A web shop's legal texts and data: eleven processors, not three
Nextica Law & Tax builds a web shop's legal and data layer: legal notice and general terms of sale with the pre-contractual information required by Law 34/2002 on information society services, privacy and cookie policies with a banner that captures valid consent, a record of processing activities, and —what almost nobody maps— the real processor chain: hosting, payment gateway, carrier, email platform, analytics and advertising tools, with their contracts and their international transfers identified one by one.
The cookie banner was copied from another shop. And the data processors are eleven, not three.
What's included
1. Drafting the legal notice and the terms of sale with the pre-contractual information the information society services law requires.
3. A real inventory of the processor chain
hosting or commerce platform, payment gateway, carrier, email and automation, analytics, advertising, chat, reviews and logistics operator.
4. A processing agreement with each, and the international transfer mechanism identified where there is one.
5. A record of processing activities with the real purposes, including the ones nobody declares: abandoned cart reminders, mailing lists, advertising audiences and order reviews.
6. A privacy policy written from that inventory, and not copied from another shop describing processing that does not happen here.
7. A breach and rights procedure, with internal deadlines set before they are needed.
THERE ARE ELEVEN PROCESSORS, NOT THREE
A shop's privacy policy almost always describes a simpler shop than the one actually behind it.
Legal texts copied from another shop
they describe processing that does not happen here and omit what does —abandoned cart reminders, mailing lists, advertising pixels, order reviews. And since the text is usually copyright protected, copying adds a problem on top of the problem.
arts. 13 and 30 General Data Protection RegulationA cookie banner that installs before consent
consent must be prior, informed and as easy to withdraw as to give, and a default configuration that switches on analytics and advertising does not meet that.
Law 34/2002 on information society servicesProcessors with no contract and transfers with no mechanism
every provider processing data on the shop's behalf needs its processing agreement, and those processing outside the European Economic Area also need their transfer mechanism identified.
art. 28 General Data Protection RegulationFrequently asked questions
Can I copy the legal texts from another shop like mine?
It is what almost everyone does and it is why almost every enforcement file starts the same way. Legal texts are not decoration: they describe specific processing operations, with their legal bases, retention periods and recipients, and another shop's texts describe theirs. Copying them produces two errors at once: you declare processing you do not carry out and omit processing you do —the abandoned cart reminder, the mailing list, the advertising pixel, the order review request. And since the text is usually protected by copyright, copying adds a problem on top of the problem.
How many data processors does an online shop really have?
More than appear in its privacy policy. The realistic minimum list includes hosting or the commerce platform, the payment gateway, the carrier and its tracking, the email and automation tool, analytics, the advertising platforms where audiences are uploaded, the support chat, the reviews app and, where logistics are outsourced, the operator picking the orders. Each needs its own processing agreement and, where data is processed outside the European Economic Area, its transfer mechanism identified. That inventory is half the work.
Let's talk about your company.
Tell us your situation and we'll reply within 24 working hours.