Running an online store isn't just about managing orders, polishing text and images, or improving the user experience to maximize the use of existing infrastructure. A completely separate area of expertise lies in the legal regulations that, when properly formulated, protect both the online seller and the consumer. It's the store that often handles sensitive personal data, and it's the business that's at the heart of this business. Therefore, when running an online store, it's important to ensure that all legal matters are taken care of down to the last detail. It's an investment in the peace of mind of both the business and the consumer, which Bartosz Wojciechowski, an expert in this field from Answer Law Firm , will explain in more detail.
Dominika Mączka: Hi Bartosz, it's great that we managed to conduct this interview! Before we get into specifics, let's introduce our readers to the topic: tell us briefly who you are and what you do.
Bartosz Wojciechowski: I am a lawyer whose professional interests are closely linked to modern technologies, online media, advertising , copyright, industrial property, cybersecurity, and personal data protection. I have had the pleasure of developing legal policies for websites such as Allegro, Ceneo, PayU, OLX, Otomoto, Wykop, Bankier.pl, Sendit, Autenti, and many others. At the "Answer" Law Firm, I collaborate with a group of lawyers for whom digitalization is both a daily challenge and an ally.
DM: So, as an expert, can you briefly explain whether GDPR-style nightmares should keep entrepreneurs awake at night?
(The rest of the article can be found below the form)
BW: The GDPR can be particularly daunting due to its high fines. This general data protection regulation, applicable throughout the European Union, provides for penalties for non-compliance of up to €20 million or 4% of total annual turnover. On the other hand, the GDPR is a set of clear rules and mechanisms that can be tamed and wisely adapted to any company, thus providing entrepreneurs with greater peace of mind.
It is worth focusing on properly addressing the personal data protection process, not only to avoid exposing your business to fines, but also to ensure that your customers perceive you as a reliable and solid company to which you can safely entrust your data.
Law and starting a business in the online world
DM: When planning the development of an online business – what should we remember when setting up a company and wanting to operate online?
BW: The foundation of an online business is our distinctive feature and the online presence where customers will find us. Most often (though not always), this is a specific internet domain, for which a subscription is easily purchased. However, to avoid losing the right to use a domain, we should ensure appropriate protection for its name (trademark), something many entrepreneurs forget. It's also crucial that entrepreneurs properly acquire the rights to the content published as part of their business or to the computer program used to provide online services. Furthermore, our online customers must have access to specific information that we, as entrepreneurs, are obligated to publish (regulations for the provision of electronic services, a mandatory set of consumer information, information about cookies, clauses collecting consent for sending commercial information, and the use of telecommunications terminal equipment). Another important issue is whether the entrepreneur is authorized to provide a specific activity, for example, whether they hold ownership rights to the goods they offer, or whether they have the necessary consents or licenses to perform specific types of services.
DM: When should a website have a privacy policy (does it always have to?)
BW: While a privacy policy isn't a document explicitly required by law, I personally recommend having one as a sign of good market practice for any website that collects any customer information or installs cookies . This is because a privacy policy helps meet a number of requirements regarding the disclosure obligations that businesses are required to fulfill by law. Furthermore, compiling transparent information in a single document demonstrates the entrepreneur's class, as it allows customers to easily access information about how customer data is handled.
DM: What does it look like for online stores? What information must be included on a store's website and what should be reported to lawyers?
BW: Online stores should have, in particular, a standard sales agreement (terms and conditions) that defines the rules under which transactions are conducted. This indicates what behaviors of internet users (e.g., clicking a specific button) will result in a legal consequence in the form of a declaration of intent to make a purchase and commit to pay a specified price. The terms and conditions should also address a number of other, more detailed provisions, such as how to set up an account, make purchases without registration, and how to handle complaints. The terms and conditions also include legally required information for consumers (in particular, information arising from Article 12 of the Consumer Rights Act, including: the seller's registration data, information for filing complaints, information on the method and deadline for exercising the right of withdrawal or in cases where it may be excluded, the possibility of using out-of-court complaint and redress procedures, and the rules for accessing these procedures). The terms and conditions should also specify how product databases can be used to prevent abuse.
