Privacy and Cookie Policy

The law obliges each site or app that collects personal data to disclose relevant details to users through dedicated privacy and cookie notices. Privacy policies must contain certain fundamental elements specific to your particular processing activities, including:

• the contact and identifying details of the data controller;
• which personal data is being processed;
• the purposes and methods of processing;
• the categories of sources from which consumers’ data is collected;
• the legal bases of processing (e.g., consent);
• the third parties that may also access the data, including any third-party tools (e.g., Google Analytics);
• details relating to the transfer of data outside the European Union (where it applies);
• the rights of the user;
• a description of the notification process for changes or updates to the privacy policy;
• the effective date of the privacy policy.

The cookie policy specifically describes the different types of cookies installed through the site, any third parties those cookies refer to (including links to their documents and opt-out forms), and the purposes of the processing.

CCPA

The CCPA requires businesses to inform California users about how and why their data is being used, their rights in regard to this, and how they can exercise those rights, including the right to opt out. To comply, you need to include the relevant disclosures in your privacy policy and display a notice of collection on the user’s first visit (where applicable).

The opt-out process should be facilitated through a “Do Not Sell My Personal Information” (DNSMPI) link, accessible from your notice of collection and elsewhere on your site. Best practice is to also include the link in the footer.

EU Cookie Law

In addition to providing an easily available and accurate cookie policy, adapting a website to the cookie law also requires showing an informative cookie banner that links to a detailed cookie policy on each user’s first visit, giving the user the opportunity to reject or grant consent to the installation of cookies. Most types of cookies, including those issued by tools such as social sharing buttons, should only be released after the user has given valid consent.

Furthermore, many third-party vendor networks may limit ad reach if you don’t have a cookie management system that meets industry standards, potentially reducing your ability to generate ad revenue.

Consent According to GDPR and LGPD (EU and Brazil)

When a user directly enters personal data on a site or app, for example by filling in a contact form, service registration, or newsletter subscription, you need to collect consent that is freely given, specific, and informed. Under the GDPR, you also need to keep unambiguous records that demonstrate valid consent was collected.

Similar to the GDPR, the Brazilian LGPD also requires the data controller to provide unambiguous proof of consent, showing that the user’s consent was collected by a valid means.

Terms and Conditions

In certain circumstances, it can be necessary to protect your online business from potential liabilities with a Terms and Conditions document. Though not always legally required, Terms and Conditions set the way your product, service, or content may be used, in a legally binding way. They typically contain copyright clauses, disclaimers, and terms of sale, allow you to set governing law, list mandatory consumer protection clauses, and more. Terms and Conditions should at least include:

• the identification of the business;
• a description of the service your site or app provides;
• information on risk allocation, liability, and disclaimers;
• warranty and guarantee information;
• the existence of a withdrawal right;
• safety information, including instructions for proper use (e.g., terms of delivery);
• rights of use;
• conditions of use or purchase (e.g., age requirements or location-based restrictions);
• refund, exchange, or termination policies and related information;
• information on methods of payment.