Category: e-commerce

SaaS Agreements – Website Legal Requirements

Does your website comply with the various legal requirements applicable to SaaS suppliers who opeate a UK website?

Below, I have set out the main legal requirements (including some optional recommendations) that apply to a SaaS supplier’s website.

Mandatory Requirements

SaaS suppliers must provide the following information in an easily accessible position on their website:

About Us/Contact Information

  • Legal name of the company i.e. XYZ Ltd;
  • Geographical address of the company;
  • Contact details i.e. telephone number and email address;
  • The country in which the company is registered and the company registration number;
  • Details of any supervisory body who regulates the company i.e. the FSA. For regulated bodies more detailed information is required;
  • If the SaaS supplier is registered for VAT and the VAT number;
  • Clear details of prices and whether or not delivery and/or tax is included (where online sales can be made);

Registration under the Data Protection Act

If a SaaS supplier collects any personal data in the operation of its business, including when visitors use its website such as, email address, name, telephone number or address of a living person, the SaaS supplier is collecting and processing personal data and must register as a data controller under the UK Data Protection Act. It is a criminal offence not to register.

Privacy Policy

If a SaaS supplier collects, stores or processes personal data as a data controller, they must set out how and why personal data is being collected and used in order to comply with the provisions of the UK Data Protection Act and the GDPR. The privacy policy must include:

  • Detailed information about the SaaS supplier;
  • The data being collected and processed; and
  • All mandatory information set out in applicable data protection laws that a data controller is required to provide to a data subject.

Cookie Banner and Cookie Notice

Before any cookie or similar technology used to track use of a website (such a web beacon, pixel etc.) can be placed on a user’s device explicit “opt in” consent must be obtained from the visitor. Consent is obtained via a cookie banner. If no consent is obtained from users no cookies other than essential cookies may be set.

The Privacy and Electronic Communications (Amendment) Regulations and the GDPR set out the obligations of website operators to provide users with information about cookies and any other similar technology that tracks the use of a website and the need to obtain a user’s prior consent to the use of cookies. Failure to comply with the rules can result in GDPR fines. SaaS suppliers must have a cookie banner on their website, they track use of the website and this should contain a direct link to the SaaS supplier’s cookie policy.

Trademarks and Logos

Do not use any third party’s trademarks or logos on your website without the third party’s consent or you could be liable to pay damages for trademark infringement. This includes displaying logos of your SaaS customers, where you do not have their specific consent to use their logos for this purpose.

Copyright

Do not use any third party’s content on your website without the third party’s consent or you could be liable to pay damages for copyright infringements. If you have links to any third party’s content, make sure that this is permitted by the third party’s terms of use and ensure that the information opens in a new frame.

Recommended Requirements

In addition to the above mandatory rules it is advisable for SaaS suppliers to have the following, in addition.

Terms of Use/Disclaimer

SaaS suppliers should set out the rules applicable to persons using and accessing the free goods and services available on their website. For example: state who may access the website i.e. businesses, persons over 18 years old. SaaS suppliers should also aim to limit their liability for information provided on their website. For example: state which law applies and limits on liability.

Copyright Notice

Protect your information on your website by inserting a copyright notice “© company name 2022.  All rights reserved.” Without this notice,  it may be difficult in some countries to take any action against a copyright infringement.

The above are examples of the main legal requirements for SaaS supplier websites. However, this is a very complicated area of law and the specific rules that apply to you will depend on what goods and services you are offering, whether you are acting BTB (business to business) or BTC (business to customer), where your SaaS business is physically located, where your customers are located and many other factors.

Help

If you would like to have your website reviewed for compliance with English law or have any queries about compliance please contact:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – FAQs – Cookies

What is a Cookie?

Cookies are small text files placed on a user’s hardware device, such as a computer, tablet or mobile phone which record online activity. The majority of websites use cookies to measure visits and the use of websites (analytics cookies). Cookies are often also used to save user names, passwords and user preferences to make repeated use of a website more comfortable for the user. However, increasingly cookies are being used to collect information about users for the purposes of targeted marketing, tracking and other non essential purposes.

Opt In Consent Required

It is unlawful to use cookies to collect user data without first obtaining consent. There is an exception when a cookie is strictly necessary for a service which a user has requested i.e. where a user places an item in an online shopping basket and there is the need to ensure that payment is for the goods actually purchased.

