Legally online: Website terms and privacy
This is the third article in a legal series for start-ups by Lucy Luo, a tech lawyer at Simmonds Stewart. Part 1 covered what founders should think about when starting a company, and Part 2 discussed employees and equity. Please email email@example.com if you have legal questions you would like covered in this series.
Here’s the what and how of establishing a healthy relationship with your website’s users.
1. Make it available
Firstly, wherever your T&Cs appear on the website, it should be easy to access. Many websites contain a link to the terms on every page, or at least on the home page. The key point here is that your website users can easily find, read, and actively agree or consent to your terms at the earliest point possible in their on-boarding. The easier it is to find, the better.
2. What constitutes consent?
How do users “consent” to your terms – is it through passive use (i.e. browsing your content), or by being prompted to click agree? If consent is to be given through passive conduct, one way to address this is by defining what counts as “consenting” to the terms, for example:
By accessing and using the website of CoolStartup Limited*, you agree to be bound by these terms.
Similarly, you will want to say something about what happens if users do not comply with these terms:
If you do not agree to these terms, you are not authorised to access or use CoolStartup’s website, and you must immediately stop your access and use.
Passive consent or active acceptance of the terms can be seen as the website user entering into a “contract” with you, and agreeing to abide by the rules which you set out.
*fictitious name, also known as everyone’s start-up.
3. Updating the terms
The nature of the web, and most start-ups, is that change is constant. It’s likely that your terms may need to be updated from time to time (or from pivot to pivot). You will want to cover how the terms themselves are to be amended, for example:
CoolStartup may amend these terms at any time by updating them on the website, and you are responsible for ensuring you are familiar with the latest terms. These terms were last updated on 1 April 2014.
4. What law governs the terms?
Even though contracts have their own terms, it will still be ultimately enforced by the courts, and in accordance with the relevant law – but which law? Your website will be available all over the Internet, and therefore accessible by people in many different countries. To make life easier for your start-up, specify a country’s laws which will govern the terms, for example:
These terms are governed by the laws of New Zealand. You submit to the non-exclusive jurisdiction of the courts of New Zealand.
Choose a governing law which makes sense for your start-up (e.g. where the company or the majority of its users are based), and somewhere with a respected legal system. It may just save your start-up from being drawn into an unnecessarily cumbersome legal process later on. If you only want to operate in a particular country, then spell this out in the T&Cs, for example:
CoolStartup’s website is intended for users based only in New Zealand. We do not supply services outside of New Zealand.
5. Disclaiming liability
There are some things you can disclaim, but the governing law you choose, or the jurisdiction your start-up operates in, may also have something to say about it. For example, New Zealand has some consumer rights legislation which companies cannot contract out of – and therefore certain disclaimers would be unenforceable. It is common to see phrasing such as:
To the extent permitted by law (i.e. the law of the country you have chosen or which you operate in), CoolStartup’s liability does not cover… etc.
This is one reason why it’s important to get a lawyer involved for your T&Cs – they know the non-negotiable background legislation which may prevent you from relying on any disclaimers incorporated into your T&Cs.
6. Collecting data and Privacy
Be as transparent as possible about the following:
- what information you collect, and why
- how you will collect the information, e.g. cookies
- what you intend to do with the data – who can see it, and who can use it?
Users are entitled to access their information at any time, and must be given an opportunity to correct that information. The Privacy Commission summarises how privacy principles apply to information collection here.
7. Other things to consider
I cover some basic points on what standard T&Cs should cover, but depending on what kind of business you operate, there are a number of other clauses you may add.
If your start-up involves storing data in the cloud, then there are a whole host of other issues you need to cover, particularly where the information will be stored (i.e. the data centres), and what privacy laws apply there. The Privacy Commission has a published a comprehensive guide to making the right choices for cloud computing.
If you are selling anything on your website, you should be covering the terms around sale and payment.
If you are intending to showcase user-generated content, you should consider terms of what contributors can and cannot do, and who owns what content.
The good thing about T&Cs is that you can find public examples all over the web – but at the same time, the relevant wording can be quite bespoke for most start-ups and the type of liability they are willing to take on. New Zealand is also about to introduce some laws prohibiting unfair contract terms in early 2015 – so as usual, consult your lawyer (before CoolStartup Limited enters into a contract on unintended terms, with gazillions of users).
BIO: Lucy is a lawyer at Simmonds Stewart – a law firm passionate about technology and growing businesses. Our clients range from start-ups raising seed funding to some of New Zealand’s largest IT companies, as well as high net worth and private equity investors. We understand technology, and we also understand how hard it is to start a company – which is why we open-sourced our legal templates to help you to get started. Follow us on Twitter @techlawnz for updates, or get in touch anytime firstname.lastname@example.org.