Legally online: Website terms and privacy

This is the third article in a legal series for start-ups by Lucy Luo, a tech lawyer at Simmonds StewartPart 1 covered what founders should think about when starting a company, and Part 2 discussed employees and equity. Please email lucy.luo@simmondsstewart.com if you have legal questions you would like covered in this series.


 If your start-up has a website, then at some point in time it’s probably occurred to you to sort out some website terms and conditions. Also known as a “terms of use”, T&Cs are basically a contract between your company and anyone who uses your website, outlining the rules of access and use. If you do not have T&Cs in place, your contractual relationship with the website’s user is unclear, and therefore you may have no contractual remedy if they do something which causes you harm. It is also just good practice to inform your website users on their rights, and to address their concerns.

 Here’s the what and how of establishing a healthy relationship with your website’s users.

1. Make it available

Firstly, wherever your T&Cs appear on the website, it should be easy to access. Many websites contain a link to the terms on every page, or at least on the home page. The key point here is that your website users can easily find, read, and actively agree or consent to your terms at the earliest point possible in their on-boarding. The easier it is to find, the better.

2. What constitutes consent?

How do users “consent” to your terms – is it through passive use (i.e. browsing your content), or by being prompted to click agree?  If consent is to be given through passive conduct, one way to address this is by defining what counts as “consenting” to the terms, for example:

By accessing and using the website of CoolStartup Limited*, you agree to be bound by these terms.

Similarly, you will want to say something about what happens if users do not comply with these terms:

If you do not agree to these terms, you are not authorised to access or use CoolStartup’s website, and you must immediately stop your access and use.

Passive consent or active acceptance of the terms can be seen as the website user entering into a “contract” with you, and agreeing to abide by the rules which you set out.

*fictitious name, also known as everyone’s start-up.

3. Updating the terms

The nature of the web, and most start-ups, is that change is constant. It’s likely that your terms may need to be updated from time to time (or from pivot to pivot). You will want to cover how the terms themselves are to be amended, for example:

 CoolStartup may amend these terms at any time by updating them on the website, and you are responsible for ensuring you are familiar with the latest terms. These terms were last updated on 1 April 2014.

If you intend to make significant changes, particularly to the way you deal with users’ personal information, you may want to go the extra mile to highlight these changes. When Twitter recently started selling merchandise, they sent an email to notify users of its changes in terms and privacy policy.  Given the bad media associated with a lack of respect for users’ rights and privacy, your start-up may want to take an informative and transparent approach to updating terms.

4. What law governs the terms?

Even though contracts have their own terms, it will still be ultimately enforced by the courts, and in accordance with the relevant law – but which law? Your website will be available all over the Internet, and therefore accessible by people in many different countries. To make life easier for your start-up, specify a country’s laws which will govern the terms, for example:

These terms are governed by the laws of New Zealand. You submit to the non-exclusive jurisdiction of the courts of New Zealand.

Choose a governing law which makes sense for your start-up (e.g. where the company or the majority of its users are based), and somewhere with a respected legal system. It may just save your start-up from being drawn into an unnecessarily cumbersome legal process later on. If you only want to operate in a particular country, then spell this out in the T&Cs, for example:

CoolStartup’s website is intended for users based only in New Zealand. We do not supply services outside of New Zealand.

5. Disclaiming liability

A website disclaimer draws the boundaries of your company’s liability, in relation to the use of the website and its content. For example, earlier this year our law firm Simmonds Stewart open-sourced our legal templates for the public to use for free. On the same page as the templates, our terms of use state that, by making a legal template available to the user, we are not providing any legal advice, and we are not their lawyers. We disclaim liability for the use and access to our legal templates, as we do not want to be responsible for any unintended consequences arising from the misuse of our content. Think about what your website’s purpose is, and what liability you do not want your start-up to be responsible for.

There are some things you can disclaim, but the governing law you choose, or the jurisdiction your start-up operates in, may also have something to say about it. For example, New Zealand has some consumer rights legislation which companies cannot contract out of – and therefore certain disclaimers would be unenforceable. It is common to see phrasing such as:

To the extent permitted by law (i.e. the law of the country you have chosen or which you operate in), CoolStartup’s liability does not cover… etc.

This is one reason why it’s important to get a lawyer involved for your T&Cs – they know the non-negotiable background legislation which may prevent you from relying on any disclaimers incorporated into your T&Cs.

6. Collecting data and Privacy

If you are collecting any personal information from your users, your T&Cs should include a privacy policy to show how your start-up will respect the privacy of its users.

 Be as transparent as possible about the following:

  • what information you collect, and why
  • how you will collect the information, e.g. cookies
  • what you intend to do with the data – who can see it, and who can use it?

Users are entitled to access their information at any time, and must be given an opportunity to correct that information. The Privacy Commission summarises how privacy principles apply to information collection here.

7. Other things to consider

I cover some basic points on what standard T&Cs should cover, but depending on what kind of business you operate, there are a number of other clauses you may add. 

If your start-up involves storing data in the cloud, then there are a whole host of other issues you need to cover, particularly where the information will be stored (i.e. the data centres), and what privacy laws apply there. The Privacy Commission has a published a comprehensive guide to making the right choices for cloud computing.

If you are selling anything on your website, you should be covering the terms around sale and payment. 

 If you are intending to showcase user-generated content, you should consider terms of what contributors can and cannot do, and who owns what content.

 The good thing about T&Cs is that you can find public examples all over the web – but at the same time, the relevant wording can be quite bespoke for most start-ups and the type of liability they are willing to take on. New Zealand is also about to introduce some laws prohibiting unfair contract terms in early 2015 – so as usual, consult your lawyer (before CoolStartup Limited enters into a contract on unintended terms, with gazillions of users).


BIO: Lucy is a lawyer at Simmonds Stewart – a law firm passionate about technology and growing businesses. Our clients range from start-ups raising seed funding to some of New Zealand’s largest IT companies, as well as high net worth and private equity investors. We understand technology, and we also understand how hard it is to start a company – which is why we open-sourced our legal templates to help you to get started. Follow us on Twitter @techlawnz for updates, or get in touch anytime lucy.luo@simmondsstewart.com.

Tags: , , ,

Leave a Comments