The contractual documentation of the website

In this “All-Digital” world, any service provider or merchant must have its own website. It will either be an e-commerce site, for the sale of its services and/or products online, or a simple showcase site.

From a purely legal point of view, several elements must appear on your website:

1. Legal notices
2. Privacy Policy
3. The GDPR notice on the contact sheet
4. The Cookies Headband

   The absence of these elements constitutes a violation of the obligation of transparency (and information) provided for in Article 5 of the GDPR (General Data Protection Regulation – EU Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016), violation which may be punishable by an administrative fine of up to 20,000,000 euros or, in the case of a company, up to 4% of the total annual worldwide turnover of the preceding financial year, whichever is greater.

5. The General Conditions of Use (CGU) or General Conditions of Use and Sale (CGUV)

Please note that these mandatory elements constitute nothing more and nothing less than contracts under which you engage the responsibility of your company.

Regarding legal notices

Article 6, III, 1 of the LCEN (Law no. 2004-575, June 21, 2004 for confidence in the digital economy) requires website publishers to mention, within the website, in an open standard, the following information:

• if the professional publisher is a natural person: their last name, first name, address and telephone number and, if they are subject to registration formalities in the trade and companies register or in the trade directory, their registration number;
• if the professional publisher is a legal entity: its name or company name, the address of its head office, its telephone number and, if it is a company subject to registration formalities in the trade and companies register or the trade directory, its registration number, its share capital and the address of its head office;
• the name of the director or co-director of the publication and, where applicable, that of the editorial manager within the meaning of article 93-2 of law no. 82-652 of July 29, 1982 on audiovisual communication.

In the event of non-compliance with these obligations, the natural person operating the website, or the manager of the legal entity operating the website, incurs criminal sanctions of up to one year’s imprisonment and a fine of 75,000 euros (this sum being increased to 375,000 euros for legal entities).

Regarding the Privacy Policy

It is precisely the Privacy Policy that allows us to meet the obligations of the GDPR.

Indeed, under the terms of the GDPR, the operator must provide the user whose personal data it collects with all the information contained in Articles 13 and 14 of the GDPR, depending on whether it carries out direct collection:

• the identity and contact details of the data controller or his representative if the data controller is located outside the European Union;
• the contact details of the data protection delegate, if a delegate has been appointed;
• the purposes pursued by the processing (provision of the service, statistical analyzes of site traffic, etc.) as well as the legal basis of the processing;
• if the legal basis for processing the data is legitimate interest, the description of the legitimate interests;
• the recipients or categories of recipients of the data (subsidiaries of the data controller, service providers involved in the provision of the service);
• the existence of transfers of personal data to a non-member state of the European Union, the country of transfer and the appropriate guarantees put in place and the means of obtaining a copy of the guarantees put in place (an email address, for example, made available to the user so that he can make this request);
• the duration of retention of the processed data, or if this is not possible, the criteria used to determine this duration;
• the existence of the rights available to users: right of access, rectification, erasure, right to limitation of processing, right to object to processing, right to withdraw consent at any time and right to portability;
• the existence of the user’s right to lodge a complaint with a supervisory authority;
• if the provision of the data is obligatory, either due to a legal or contractual obligation and the possible consequences of the failure to provide the data;
• the existence and operation of automated decision-making, in particular profiling, as well as the importance and consequences of this system for the user.

In the event of indirect data collection, the following additional information must also be provided:

• the categories of personal data collected;
• the source from which the data come, and where applicable, a statement indicating whether or not they come from sources accessible to the public.

Particular care must be taken when drafting this document.

On the GDPR mention on the contact sheet

If the website uses an online registration form allowing the collection of personal data, the operator must, again and despite the existence of the Confidentiality Policy, provide reduced and specific information to users (arising from article 32, I of the Data Protection Act applicable in France).

Thus, at the top of the form there should be a statement specifying at least the purpose of data collection, recipients and retention period.

On the cookies banner

Almost all websites today use cookies (digital files placed on the hard drive of a user who accesses the site), some of which are necessary for the provision of services, while others are used to offer the user a personalized journey or to measure and improve the performance of the Site.

The CNIL adopted deliberation no. 2013-378 of December 5, 2013 adopting a recommendation relating to cookies and other tracers covered by article 32-II of the law of January 6, 1978.

In addition, the CNIL adopted new recommendations in September 2020 (no. 2020-092), on the practical arrangements for compliance with “cookies” and other “trackers”. The CNIL has already announced that it could pursue breaches of these recommendations, particularly in the event of a particularly serious violation of the right to respect for private life.

These cookies require the user to give free, specific, informed and unequivocal consent.
Refusing cookies must be possible.
It must be as simple to refuse cookies as to accept them upon connection by the Internet user.
Refusal cannot be subject to conditions.

Concerning the General Conditions

The purpose of the General Conditions of Use or General Conditions of Use and Sale is to define the conditions of:

• Sale/purchase of the product or service you offer; and
• Use of the website (how to navigate the site, what is allowed or not allowed for a user of the site to do)

Thus for an e-commerce site, the operator of the website must communicate to the consumer, in a readable and understandable manner on its site, a certain amount of information, including:

• the essential characteristics of the product (with certain specific requirements depending on the type of product), its price and other associated costs;
• the date or delivery time of the product;
• the payment and delivery terms as well as the terms provided by the professional for processing complaints;
• the existence and conditions of implementation of guarantees;
• the conditions, deadlines and procedures for exercising the right of withdrawal;
• dispute resolution methods.

We must now put an end to the idea of being able to copy and paste the T&Cs of another company, whether they are well written or not…

Besides the fact that these documents were written for THESE companies and not for yours; Copying/pasting a competitor’s T&Cs constitutes an act of copyright infringement punishable by the courts. As an example, perhaps cited the ordering of an e-commerce company to pay 10,000 euros to its competitor for having reproduced its General Conditions of Sale.

Writing your own T&Cs means having the opportunity to specify in a clear, concise and transparent manner; the way in which your sale is structured, the reasons for which your liability may be incurred and thus avoid any surprises on both sides (the seller and the buyer).

A true expert in the law of new information and communication technologies, the LEGALPROTECH-AVOCATS firm will be able to assist you in drafting or revising the contractual documentation for your website.

Christelle REYNO
Lawyer