I would advise combining the sales regulations with the regulations for the provision of electronic services (referred to in the Act on the provision of electronic services), regulating the rules of access to electronic content on the online store's websites or, for example, the sending of a periodic newsletter.
Furthermore, an online store should be equipped with a number of information clauses and consents that must be collected in accordance with legal regulations (e.g., information clauses arising from Article 13 of the GDPR, acceptance of terms and conditions, consent to receive commercial information by the customer, or profiling). It's important to remember that it's not always necessary for the customer to select a consent checkbox. The frequent use of checkboxes negatively impacts transactional efficiency, so they should be used prudently and in accordance with legal requirements. It's beneficial to have a privacy policy and a cookie policy.
Businesses are definitely more secure when lawyers prepare the necessary documentation and clauses. However, it's important to ensure that addressing legal requirements doesn't overwhelm the website's content, distorting its commercial nature. Therefore, it's crucial to do so skillfully.
Check out related articles
DM: What is the difference between store regulations and privacy policy?
BW: A store's terms and conditions are essentially a sales agreement we enter into with an online user who decides to make a purchase. Terms and conditions should also explain how the sale is made and describe possible cases of non-fulfillment. Some online stores overlook such regulations, unaware that without them, it will be impossible to effectively cancel a purchase , for example, if payment is not made within a specified time. A privacy policy, on the other hand, is a collection of information about how the store operator processes and protects personal data. The policy's purpose is to inform users about the mechanisms and measures used, while also protecting the interests of the personal data controller.
DM: What digital-related issues do clients most often ask for solutions to?
BW: The online environment is a treasure trove of incredibly interesting legal issues, and we can't complain about their diversity. We most often receive assignments involving reviewing and strengthening personal data protection tools, including developing privacy and cookie policies , reviewing and adapting regulations and information clauses, as well as implementing the ability to conclude contracts online (including employment contracts), transferring copyrights, and supporting dispute resolution processes. Many online issues rely on licensing rights, often using unconventional licenses such as SaaS (software as a service), PaaS (platform as a service), or IaaS (infrastructure as a service). Much of our work is based on assisting in the proper adaptation of FOSS (free and open source software) solutions. It's not always the case that using free software means there are no strings attached. We also help integrate (in the legal sense) existing solutions with cloud computing solutions. A completely separate topic and extensive legal area that we deal with is the support of gaming and e-sports products.
Law and lead generation, collecting contacts and addresses
DM: When sending a newsletter or collecting leads, what should we remember in the context of law and personal data processing?
BW: We should, above all, bear in mind that, as a rule, collecting data for marketing purposes requires consent. Furthermore, the individuals whose data we collect or further process should have access to a range of information about the scope, methods, and purpose of processing, as well as their rights in this regard. Therefore, we should take care to address these issues, but also ensure that they are not too intrusive for our potential clients.
Thus, consent to sending a newsletter can be prepared concisely and reduced to providing the user with a link to the newsletter service regulations with an appropriate indication that the sending is based on it, a field for entering the e-mail address and a "save" button.
Separate consent is not required if data processing takes place in connection with the customer's actions undertaken before concluding the contract , i.e. answering questions about products or offers, determining the details of the contract.
However, I recommend extreme caution when basing your sales funnel on personal data databases . Remember that trading in such databases often violates the rights of the individuals whose data is processed within them. Therefore, ensure that these individuals have consented to this type of data processing. Consult with lawyers on how to proceed in such cases to avoid consequences.
DM: Is submitting a GDPR declaration about having read the information clause required every time or is submitting it once sufficient?