Compliance and Fines

The UK Information Commissioners Office (ICO) investigates and prosecutes companies for breaches of the Privacy and Electronic Communications (Amendment) Regulations and the GDPR. These two laws set out the obligations of website operators to provide users with information about cookies and any other similar techonlogy that track use of a website and the need to obtain obtain a user’s consent to the use of cookies. Failure to comply with the rules can result in GDPR fines.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Website Legal Requirements – for SaaS Suppliers

Below, I have set out the main legal requirements (including some optional recommendations) that you should comply with when operating your website in the UK. Even if you do not sell SaaS products or services online via your website, you will still need to comply with the following English laws when operating a website in the UK.

Mandatory Requirements

About Us/Contact Information

You must provide the following information in an easily accessible position on your website:

  • your legal name i.e. XYZ Ltd
  • your geographical address
  • contact details i.e. telephone number, fax number and email address
  • which country your business is registered in and the registration number
  • details of any supervisory body which regulates your business i.e. the FSA. For regulated bodies more detailed information is required.
  • where you are registered for VAT and your VAT number
  • clear details of prices and whether or not delivery and/or tax is included

Registration under the Data Protection Act

If you collect any personal data on your website – i.e. email address, name or address of a living individual, you will be processing personal data and must register as a data controller under the Data Protection Act (DPA). As a SaaS supplier the DPA will apply as soon as you require users to register in order to access your SaaS website or receive a newsletter or marketing information from you.

Privacy Policy

If you are collecting personal data it is a criminal offence not to register as a data controller under the Data Protection Act (DPA).

If you are collecting, storing or processing personal data you need to inform SaaS customers or website users how, what and why you are using their personal data in order to comply with the DPA. Even if you do not collect personal data on your website as a SaaS supplier you will be collecting and processing personal data on behalf of your SaaS customers.

Also, if you are sending marketing emails to potential SaaS customers you need to ensure that you have obtained specific consent, BEFORE such emails are sent. Consent should be covered in your privacy policy and the registration process on your website.

Cookie Policy

Cookies are small text files placed on a user’s computer which record online activity. Virtually all websites use cookies. Most use analytics cookies to measure visits and use of websites. Performance and functionality cookies are used to make repeated use of a website more comfortable for the user and advertising cookies are increasingly used to collect information about users for targeted marketing purposes.

You must provide users with clear and comprehensive information about the type of cookies being used on your website and the purposes for which the information is collected (subject to some exceptions). Users must give consent to the use of cookies. Consent can be obtained, by specifically making users aware of their acceptance of the terms of your cookie policy (or the relevant section of your privacy policy) by virtue of continuing to use your website.

Disabled Access to your Web Site

If you offer SaaS goods or services on your website you need to make your website accessible to disabled users. Level 1 compliance with the WC3 standard will usually suffice.

Trademarks and Logos

Do not use other people’s trademarks or logos without their consent on your website or you could be liable to pay damages for trademark infringements.

Copyright

Do not use other people’s content without their consent on your website, or you could be liable to pay damages for copyright infringements. If you have links to other people’s content, make sure that this is permitted in their terms of use and ensure that the information opens in a new frame.

Online Payment

If you accept online payment for your SaaS goods or services you must provide SaaS customers with specific information about their right to cancel, VAT and prices, refunds and defective goods PRIOR to the sale being concluded.

Recommended Requirements

In addition to the above mandatory rules it is advisable to include the following information on your website.

Terms of Use/Disclaimer

You should set out the rules applicable to visitors using and accessing SaaS goods and services on your website. For example, state who may access the website i.e. consumers, businesses, over 18s. You should also aim to limit your liability for information on your website. For example, state which law applies and your limits on liability. However, please note that you cannot exclude or limit certain liabilities in particular circumstances  – particularly in relation to consumers, injuries caused by goods and services, or defects in your goods and SaaS services.

Copyright Notice

Protect the information on your SaaS website by inserting a copyright notice “© company name 2013.  All rights reserved.” Without this notice, it may be difficult in some countries to take legal action against any copyright infringement.

Summary

The above are examples of the main legal requirements for UK websites. This is a very complicated area of law and the specific rules that apply to you will depend on what goods and SaaS services you are offering, whether you are acting BTB (business to business) or BTC (business to customer), where you are based, where your customers are located and many other factors.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

Website Legal Requirements – Tweeting – 5 Legal Offences to Avoid

There have recently been a number of high profile cases on liability for the sending of inappropriate tweets in the UK and the USA.

As tweeting becomes more and more the norm for many businesses it is important to consider the legal consequences of staff sending inappropriate tweets. Before allowing, permitting or encouraging staff to start tweeting on your behalf or with your brand you should consider creating a tweeting policy. This should set out guidelines on what is, and what is not permitted. It should also state whether any approval needs to be obtained before tweets are sent. Staff should be made aware of this policy and agree to comply with it.

Below is a brief summary of 5 possible offences that you should specifically cover in your tweeting policy.

