- Hi everyone.
I'm attorney Aiden Durham with 180 Law Co.
in Denver Colorado.
And you're watching, All Up In Yo' Business.
(upbeat music)
(whooshing)
Continuing on with the trend of the week,
we are still talking about online businesses,
and more importantly in light of the coronavirus pandemic
that's going on right now, how you can start a business
when you can't leave your house.
And so in this episode,
we're gonna talk about another really important document
for your online business or your website,
which is the privacy policy.
But before we get into it,
please be sure to like, subscribe, and share.
And don't forget to check the description
for some additional resources and information there too.
So yesterday we talked about terms and conditions,
or terms of use for your website.
I said, legally these aren't required.
There's no real law that says that we have to have
terms and conditions on our website.
But even though it's not legally required,
it's still a really, really good idea.
The privacy policy on the other hand,
isn't just a really good idea, it is actually required.
So this is something that pretty much every online business
actually needs to have.
If you collect any kind of personal information
whether it be a name, email address, phone number,
mailing address, any kind of personal information
then you need a privacy policy on your website.
And this just becomes even more and more important
the more personal information you're collecting.
So especially if you collect sensitive personal information
like social security numbers, or medical history,
regardless of the nature of the information,
if you collect any kind of information
from people who visit your website
then you need a privacy policy.
A lot of third party apps and plugins
that we use on our websites like Google Analytics,
or Stripe credit card processors,
many of those third parties have separate requirements
for our privacy policies.
They state in their terms and conditions
what we need to put in our privacy policies
if we want to use those tools on our website.
So aside from the legal requirement,
there is this contractual requirement with any
third party apps that we might use on our websites too.
In the United States specifically,
the probably biggest privacy law that we know
about right now is in California.
And California has privacy requirements for any business
that collects personally identifiable information
from California residents.
So what that means is this doesn't just apply
to California businesses,
this applies to any business that collects information
from California residents.
So even if you're outside of California,
if California residents--
(dog barking)
If California residents visit your website,
and might submit your contact form,
or my comment on your blog,
then that's enough for you to be subject
to these privacy requirements that California puts out.
Similarly, the European Union has GDPR,
which governs privacy of personal information
of citizens of the European Union.
And so again just like California,
even if your business isn't actually located in the EU,
if you collect any kind of information,
personal information from people in the EU,
then you're subject to those GDPR requirements too.
So with all of these different requirements going on,
and different jurisdictions telling us what we need to do,
it can be kind of confusing figuring out
what exactly needs to be in our privacy policies.
And just like everything else, this is gonna completely
depend on the nature of your website,
the type of information that you collect on your website,
the tools and the apps that you have on your website,
that's all going to impact how your privacy policy
needs to read, and what needs to be included in it.
But at a bare minimum, there are a handful of things
that every privacy policy should include.
The first of course is the contact information
and name of the business.
Number one thing with this privacy is people's access,
and their ability to get information
about what kind of data we have on them.
So most importantly is that they can contact us.
So your privacy policy needs to include your business name,
and some contact information for how people can get
in touch with you regarding their privacy and their data.
Your privacy policy should disclose
what types of data, or what types of personal information
you collect from your website.
So for example this would be like
we collect your name and phone number,
or name and email address that you provide to us
through a contact form on our website.
Or we collect information that you post as a comment,
or a contribution to our website.
You would also wanna say things like we collect
demographic information like your location, age, and gender,
if you're using something like Google Analytics
where you can get that data.
And then also we collect your behavioral history
through cookies, and you know when you landed on this page,
and your traffic, and your interactions with our website.
If you collect that type of data,
then you need to tell your website visitors
that that's what you're collecting.
And you also wanna disclose
how you're collecting that information.
So again you can say we collect this information
when you submit a contact form,
or when you register for one of our promotions or giveaways,
or when you sign up or opt in for our email newsletter.
Whatever the modes or methods you take
to collect that information,
you need to disclose that as well.
And then we need to tell our website visitors
why we're collecting that information.
It's not enough to tell them what we're collecting,
we need an actual reason.
We need to let them know why we're collecting it.
A few common, acceptable reasons in a privacy policy
for collecting information
would be for customer service purposes,
to fulfill orders, or to respond to your inquiries
or requests, or for market research purposes,
or for doing promotions and marketing,
whatever the reasons for collecting that information,
that needs to be disclosed.
And then how you use that data.
So we are giving them the what kind of information
we collect ,how we collect it, why we collect it,
and now we're telling them how we use that information.
So again the reasons for using personal information
that we collect through our websites,
again customer service, or responding to inquiries,
fulfilling service requests,
or it could be to fulfill legal obligations,
or court orders, or another common use of that data
especially for some of the data like within your website,
like how your visitors interact with your website,
a lot of that is used to improve website speed,
or improve the function of your website,
or to improve the quality of your products or services.
Whatever it is, it's important to disclose
in your privacy policy,
how you use that data once it's been collected.
And also not only how you use it,
but how you share it with any third parties.
So if you have analytics, a Google Analytics tool
on your website, or if you do advertising
and you share your data with advertisers,
that personal information that you're collecting
about their demographics, or their location,
or their internet behavior.
You're sharing that information with Google,
or with your advertisers, or with service providers
if you hire let's say a marketing person
who's going to create newsletters
and send them out to your entire email list.
You're sharing your contact information,
your email lists with that service provider.
So that's something that needs to be disclosed,
the nature of how you use that information,
and share it with third parties.
And then finally, we need to tell website visitors
how they can opt out of getting their information collected
in this nature,
and how they can contact us to find out
what kind of information we have on them.
So in most jurisdictions, people whose information we hold
they have a right to know what kind of information
we have on them, or to correct it, or to have it removed
from our systems or from our database.
And so we need to give them clear information
about how they can opt out.
So this is typically something easy
like you can opt out by hitting the unsubscribe button
on our emails.
Or if your website, if your service is some kind
of a membership, or an account
where people have to log in,
and they have an account dedicated to them,
it can be something like you can opt out
by changing the email,
or notification settings in your account.
Again this depends on the nature of your website
and your services,
but we need to tell people,
and people need a easy way of opting out
of having their information collected
or getting communications from us
because of that information.
And then again remember I mentioned this in the beginning
but tools like Google Analytics, credit card processors,
any other kind of plugins
or apps that we might use on our website,
those are often going to have their own requirements
for what we need to put into our privacy policies.
So it's important to check any of those terms of use,
or terms of service for those products, or those apps too.
The biggest idea behind privacy policies
and why all this exists
is transparency, and being forthright with website visitors
about their information, and giving them the rights
to protect their personal information.
That's all for this episode folks.
Drop a comment below and let me know what you think.
And don't forget to check the description
for more resources and information.
Thank you so much for watching.
I'm Aiden Durham, and I'll see you next time.
(calm upbeat music)