COOKIE LAW

In addition to preparing a cookie policy, to adapt a website to the cookie law it is also necessary to show a cookie banner at the first visit of each user and acquire consent to the installation of cookies . Some types of cookies, such as those released by tools such as social sharing buttons, must in fact be released only after obtaining valid consent from the user.

What is a cookie?
Cookies are used to store some information on the user's browser while browsing the site. Cookies are now essential to allow the correct functioning of a site. In addition, many third-party technologies that we usually integrate into our sites, such as a simple YouTube video widget, also use cookies.

SPACE

CONSENT ACCORDING TO GDPR AND LGPD

Pursuant to the GDPR, if the user has the possibility to directly enter personal data on the site/app, for example by filling out a contact form, service registration form or newsletter subscription form, it is necessary to collect free, specific and informed consent , as well as record unequivocal proof of consent .

Similar to the GDPR, the Brazilian LGPD also requires the data controller to demonstrate, through the storage of evidence, that the user's consent has been correctly collected.

What is meant by free, specific and informed consent?
It is necessary to collect a consent for each specific processing purpose – for example, a consent to send newsletters and another consent to send promotional material on behalf of third parties. Consents can be requested by providing one or more non-pre-selected, non-mandatory checkboxes accompanied by informative texts that make it clear to the user how his/her data will be used.

How can consent be demonstrated unequivocally?
You need to collect a set of information whenever a user fills out a form on your site/app. This information includes a unique user identifier, the content of the privacy policy accepted, and a copy of the form presented to the user.

Is the email I receive from the user after completing the form not sufficient proof of consent?
Unfortunately, this is not sufficient, as some information necessary to reconstruct the suitability of the consent collection procedure is missing, such as a copy of the form actually filled out by the user.

Do I need to comply with the LGPD even if my organization is not based in Brazil?
You fall within the scope of the LGPD if you process data of people who are within Brazilian territory, regardless of their nationality (even if they were only in Brazil at the time of data collection, and have since moved).

SPACE

CCPA

The CCPA (California Consumer Privacy Act) requires that California users be provided with information about how and why their data is being used, their rights in relation to that data, and how they can exercise those rights, including the right to opt out. If you fall under the CCPA, you must provide this information both in your privacy policy and in a notice of data collection displayed on the user's first visit (where applicable).

To facilitate opt-out requests by California users, you should include a “Do Not Sell My Personal Information” (DNSMPI) link both within the data collection notice displayed on the user’s first visit and elsewhere on the site that is easily accessible to the user (a best practice is to include the link in the footer of the site).

My organization is not based in California, do I still need to comply with CCPA?
The CCPA may apply to any organization that processes or could potentially process personal information of California users, regardless of whether the organization is located in California. Since IP addresses are considered personal information, any website that receives at least 50,000 unique visits per year from California is likely to fall under the CCPA.

SPACE

TERMS AND CONDITIONS

In some cases, it may be appropriate to protect your online business from liability by preparing a Terms and Conditions document. Terms and Conditions usually include clauses regarding the use of content (copyright), limitation of liability, conditions of sale, allow you to list the mandatory conditions required by consumer protection legislation and much more.

The Terms and Conditions should include at least this information:

• the identification data of the activity;
• a description of the service offered by the site/app;
• information on risk allocation, liability and disclaimers;
• warranties (if applicable);
• right of withdrawal (if applicable);
• safety information;
• usage rights (if applicable);
• conditions of use or purchase (such as age requirements or country restrictions);
• refund/replacement/suspension of service policies;
• information on payment methods.

When is it mandatory to prepare a Terms and Conditions document?
Terms and Conditions can be useful in any scenario, from e-commerce to marketplace, from SaaS to mobile app and blog. In the case of e-commerce, it is not only advisable, but often mandatory to prepare this document.

Can I copy and use a Terms and Conditions document from another site?
The Terms and Conditions document is essentially a legally binding agreement, and therefore it is not only important to have one, but you also need to ensure that it complies with legal requirements, that it correctly describes your business processes and model, and that it remains up to date with relevant regulations. Copying Terms and Conditions from other sites is very risky as it may render the document null and void.