Email and SMS for online stores: the platform and the first flows

For most online stores turning over more than a few hundred thousand pounds, we'd choose Klaviyo for email and SMS, because it is built around order and browsing data and its automated flows are the strongest part of the product. Mailchimp is a sound choice for a smaller store that mainly sends newsletters, or a business where the shop is only part of what it does. Whichever you pick, the platform matters less than two things: whether you have lawful permission to message each person, and whether five core automated flows are live and maintained.

Those five are welcome, abandoned basket, browse abandonment, post-purchase and win-back. Built well, they keep earning in the background while your team concentrates on campaigns. Built without thought for consent, they are the quickest way for a retailer to break UK marketing rules.

This guide is our working view, not legal advice. Where it describes the law, it follows the Information Commissioner's Office (ICO) guidance, and you should check anything unusual with your own adviser.

The short version

• Choose the platform that reads your store's order and product data natively, because flows depend on it.
• In the UK, marketing by email and by text follows the same rules: consent, or the "soft opt-in" for your own customers.
• Consent for email does not cover SMS. Ask for each separately.
• Build flows in this order: welcome, abandoned basket, post-purchase, browse abandonment, win-back.
• Browsing your site is not a sale or a negotiation, so browse abandonment messages need consent.
• Platforms charge by the size of your list, so cleaning out people who never open saves money and protects deliverability.

Klaviyo, Mailchimp or something else?

The question to ask of any platform is how much it knows about your customers without custom work. A flow that says "you bought a tent three weeks ago, here is how to care for it" needs order data, product data and timing. If that data arrives through a patchy connector, the flow never gets built.

We have left paid prices out of the table on purpose. Both vendors price on a sliding scale and change it often, so use the calculator on each vendor's own pricing page with your real list size.

When Klaviyo is the right call

You run on Shopify, BigCommerce or Adobe Commerce, you want segments based on what people bought and viewed, and you plan to add SMS. This is the situation for most retailers we work with, and it is why we run a dedicated Klaviyo practice.

When Mailchimp is the right call

Your list is modest, you send a regular newsletter and a few simple automations, and your team already knows the tool. Moving platform has a real cost in rebuilt templates, flows and sender reputation. If Mailchimp is doing the job, a better welcome flow will earn more than a migration.

The others

Omnisend, Brevo and similar platforms are credible and can be cheaper. Judge them the same way: the quality of the integration with your store, how flows are built, and what you will pay at the list size you are heading for.

Consent under UK GDPR and PECR, in plain words

Two sets of rules apply together. UK GDPR covers how you handle personal data. The Privacy and Electronic Communications Regulations (PECR) cover sending marketing by "electronic mail", which the ICO confirms includes texts as well as email. To send marketing to an individual you need one of two things.

Route one: consent

The person actively agreed to receive marketing from you. The ICO's standard is that consent must be freely given, specific, informed and unambiguous. In practice:

• No pre-ticked boxes. Silence or inactivity is not consent.
• Say what they are signing up for and who it is from.
• Ask for email and SMS separately. Agreeing to one is not agreeing to the other.
• Keep a record of when and how each person agreed.
• People can withdraw at any time, and it must be easy.

Route two: the soft opt-in

You can market to your own customers without consent if every one of these is true: you collected their details yourself, during a sale or the negotiation of a sale; you are marketing your own similar products or services; you gave them a clear chance to opt out when you collected the details; and you give them a chance to opt out in every message afterwards.

Two points catch retailers out. First, the opt-out has to be offered at the moment of collection, so it cannot be added retrospectively to an old customer list. Second, the soft opt-in never applies to bought or shared lists.

What every message needs

Your identity must be clear, and there must be a simple way to opt out: an unsubscribe link in email, a reply keyword or link in a text.

Why it matters more now

The Data (Use and Access) Act 2025 raised the stakes. The ICO states that it can now issue fines under PECR of up to £17.5 million or 4% of global turnover, the same ceiling as UK GDPR. The earlier maximum was £500,000. The ICO's own guide to electronic mail marketing is short and worth reading in full.

Order confirmations and delivery updates are service messages, not marketing, as long as they stay free of promotion. A dispatch email with a discount code in it is marketing.

The five flows to build first

1. Welcome. Build it first because every new subscriber gets it. Say who you are, what you sell and why people buy from you. If you promised a discount at sign-up, deliver it in the first email.
2. Abandoned basket. The shopper gave an email address at checkout and left. Remind them what is in the basket and answer the likely doubt: delivery cost, returns, stock. Hold the discount back to the second message, or shoppers learn to abandon on purpose. On permission: the ICO's test for the soft opt-in is whether the person actively expressed an interest in buying, and whether they were offered an opt-out when you collected the address. Put that opt-out at the email field in your checkout.
3. Post-purchase. The most neglected flow and the one that builds repeat custom. Care instructions, what to expect, a review request once the product has arrived, then a relevant next product.
4. Browse abandonment. Someone you can identify looked at a product and left. The ICO says plainly that a customer browsing your range, even when logged in, has not entered into negotiations for a sale, so the soft opt-in does not apply. Send this only to people who have consented to marketing, and remember that the tracking which identifies them falls under the cookie rules as well.
5. Win-back. Set the trigger from your real repurchase cycle, not a round number. If people have not responded after two messages, stop emailing them. That is good for deliverability and for your bill.

Add SMS only after the email versions work. Text is intrusive and paid for per message, so reserve it for moments that are time-sensitive: a basket reminder, a back-in-stock alert, the last day of a sale.

Common mistakes

• Importing every past customer and pressing send. If no opt-out was offered when their details were collected, neither route covers them.
• One tick box for everything. Email and SMS bundled into a single consent is not specific.
• A discount in every flow. It trains customers to wait and takes margin from orders you would have won anyway.
• Believing platform-reported revenue. Email tools credit themselves with any order placed within a window of an open or click. Compare against your analytics and, where you have the volume, hold a small group back from a flow to see the true difference.

How we'd approach it

1. Audit permission first. We look at every place you collect an email address or mobile number, what the wording says, and what record is kept. Fixing the sign-up form and checkout wording usually takes days and protects everything that follows.
2. Check the data. Orders, products, and viewed-product events need to reach the platform cleanly. This is often an integration job before it is a marketing one.
3. Build the welcome and abandoned basket flows, then post-purchase, in plain versions that can go live in weeks.
4. Measure honestly for a month, then add browse abandonment and win-back.
5. Then campaigns and segmentation as an ongoing email marketing programme, with flow copy and timing tested as described in our guide to conversion rate optimisation.

Questions we get asked

Want a second opinion on your own setup? Thirty minutes with a strategist, and you leave with a clear next step.