BW: GDPR provisions do not require the submission of declarations confirming that the data subject has read the information clause. It is only necessary for the Controller to be able to demonstrate that it has fulfilled its obligation to provide information to the data subjects. Therefore, it is sufficient to provide the data subject with an opportunity to read the information clause. However, if the data controller plans to process the data in a manner different from that indicated in the information clause, they are obligated to provide the data subject with information about the new (different) purpose of processing, along with relevant information. The same applies to a significant change to the information clause. Whether a change is significant should be assessed from the perspective of the data subject and how unexpected/obvious the change would be to them. The GDPR does not specify the time requirements (or methods) that should be used for notifying about changes. However, if a change in the information indicates a material change in the nature of the processing (e.g. extension of the categories of recipients or initiation of transfers to third countries) or a change that may not be material in the context of the processing operation but may be relevant to and affect the data subject, then such information should be made available to the data subject well in advance of the change coming into effect and the method used to communicate those changes to the data subject should ensure clarity and effectiveness.
DM: Sending offers to new clients and GDPR
BW: In practice, sending offers to potential customers to their individual email addresses or end devices may be based on their consent. The recipient of the offer may express their consent directly or implicitly, for example, by providing their email address, including authorizing the further sharing of personal data (after fulfilling the information obligation, of course), or by accepting the terms and conditions (e.g., newsletter terms and conditions) under which the Administrator will deliver the requested content. This restriction does not apply to emails sent to general company accounts , not assigned to individual users.
Consent to sending offers electronically is not always required , in particular when:
- The entrepreneur communicates with the customer to fulfill the order or service. This includes information about the order's status and estimated delivery time.
- A potential customer expresses interest in learning about the offer. However, it should be remembered that a customer inquiring about an offer implicitly wants to receive a single piece of information from the entrepreneur in the first phase of communication. Therefore, the entrepreneur has no right to save the inquiring entrepreneur's address and send them other offers or information.
- a potential customer makes his or her email address public in order to receive offers or advertisements.
DM: Marketing consents for data processing and marketing contact by telephone/email in lead ads forms on Facebook
BW: When using Facebook Lead Ads, users who click on an ad provide personal data, most often including an email address or phone number linked to their name (Facebook profile). Therefore, in the case of marketing activities on Facebook, we may obtain personal data.
However, the GDPR requires that consent to the transfer of personal data be given actively, expressly, and knowingly by the data subject. Therefore, the user's explicit consent to the transfer of personal data must be obtained by using the checkbox option within the contact form. The content of the checkbox should correspond to the purpose for which the personal data is being collected. It is important to ensure that the checkbox always corresponds to the actual purpose of data use. We also advise avoiding combining different means of communication within a single consent (e.g., separate consent for emails, separate consent for contact phone calls).
Facebook requires you to add a privacy policy to the Lead Ads form. As previously mentioned, this is not a GDPR requirement, but it is an excellent opportunity to fulfill your disclosure obligations towards the individuals whose data you collect. It's worth remembering that what Facebook explicitly requires doesn't necessarily equate to the legal requirements for the proper processing of personal data, so we encourage you to verify that you've completed all necessary steps.
DM: Should an IP address be considered personal data?
BW: Personal data is data that allows for the identification of a specific person, as well as for the identification of that person with a certain expenditure of time, effort, or effort. An Internet Protocol (IP) address should be considered personally identifiable information because Internet service providers and local network managers can, using reasonable means, identify specific Internet users based on it by systematically recording the date, duration, and dynamic IP address assigned to a given person in files. The same applies to Internet service providers that maintain a logbook on an http server.
Therefore, in cases where an IP address is permanently or permanently assigned to a specific device assigned to a specific user, it should be considered personal data. However, an IP address will only be considered personal data if the entity processing the IP address also has access to data linking the IP address to other personally identifiable information. Until the entity is certain that it cannot link the IP address to other personally identifiable information, it should protect the IP address as if it were personal data.
Law and advertising on the Internet
DM: When it comes to Google Ads ads, can you show up on your competitors or not?
BW: You should be very careful when selecting phrases containing competitor names for your campaign. Using a competitor's name in keywords for which an ad is displayed is not prohibited, as long as it doesn't involve the use of someone else's trademarks or mislead the audience as to the source of the advertised product or service. However, mentioning the name in the ad itself is permitted if you are reselling the manufacturer's goods, legally purchased within the European Economic Area. However, the ad's content must be consistent with fair market practices and must also not mislead the advertised product's source.
DM: What other restrictions apply to us regarding the display of ads on Google?
