Key points
- A start-up website that collects personal data must have a legal notice, terms of use and sale, a privacy policy and a cookie policy.
- A legal notice on its own is not enough to comply with the rules in force.
- These obligations derive in particular from the GDPR and from the French Law on Confidence in the Digital Economy (loi pour la confiance dans l’économie numérique).
- The content of the legal notice and of the terms of use and sale depends on your business and on the legal form you have chosen.
- The use of cookies is governed by Article 82 of the French Data Protection Act (loi Informatique et Libertés), the ePrivacy Directive and the GDPR, whose application is clarified by the CNIL (French data protection authority).
- There are three categories of cookies: functionality, statistics and advertising.
Protecting the personal data of internet users remains a major issue for every start-up with a website. To bring your terms and conditions, your privacy policy and your cookie policy into compliance, it helps to work with a lawyer who advises start-ups. There are rules on the protection of personal data that you must comply with. These obligations derive in particular from the GDPR (General Data Protection Regulation).
HASHTAG Avocats offers tailored support, adapted to your needs, to bring your website into compliance.
Which documents does a start-up need before launching its website?
A legal notice on your website selling services or products is not, on its own, enough to comply with the rules in force. Every start-up that has a website and collects users’ personal data must draft certain documents and make them available on its site. These are the legal notice (mentions légales), the terms of use and sale (CGUV), the privacy policy and the cookie policy.
The legal notice (mentions légales)
Start-ups that offer online services must draft a legal notice and display it on their website. This information allows users to identify you as the publisher of the site. It also allows them to contact you when needed. The content of the legal notice varies with the type of business you carry on (liberal profession, craft or commercial activity) and with the legal structure you have chosen (commercial company or sole trader status). To make it easy to find, it is advisable to place it at the bottom or top of the home page.
HASHTAG Avocats drafts legal notices that comply with the applicable rules while remaining adapted to your needs.
Terms of use and sale (CGUV)
The terms of use and sale (CGUV) are regarded as the basis of the relationship between start-ups and their customers. Certain information must appear in this document. Like the legal notice, the terms of use and sale also depend on your status and your business sector. You should therefore seek a lawyer’s advice beforehand.
The privacy policy
To run your online business, you will need to collect and process certain personal information. This is the case, for example, when a user uses your online service or makes a purchase. You must therefore draft a privacy policy. This document tells users how you process their personal information.
You need to work with advisers, such as HASHTAG Avocats, to obtain a privacy policy that complies with the law in force.
The cookie policy
Cookies are small files that are automatically stored on the user’s hard drive. They make it easy to identify the user. These files can be placed by the website itself or by social media platforms and technology companies. Most websites use cookies for a variety of purposes. There are three categories of cookies:
- functionality cookies: they optimise how the website works by making browsing smoother.
- statistics cookies: these are audience measurement cookies that collect information on how users use the site.
- advertising cookies: they collect information on users in order to show them targeted advertising.
To ensure users’ safety by protecting their personal data, the use of cookies is governed by Article 82 of the Data Protection Act (loi Informatique et Libertés) (in French), the ePrivacy Directive and the GDPR, whose application the CNIL (Commission nationale de l’informatique et des libertés) clarifies in its guidelines. Start-ups whose website uses cookies must therefore inform users, in particular through a cookie policy. This policy lets users learn more about how cookies work and adjust their settings where needed.
HASHTAG Avocats can draft the cookie policy for your website before you launch your business.
How do you make your website’s terms of use and sale compliant?
For the terms of use and sale to comply with the rules in force, the document must contain certain information. It will have two parts: the terms of use (CGU) and the terms of sale (CGV).
Terms of use (CGU)
The terms of use must state the purpose of the website and give information on the services offered. With your start-up lawyer, you will obtain a description broad enough that you do not have to amend the document each time your site changes. The rights and obligations of the user and of the publisher must appear in this document. The rules for using an open discussion space or forum must also be included in the terms of use. You can limit your liability so that you are not held liable when, for example, a user posts abusive comments. The document must also set out how disputes are resolved and the publisher’s limited liability for hyperlinks.
Terms of sale (CGV)
The terms of sale frame your commercial relationship with your customers. Price, payment terms, after-sales service, delivery costs and times and other information must appear in the terms of sale. You must avoid plagiarism, as it is sanctioned by intellectual property law. When you sell to consumers, you must also comply with the rules of the French Consumer Code (Code de la consommation).
Terms and conditions are only binding on the user if they were brought to the user’s attention and the user accepted them (Article 1119 of the French Civil Code (Code civil) (in French)). You can record this acceptance with a tick box. Each time you amend the terms, you must make sure users accept the new changes.
Terms of sale and terms of use must be drafted for your business sector; to that end, it is useful to work with lawyers such as those at Hashtag Avocats.
GDPR privacy policy: what must it contain to be compliant?
To remain compliant with the GDPR, your privacy policy must be concise, transparent and intelligible. This lets users know why their data is collected and how it is processed, and it builds trust with them. A GDPR-compliant privacy policy must contain:
- the identity and contact details of the controller and of the organisation processing the data;
- the purpose of the data collection;
- the legal bases that authorise you to collect personal data;
- the identity of the organisations or persons who may access the data (associations, processors, IT managers or others);
- the data retention period and the conditions for deletion;
- the rights of the users concerned (right of access, rectification, erasure, restriction, objection and portability);
- where applicable, the contact details of the Data Protection Officer (DPO);
- the right to lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés).
Beyond the mandatory information, there is optional information you can include with the help of your start-up lawyer. It varies from case to case.
If you have doubts about whether your privacy policy is compliant, Hashtag Avocats offers audits of your existing documents.
How do you set up a GDPR-compliant cookie policy?
Cookies make it possible to track users. They can therefore contain personal data. Your cookie policy must therefore state:
- the types of cookies that are set;
- the categories of personal data collected;
- the purpose of this operation;
- the recipients of the data collected, among other things.
You must therefore inform users through a banner accessible on the home page. For your policy to be compliant, users must be able to refuse cookies or adjust their settings. Note that not all cookies require the user’s consent. You can consult a start-up lawyer in Paris to find out more.
HASHTAG Avocats can also audit whether your cookie policy complies with the GDPR.
Why work with a start-up lawyer?
Meeting every obligation relating to personal data protection is not always easy. The GDPR rules are broad and very complex. The vocabulary is technical and the sanctions for failing to comply are very severe. It is therefore in your interest to work with a lawyer who advises start-ups in Paris. This professional will help you identify and understand your rights and obligations, taking into account your company’s legal structure and your business sector. They will also help you draft the mandatory documents, in particular the privacy policy and the cookie policy. They will point out the mistakes to avoid.
