Carticy Widerrufsbutton & EU Withdrawal Form for WooCommerce

Adding a “withdraw” button is the easy part. The hard part, the part that actually protects you, is being able to show months later that a specific person withdrew from a specific order at a specific time, and that you handed them a durable copy of it.

That record-keeping is what this plugin is built around. Your customers get a clean, guided way to exercise their EU right of withdrawal (Widerruf). You get a complete, defensible paper trail for every request, in one place.

It follows the EU “withdrawal button” model (Article 11a of Directive 2011/83/EU, implemented in Germany as § 356a BGB, mandatory from 19 June 2026) without making the experience feel like a legal form.

This plugin gives you the tooling. It is not legal advice and does not guarantee compliance, so please review your wording, exclusions, retention and refund process with qualified counsel.

The records that matter

• A durable-medium receipt your customer keeps. The moment a request is submitted, the customer is emailed a receipt containing the full declaration (name, order, items, message) and the exact date and time it was received.
• A tamper-evident fingerprint. Every request is signed with a keyed HMAC-SHA256 fingerprint using a secret that never leaves your site. The fingerprint goes in the customer’s receipt and is stored with the record, so a saved request cannot be quietly altered or fabricated and still match.
• The statutory model withdrawal form. A [carticy_eu_withdrawal_model_form] shortcode renders the official EU model form (Annex I.B; in Germany the Muster-Widerrufsformular), pre-filled with your store’s details, so the document the law expects you to provide is always there and always correct.
• 14-day deadline logic. A configurable cooling-off period, calculated from the delivery date, not just the order date.
• Article 16 exclusions. Mark products, categories, or product types that carry no right of withdrawal, such as custom-made goods or sealed hygiene items.
• Recorded consent for digital goods. For downloads and digital content, the right is only lost if the customer agreed up front. The plugin captures that consent at checkout, timestamps it, confirms it in the order email, and only then treats the item as non-withdrawable.

Effortless for the customer

• A guided, mobile-friendly flow: find your order, choose items, confirm, done.
• Logged-in customers get their name and email pre-filled and can pick from their own orders.
• Guests look up an order with just an email and order number. No account is required, the lookup is rate-limited, and it never reveals whether an order exists.
• Works without JavaScript as a normal form, and becomes a smooth multi-step flow when JavaScript is available.
• A separate, clearly labelled confirmation step (“Confirm withdrawal” / “Widerruf bestätigen”), then an instant on-screen receipt.
• Theme-adaptive styling that inherits your fonts and colors. No heavy framework is loaded on your storefront.

One place to handle requests

• A guided setup wizard gets you live in a minute, then a clean dashboard whose totals click straight into a filtered queue, with a small insights card showing your withdrawal rate and the most common reasons.
• Every request in one queue, with a clear lifecycle (Confirm, then mark Received, then Complete) or Reject, buttons that only show the actions a request can actually take, an expandable detail view (declaration, items, reason, return code, tracking, receipt fingerprint), and bulk Confirm/Reject, a search box, and a CSV export when you have a lot of them.
• A “Withdrawal” column on the WooCommerce Orders list and a panel inside each order show its withdrawal state at a glance, while the order keeps its own native status.
• Optional order automation. When a request is confirmed or completed you can set the order status (On hold or Cancelled) or issue a refund automatically. It is off by default, so nothing moves money without your say-so.
• Emails that match your store. Every notification is sent through WooCommerce’s own email template, so it inherits your branding, colors and from-address like the rest of your WooCommerce emails.
• Webhooks for your workflows. Send every withdrawal event to Zapier, Make, n8n, or your own endpoint, optionally signed with HMAC-SHA256.
• One withdrawal per order. A second request for an order that already has an open one is blocked, so you never get duplicate receipts or double refunds.
• Withdrawal links are added to order emails and the My Account orders list, plus a [carticy_eu_withdrawal_button] shortcode you can place anywhere.

Closing the return loop

A withdrawal is only finished when the goods are back and the money is settled. The plugin handles that whole second half, with defaults that are correct on their own so a merchant who changes nothing still runs a compliant, complete flow.

• An accurate 14-day clock. The cooling-off period is counted from when the order reaches your “delivered” status (Completed by default), not from the order date, and it works alongside shipment-tracking plugins.
• Return code, address, and instructions. The moment you confirm a withdrawal, the customer is emailed a return (RMA) code, your store’s return address, and your return instructions, so they know exactly what to do.
• Withhold the refund until the goods are back. The lifecycle has a “Received” checkpoint, and the refund settles at completion, which keeps the money withheld until the return arrives. You can turn the wait off for a no-questions-asked policy.
• Correct refunds. A full withdrawal refunds the items and the original outbound shipping and restocks the goods, and you can deduct for value lost to handling beyond normal inspection.
• Refund as store credit. Instead of money back you can issue the refund as a single-use, email-locked WooCommerce coupon, which covers most “I would rather exchange” cases without leaving WooCommerce.
• Gentle reminders. A “please ship it back” nudge goes out a few days after you confirm (on by default), with an optional last-chance reminder before the window closes (off by default, so a quiet store never spams).
• Customer transparency. The My Account orders list shows how many days are left to withdraw, and once a request exists it becomes a “track your return” view with the current status, return code, and address.

Built to stay correct

The withdrawal button itself is simple, and one day the platform may ship a basic version. The reason to choose this plugin is everything around it: the proof, the durable receipt, the exclusions, and the consent records, plus the commitment to keep them correct as the law and WooCommerce evolve.

German-ready

Fully translatable, and ships with German included, with the legally exact labels (“Vertrag widerrufen”, “Widerruf bestätigen”) and the Muster-Widerrufsformular wording.

Free, with no catch

It is completely free. There is no paid version, no locked features, and no upsell prompts, and the plugin does not phone home or send your data to us. HPOS (custom order tables) and the block-based cart and checkout are fully supported.

Privacy

The plugin stores withdrawal requests in its own database tables: the contact details and order reference the customer provides, the items and message, a request timestamp, a keyed verification fingerprint, and hashed IP/user-agent values used only for spam and rate-limiting. It integrates with the WordPress personal-data exporter and eraser. On uninstall, data is removed only if you enabled that option. The plugin does not send any data to us. If you enable the optional webhook, each request’s details are also delivered to the URL you configure, and nowhere else.