BW: Google has introduced numerous restrictions on the ads it displays . Advertising counterfeits or dangerous products or services is prohibited, and the ad itself or the website it links to cannot contain shocking content or promote hatred, intolerance, discrimination, or violence. It also prohibits promoting products or services intended to facilitate "dishonest behavior," such as software or instructions for cracking security, services designed to artificially increase website or ad traffic, or presenting false information (e.g., concealing payment details). Advertising of sexually explicit content, pharmaceuticals, alcohol, or gambling is also prohibited.
DM: What should you remember when running a contest on Facebook or Instagram?
BW: Social media platforms typically require that each promotion have its own terms and conditions, primarily those that explicitly release the platform from liability in connection with the promotion and that the promotion is in no way administered by or associated with the platform. Furthermore, it is required to specify the conditions for participation in the promotion, such as age and place of residence. The use of users' private timelines or connections with friends is also prohibited. This means that users cannot be required to share anything on their profile or tag their friends. However, users may share content in the comments under the contest post.
DM: Does every promotion have to have terms and conditions?
BW: From a legal perspective, except when required by a social media platform or pertaining to a promotional lottery, regulations are not a necessary condition for running a specific promotion. Regardless of legal requirements, however, we recommend creating short regulations or at least a set of rules governing the promotion to avoid any doubts or misunderstandings with participants that could undermine the intended effect.
Unfair actions of competitors – how to deal with them?
DM: When can we say that a competitor is going too far when copying business solutions?
BW: The internet, with all its benefits, also brings numerous opportunities for dishonest activity, often in numerous forms and forms never before seen (e.g., cybersquatting, typosquatting, phishing). This often happens without the awareness of those whose rights are being violated, and sometimes even without the knowledge of those who inadvertently become violators. Therefore, it's worth pointing out, at every opportunity, what is and isn't permitted in the use of other people's publications or online markings.
When it comes to business solutions, there is generally no prohibition against operating based on the same business model. To some extent, imitation of a given entrepreneur's products by their competitors is accepted as one method of counteracting market monopolization. For example , copying product elements is permitted to the extent that these elements are not protected by exclusive rights (patent, industrial design, utility model, trademark, copyright) and to the extent that their copying does not pose a risk of confusion regarding the identity of the product or the entrepreneur offering it. Copying business solutions violates the principles of fair competition when such action is aimed at impersonating the name and reputation of another entrepreneur, or when a competitor's action aims to exploit another entrepreneur's achievements in promoting a product in order to promote the competitor's generically identical product in the minds of users without incurring any own efforts or financial outlays to promote it.
Much of the content shared by businesses online will benefit from exclusive rights—e.g., verbal descriptions, photos, graphics, diagrams, and so on. In the case of copying content, a business may invoke a competitor's use of so-called parasitic competition, meaning a market participant exploiting the work of another business without incurring the costs of achieving that work. Parasitic competition can occur, for example, when a competitor refers to another business's trademark, company name, advertising, appearance, or color scheme of a product that is familiar and recognized by buyers. A product should also be understood as a virtual product (e.g., a website).
However, it is not always a violation of copyright to use a specific content layout on a competing news site, provided that no copied graphics or texts are used. Nor is it a violation of the rules for a competitor to use a color scheme based on the color green on a site dedicated to ecology. On the other hand, slavish imitation (faithful imitation of the external appearance of a product, making it impossible to distinguish the copy from the original) is undoubtedly an act of unfair competition, punishable by sanctions. Therefore, faithful copying of a business's domain content by a competitor (in addition to being protected by exclusive rights) constitutes a violation of the principles of fair competition and justifies pursuing appropriate claims against that competitor.
A separate area of infringement may be domain name torts, based on the use of similar domains, utilizing a word trademark, or the most common mistakes made when entering an address into an internet search engine (so-called typo). As mentioned earlier, an internet domain is an important component of our online business and should therefore be properly protected, including by combating potential infringements.
Other violations may include, for example, extorting personal data of our customers, logins or passwords, or copying our databases.
