How can you make your eCommerce site compliant?
If you have an online store, you must comply with the regulations that apply to the digital world, set out in Spain’s Organic Law on Data Protection and Digital Rights (LOPDGDD), the Information Society Services Act (LSSI), the General Law for the Protection of Consumers and Users (TRLGDCU), etc. We understand this can be very complex, as there are many rules and they change very often, but we’ll do our best to break it down in an easy way.
Let’s get started!
First of all, let’s answer a question we get asked a lot… Do all websites have to comply with the regulations?
The answer is simple: YES.🫡 What changes from one site to another is the type of document you need to make available to users and its content. But whether you have a blog or an online store, you’ll need a Legal Notice and a Privacy and Cookie Policy if you have a contact form, for example.
And for online stores, whether you run a marketplace for second-hand electronics or mystical professional services, or sell fresh vegan products, you’ll need Terms of Use or Terms of Purchase that govern your relationship with users and customers (setting return periods, right of withdrawal, shipping costs, etc.) and protect your business by making the limits of your liability very clear.
What documents does an online store need to comply with the regulations?
The answer may vary slightly from one online store to another depending on the business model, but broadly speaking it will need a Legal Notice, a Privacy Policy, a Cookie Policy, and Terms of Use or Terms of Purchase.
Let’s see what each one involves 👀:
- Legal Notice: Law 34/2002 on Information Society Services (LSSI) transposed this European directive into Spanish law, establishing in its Article 10 the need to identify website owners and provide a free way for users to contact them.
- Privacy Policy: If your website collects personal data, such as an email or postal address, it must include a section, known as the Privacy Policy, that specifies how the owner processes that data, for what purpose, who it is shared with, etc., and therefore how it complies with European and Spanish regulations.
- Cookie Policy: As set out in Article 22 of the Information Society Services Act (LSSI) and according to the guidelines of the Spanish Data Protection Agency, all websites must state whether or not they use cookies and, if so, for what purpose. The regulations also define exactly how this information must be presented to users.
- Terms of Purchase: If you have an online store or sell products through your website, it must include Terms of Purchase that govern how you will sell your products. This document must inform users of the conditions under which products are sold, such as delivery times, prices for different shipping methods, withdrawal periods, how to make returns, and the products’ legal and commercial warranties, among others.
- Terms of Use: Like the previous one, Terms of Use govern how a website offers paid services that require users to register or subscribe first. This document sets out the conditions under which the service will be provided, such as price or duration, right of withdrawal, minimum commitment period, etc.
- But you may be wondering: what about the Cookie Banner? No, we haven’t forgotten 😉 The cookie information banner is mandatory for all websites that use cookies. It must disclose the cookies being used, classified by purpose, so that users can reject any cookies that are not strictly necessary.
This means a Cookie Banner cannot install any cookie or similar technology that is not technical or necessary for the website to function until the user accepts it.
Also, if you display third-party ads on your website with Google AdSense, for example, you should know that from January 16, 2024, if you don’t install one of the Cookie Banners certified by Google and the IAB in version 2.2, you will no longer be able to monetize these spaces.
What happens if I don’t comply?
The most common penalties relate to data protection and are imposed by the Spanish Data Protection Agency for breaching the Organic Law on Data Protection and Digital Rights (LOPDGDD) or the cookie provisions of the Information Society Services Act (LSSI). These fines can reach up to 4% of any company’s annual turnover 😱.
This doesn’t mean Spain’s regional governments can’t impose the penalties set out in Title IV of the General Law for the Protection of Consumers and Users (TRLGDCU) for failing to meet its obligations regarding the information you must give users when they sign up or the rights you must respect.
As you can see, making your eCommerce site compliant is far from simple, and Lawwwing wants to give you a hand:
At Trilogi we’ve partnered with Lawwwing, the platform that lets you forget about everything you’ve read in this article just by installing a plugin. It seems like magic, but it isn’t. Contact us and ask for more information.
