted in EU) — branded transactional emails (order confirmation, payment prompt, delivery) without dependency on an external ESP.
Implementation decisions:
- PIV (Post-Implementation Verification) per ICC standard — every Comgate and MuFis endpoint was verified against the spec. Comgate revealed 16 gaps, MuFis 13 — all fixed before launch.
- Self-Confirming Tests prohibited — tests were derived directly from the spec, not from the implementation.
Cookieless analytics: Self-hosted Umami in the EU per EDPB 2/2025 — no cookies, no consent window, fully legal traffic measurement.
Results
- Production launch with an automated pipeline from “Order” click to delivery.
- Zero manual touch for standard orders.
- Recovery flow for Comgate or MuFis errors — auto-retry with exponential backoff, escalation to email alert after 3 failures.
- GDPR compliance audit — the project passed an internal review against GDPR + EDPB 2/2025 with no findings.
Lessons learned
- Third-party integration = primary source of risk. The PIV protocol revealed more issues than code review alone.
- Self-hosted SMTP gives full control over domain reputation — crucial for a B2C e-shop where the customer expects reliable delivery of confirmations.