In the event of violations of our rights, we should respond quickly by informing the infringing party that we are pursuing our rights. In practice, such a request often achieves the intended effect, and if the damage is minor, there is no need to escalate the matter. This is because infringers may only then realize that an actual violation of the law has occurred, which they did not intend. Even if they had considered such a possibility, they now know that not only have we discovered the violation but, thanks to the internet, we also have evidence of such activity. The inevitability of consequences for the infringing party is very real, so resorting to litigation can only increase the costs.
DM: If someone steals content and images from my website, do I have any rights?
BW: The theft of photos or graphics from our website is extraordinary, because at first glance, nothing is lost. But at the expense of our creative work (or the work we've acquired), another person, usually a competitor, benefits. In such cases, we can demand that the person who has infringed our copyright: cease the infringement, repair the damage caused, or take steps necessary to remedy the effects of the infringement, including making a public statement of appropriate content and form, releasing the benefits the infringer has earned, or paying a specified sum of money to us or to a specific social cause.
However, legal protection applies to works, i.e., manifestations of creative activity of an individual nature, established in any form, regardless of value, purpose, or means of expression. Typically, in the case of websites, these are created texts, photos, graphics, or sounds. However, it may turn out that what we possess is not a work.
And the last question 🙂
DM: Do you think that the change in the law on treating companies as consumers will help or hurt business?
BW: I have mixed feelings about this. On the one hand, it's great that attention is being drawn to the weaker position of sole proprietorships, but on the other hand, we're introducing a lot of ambiguity regarding how to treat invoices for purchases, which entrepreneurs will include in the costs of their business. Until now, entrepreneurs have had to decide whether they're buying as a consumer, with the right of withdrawal and a longer warranty, or whether they're buying as an entrepreneur—requesting an invoice and including it in their costs. After the changes, uncertainty arises, and sellers (including sole proprietorships) won't always know what type of sale they're currently participating in, and therefore whether their counterparty—a sole proprietorship—is buying as a consumer or an entrepreneur. It seems, therefore, that the effort to extend the rights currently enjoyed by consumers to an additional group could have been treated as a universal principle and applied to all buyers without exception, thus dispelling any doubts about accounting issues.
And finally, the traditional bio:
Bartosz Wojciechowski
Legal Counsel at ANSWER Law Firm. An expert in providing legal services to companies in the high-tech sector, he has been responsible for shaping the legal policies of major e-commerce sites, including Allegro, PayU, OLX, Ceneo, Otomoto, Otodom, Sendit, Autenti, and Wykop, and has supported the legal supervision of a number of websites in Central and Eastern Europe. He has extensive experience in commercial law, M&A, and contract law. He is passionate about the law of high-tech and electronic media, as well as issues related to contract drafting and negotiation.
Frequently asked questions about online advertising law
Although the GDPR imposes significant penalties (up to €20 million or 4% of annual turnover), these regulations should not paralyze businesses. They should be treated as a set of clear rules and mechanisms that, when properly implemented, allow for the legal and secure processing of customer data.
The absolute foundation of any legitimate e-commerce business is having well-written terms and conditions and a transparent privacy policy. These documents protect the seller's interests and peace of mind, while also ensuring respect for consumer rights (e.g., regarding returns and complaints).
When collecting email addresses or phone numbers from potential customers (e.g., for a newsletter database), you should always ensure voluntary and informed consent to marketing communications. Users must know who the controller of their data is and for what purposes it will be used.
Online advertising must not mislead the audience (e.g., regarding the actual price, product specifications, or its origin). It is essential to maintain transparency of the message and rigorous compliance with copyright when using all graphic and video materials.
If another company is copying your texts, photos from your online store, or impersonating your brand, you don't have to remain passive. Such actions constitute acts of unfair competition and copyright infringement – in such situations, it's worth seeking legal support to effectively block infringement and protect your established image.
Summary
The above article covers the following topics:
- legal regulations regarding online advertising,
- what regulations apply when setting up an online business,
- how to legally collect contacts and addresses,
- Internet advertising in the light of the law,
- how to respond to unfair competition on the Internet.
