Find out how we can help you adapt your site or app to regulations
Websites and apps must always comply with certain obligations imposed by law. Failure to comply with the rules, in fact, carries the risk of huge fines. This is why we have chosen to rely on iubenda, a company made up of both legal and technical figures, specialized in this sector. Together with iubenda, of which we are Certified Partners, we have developed a proposal to offer all our customers a simple and safe solution to the need for legal compliance.
The main legal requirements for website and app owners
Privacy and Cookie Policy
The law obliges every site/app that collects data to inform users through a privacy and cookie policy. The privacy policy must contain some fundamental elements, including:
- the types of personal data processed;
- the legal bases of the processing;
- the purposes and methods of processing;
- the subjects to whom the personal data may be communicated;
- any transfer of data outside the European Union;
- the rights of the interested party;
- the identification details of the owner.
The cookie policy describes in particular the different types of cookies installed through the site and any third parties to which these cookies
Can't we use a generic document?
It is not possible to use generic documents as the information must describe in detail the data processing carried out by your site/app, also listing all the third-party technologies used (e.g. Facebook Like buttons or Google Maps).
What if my site doesn't process any data?
It is very difficult for your site not to process any data. In fact, a simple contact form or a traffic analysis system such as Google Analytics is enough to trigger the obligation to prepare and display information.
Cookie Law
In addition to preparing a cookie policy, to adapt a website to cookie law it is also necessary to show a cookie banner on each user's first visit and acquire consent to the installation of cookies. Some types of cookies, such as those released by tools such as social sharing buttons, must be released only after obtaining valid consent from the user.
Cookies are used to store some information on the user's browser while browsing the site. Cookies are now essential to allow the correct functioning of a site. Furthermore, many third-party technologies that we usually integrate into our sites, such as a simple YouTube video widget, also make use of cookies.
Consent under the GDPR and LGPD
Pursuant to the GDPR, if the user has the possibility to directly enter personal data on the site/app, for example by filling out a contact form, registration form for the service or subscription to the newsletter, it is necessary to collect free, specific and informed consent , as well as record unambiguous proof of consent.
Similarly to the GDPR, the Brazilian LGPD also requires the data controller to demonstrate, by storing proof, that he has correctly collected the user's consent.
What is meant by free, specific and informed consent?
It is necessary to collect consent for each specific processing purpose – for example, one consent to send newsletters and another consent to send promotional material on behalf of third parties. Consent can be requested by providing one or more non-pre-selected, non-mandatory checkboxes accompanied by information texts that make it clear to the user how their data will be used. How can consent be demonstrated unambiguously? It is necessary to collect a series of information every time a user fills out a form on your site/app. This information includes a unique user identification code, the content of the accepted privacy policy and a copy of the form presented to the user.
Is the email I receive from the user following completion of the form not sufficient proof of consent?
Unfortunately it is not sufficient, as some information necessary to reconstruct the suitability of the consent collection procedure is missing, such as a copy of the form actually filled out by the user.
Do I have to comply with the LGPD even if my organization is not based in Brazil?
You fall within the scope of the LGPD if you process data from people located within Brazilian territory, regardless of nationality (even if they were only in Brazil at the time of data collection, and have since moved).
CCPA
The CCPA (California Consumer Privacy Act) requires that California users be informed of how and why their data is used, their rights and how they can exercise them, including the right to opt-out. If you fall within the scope of the CCPA, you will need to provide this information both in your privacy policy and in a data collection notice displayed upon the user's first visit (where necessary). To facilitate opt-out requests from California users, it is necessary to insert a “Do Not Sell My Personal Information” (DNSMPI) link both within the data collection notice displayed on the user's first visit and in another point on the site easily accessible by the user (a best practice is to include the link in the site footer).
My organization is not located in California, do I still need to comply with the CCPA? The CCPA may apply to any organization that processes or may potentially process personal information of California users, whether or not the organization is located in California. Because IP addresses are considered personal information, any website that receives at least 50,000 unique visits per year from California is likely to fall under the scope of the CCPA.
Terms and conditions
In some cases it may be appropriate to protect your online business from liability by preparing a Terms and Conditions document. The Terms and Conditions usually include clauses relating to the use of content (copyright), limitation of liability, conditions of sale, allow you to list the mandatory conditions required by consumer protection regulations and much more. The Terms and Conditions should include at least this information:
- the activity identification data;
- a description of the service offered by the site/app;
- information on risk allocation, responsibilities and disclaimers;
- guarantees (if applicable);
- right of withdrawal (if applicable);
- safety information;
- rights of use (if applicable);
- conditions of use or purchase (such as age requirements or country restrictions);
- refund/replacement/suspension of service policies;
- information on payment methods.
When is it mandatory to prepare a Terms and Conditions document?
The Terms and Conditions can be useful in any scenario, from e-commerce to marketplace, from SaaS to mobile app and blog. In the case of e-commerce, it is not only advisable, but often mandatory to prepare this document.
Can I copy and use a Terms and Conditions document from another site?
The Terms and Conditions document is essentially a legally binding agreement, and therefore not only is it important to have one, but you also need to ensure that it complies with legal requirements, that it correctly describes your business processes and business model, and that remains updated with respect to the reference regulations. Copying the Terms and Conditions from other sites is very risky as it may render the document null or invalid.
How we can help you with iubenda solutions
Thanks to our partnership with iubenda, we can help you configure everything necessary to bring your site/app up to code. iubenda is in fact the simplest, most complete and professional solution for complying with regulations.
Privacy and Cookie Policy Generator
With the iubenda Privacy and Cookie Policy Generator we can prepare a personalized policy for your website or app. iubenda policies are generated by drawing from a database of clauses drafted and continuously reviewed by an international team of lawyers.
Cookie Solution
The iubenda Cookie Solution is a complete system for complying with the Cookie Law through the display of a cookie banner on each user's first visit, the provision of a preventive blocking system for profiling cookies and the collection of valid consent for installation of cookies by the user. The Cookie Solution also helps you comply with the CCPA by showing California users a data collection notice containing a “Do Not Sell My Personal Information” link and facilitating opt-out requests.
Consent Solution
The iubenda Consent Solution allows the collection and storage of unambiguous proof of consent pursuant to the GDPR and the Brazilian LGPD whenever a user fills out a form – such as a contact form or newsletter subscription form – on your website or app, and to document California users' opt-out requests in compliance with the CCPA.
Terms and Conditions Generator
With the iubenda Terms and Conditions Generator we can prepare a customized Terms and Conditions document for your website or app. The iubenda Terms and Conditions are generated by drawing from a database of clauses drafted and continuously reviewed by an international team of lawyers.