Last updated on 24 May 2022 by Robert Bateman (Privacy and Data Protection Research Writer at TermsFeed)
If you've recently started an ecommerce business using WooCommerce, you're going to be focused on sales, suppliers, and investment. But you have other important duties too, such as complying with privacy law.
Every online business must post a Privacy Policy that lets customers know how and why they need to process personal information. Failing to publish a Privacy Policy makes your business appear amateurish, and puts you in breach of the law.
In this article, you'll learn how to create a basic Privacy Policy for a WooCommerce-powered store, and what extra information you'll need to comply with the privacy laws of some major markets.
Our Privacy Policy Generator makes it easy to create a Privacy Policy for your business. Just follow these steps:
Enter the email address where you'd like the Privacy Policy delivered and click "Generate."
You'll be able to instantly access and download your new Privacy Policy.
Yes, your WooCommerce-powered store needs a Privacy Policy.
As an ecommerce business, you need to collect and process the personal information of your customers, your potential customers, and the visitors to your website.
Therefore, you're required by law to post a Privacy Policy that explains how and why you collect and use personal information.
Your Privacy Policy must meet the requirements of whatever privacy laws apply where your customers live. This can get a little complicated, particularly if you have customers in multiple regions.
First, we'll run through the basic information that every Privacy Policy should contain. Then we'll look at some additional region-specific clauses you might need to include as well.
Your Privacy Policy should explain how you collect personal information. You can also use this section of your Privacy Policy to identify all the different types of personal information you collect.
There are probably two main ways in which you collect personal information:
You might also receive personal information from third parties, such as social media channels or subsidiary companies.
Your users provide the following types of personal information to you voluntarily:
Here's an example from ecommerce store Boodles:
Boodles explains that people might provide their personal information via the following channels:
In addition to the personal information your customers provide to you, there's also the personal information you automatically collect from visitors to your website. The means by which you collect this type of personal information might include:
The types of personal information you collect in this way might include:
Here's an example from PhotoBite:
You might be surprised to see some of these types of data listed as "personal information." However, personal information is defined very broadly, especially in places such as California, Canada, and the EU.
Therefore, you should use your Privacy Policy to disclose any type of information you're collecting from your customers.
You should only collect personal information if you have a specific reason for collecting it. Your Privacy Policy should explain how you use every type of personal information you collect.
The table below describes some typical activities of an ecommerce business, together with the types of personal information it might need to collect for these purposes.
Some typical activities of an ecommerce business: | Types of personal information it might need to collect for these purposes: |
Communicating with a customer about their order or their customer service queries: | Name, email address, phone number |
Processing a customer's order: | Name, shipping address, billing address, payment card details |
Advertising: | Cookie ID, email address |
Improving your website or app: | Analytics data, e.g. website usage |
For security and fraud prevention: | IP address, cookie data |
Setting up an account: | Username, password |
Here's how clothing retailer River Island explains some of the ways in which it uses personal information:
If you use cookies to deliver personalized advertising, you should offer a little more information about how and why you do this. Your Privacy Policy should explain:
Here's how Mary's Meals explains why the company uses cookies:
Many businesses publish a separate Cookies Policy for this purpose. However, you can use a section in your main Privacy Policy if you prefer unless you're required by law to do otherwise.
Practically every business needs to share personal information or to allow other companies to collect personal information on its behalf.
If you run a WooCommerce store, it's likely that your customers' personal information will be processed by third parties such as Wordpress, WooCommerce, and Stripe (which processes payments on behalf of WooCommerce Payments).
Think about the WordPress plugins you use that also collect personal information. For example, if you use a Google Analytics plugin, such as MonsterInsights, you should mention both service providers in your Privacy Policy.
You might also share personal information with:
Here's a section of a Privacy Policy from Scandanavian Diamonds, a WooCommerce retailer:
The business lists Wordpress, WooCommerce, Google Analytics, and MonsterInsights among the third parties with which it shares personal information.
You should also provide links to the Privacy Policies of your third-party service providers.
Here's how jewelry retailer Eileen Gatt does this:
Note that you don't necessarily have to identify your third parties service providers by name. It may be sufficient to list the types of third parties with which you share personal information (e.g. "payment processors," "mail carriers").
You should provide contact details for your company in case visitors have any questions about your privacy practices.
Here's an example from Kefi:
Note that Kefi has set up a dedicated email address to deal with privacy queries. This helps the business demonstrate to its customers it's taking their privacy seriously.
So far we've covered the basic information that every Privacy Policy should contain. Now we're going to look at some of the specific information required under the privacy laws of some major markets worldwide.
If you have customers in the US, your main concern should be complying with that state privacy law of California, specifically the California Online Privacy Protection Act (CalOPPA).
CalOPPA applies to all commercial websites that are accessible in California.
Under CalOPPA, your Privacy Policy must:
Here's an example of how Medtronic discloses how its website treats "Do Not Track" signals:
California has several privacy laws that require businesses to publish a Privacy Policy, including:
For more information about complying with all these laws, see our article Sample California Privacy Policy Template.
The EU has the highest privacy standards in the world, and the UK still enforces them despite having left the EU.
If you have customers in the European Economic Area (the EEA, which includes all 27 EU countries plus Iceland, Liechtenstein, and Norway) or the UK, you must comply with the General Data Protection Regulation (GDPR).
Under the GDPR, your Privacy Policy must, at a minimum:
Here's how Bowles & Wyer explains how users can make a complaint to the UK's Data Protection Authority, the Information Commissioner's Office (ICO):
Note that the business encourages users to make a direct complaint before going to the ICO. This is perfectly reasonable.
For more information, see our article GDPR Privacy Policy.
Canada's main private-sector privacy law is the Personal Information Protection and Electronic Documents Act (PIPEDA). If your business serves Canadian customers, you'll need to post a Privacy Policy that complies with PIPEDA.
PIPEDA requires that your Privacy Policy must, at a minimum:
Here's how Bayer Canada explains the right to access personal information under PIPEDA:
For more information, see our article Privacy Policy for Canada.
Here are some links to information about other regions in which a Privacy Policy is required:
Here's our guide to privacy laws by country to help you out.
Now that you have a compliant, detailed Privacy Policy, here's how you should display it to your customers.
To add your Privacy Policy to your WooCommerce store, simply post it on a page on your website as a link titled "Privacy Policy."
You'll need to link to your Privacy Policy whenever you collect personal information from your customers. Here are a few examples of when and where.
Make your Privacy Policy available on your website's footer alongside any other legal information, such as your Terms and Conditions.
Here's how Woocommerce-powered clothing retailer The Neighbourgoods does this:
It's important to link to your Privacy Policy at checkout when your customers are about to submit financial information and a mailing address.
Here's how the WooCommerce-powered website Spike Island does this:
It's particularly important to make your Privacy Policy available when asking people to sign up to newsletters or direct marketing emails.
Here's how WooCommerce-powered website The Wellbeing Project does this:
Every ecommerce website requires a Privacy Policy, including your WooCommerce-powered store.
At a minimum, your Privacy Policy should provide details of:
Check the other legal requirements that might apply in your target markets.
Make sure you link your Privacy Policy:
Create Privacy Policy, Terms & Conditions and other legal agreements in a few minutes. Free to use, free to download.
This article is not a substitute for professional legal advice. This article does not create an attorney-client relationship, nor is it a solicitation to offer legal advice.
24 May 2022