Misrepresentation

Tweets containing false information that might induce another person to act on it.

Harassment

Tweeting words that cause ‘alarm’ or ‘distress’.

Malicious Tweets

Being “reckless” with the truth or sending false information in tweets for the purpose of damaging another’s commercial interests.

Defamatory Comments

Tweeting information that damages a person’s reputation unless you can prove that the information is a truthful, honest opinion.

Menacing Tweets

Tweeting content that is grossly offensive, indecent, obscene or menacing.

Penalties for Tweeting Offences

If a court in the UK finds you liable for any of the above offences you could be:

  • fined;
  • imprisoned for up to 2 years;
  • liable to pay damages for losses suffered;
  • liable to pay compensation for causing distress;
  • sued for libel and face an order for damages and costs.

It is therefore important that you consider whether there is a business need to protect yourself and your business from such potential “tweeting” claims.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

Website Legal Requirements – Privacy Policy – Basics for your Website

If you are operating a website and require users to register in order to use your website or you are simply using Google analytics on your website then you are collecting and processing personal data. Under the Data Protection Act 1998, if you collect, store or process personal data you must provide specific information to the persons whose personal data you are using. This information is usually provided to users in a privacy policy which should be published on your website.

The following basic issues should be covered in your privacy policy.

Personal Data Practices

Your privacy statement should reflect your personal data practices. For example, it should include details of:

  • The type of data being collected;
  • Why the data is collected;
  • How the data is used and why;
  • If and why personal data will be disclosed to third parties;
  • How and where data is stored;
  • How complaints or queries about personal data will be dealt with.

Cookies

Cookies are small text files placed on a user’s computer which record online activity. Virtually all websites use cookies. Most use analytics cookies to measure visits and use of websites. Performance and functionality cookies are used to make repeated use of a website more comfortable for the user and advertising cookies are increasingly used to collect information about users for targeted marketing.

In your privacy policy you must provide users with clear and comprehensive information about the type of cookies being used on your website and the purposes for which the information is collected.

Where should the Privacy Policy Appear on my Website

The privacy policy should be easy to find on your home page and/or at the point where you obtain consent to the collection of the personal data i.e. where a user registers on your website. It is advisable to have links between the privacy policy and all references made to it on your website. For example, if you are providing online recruitment services you should place your privacy policy on your home page and also have a link to it when users register to use your website or services. In addition you should have a process for the user to confirm acceptance of your privacy policy i.e. by actively clicking an acceptance box or a double opt-in email process.

Compliance with other Laws

You will need to consider your compliance with any other applicable laws or rules, which will apply in relation to the collection of a user’s personal data. Which other laws apply will depend upon a number of factors. For example if you are selling or providing services to children (persons under the age of 18) you must have additional safeguards in place on your website. For example, you will need to obtain parental consent before you collect any personal data for children of certain ages. Or if you are providing services to children which include advertising or marketing you will need to comply with the CAP Code.

The type of products or services that you are offering online and the countries in which you are making these available will also be relevant – as this will determine whether national, EU and/or international laws will also apply to your website. Depending on the business sector in which you operate, the rules of self-regulatory schemes may also apply. For example, if you are providing email marketing services to users you will need to comply with applicable email marketing and advertising rules.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

Website Legal Requirements – Providing Mandatory Information to Consumers

Website operators who sell products or services to consumers online must comply with the provisions of the Consumer Protection (Distance Selling) Regulations 2000. These require you to provide consumers with specific information in a durable medium before the products or services are delivered.

Pre-Contract Information

The following minimum information must be provided to customers before online sales are concluded:

  • the name and full address of the supplier;
  • exactly what is being bought;
  • the price (including any additional charges or costs, such as taxes and delivery costs).

The above information must be provided in a way which allows the customer to store, access and reproduce the information for as long as may be necessary in connection with the online sale.

Cancellation Rights

You must inform customers of their right to withdraw from the contract within the cooling-off period (14 days), otherwise the customer’s right to withdraw will automatically extend to 12 months.

What is a Durable Medium

“durable medium” is not defined in the Distance Selling Directive on which the UK law is based. The Office of Fair Trading states in its guidance that a website is not a “durable medium” because it can be changed at any time after it has been accessed by a consumer.

This view seems to have been confirmed by the recent European Court of Justice (ECJ) case below.

Content Services Ltd v Bundesarbeitskammer

The ECJ ruled in this case that sending a consumer a link to terms and conditions on a website does not constitute providing information in a “durable medium” because:

  • the consumer must receive the relevant information without having to take any positive action i.e. clicking on a link; and
  • a website is not a “durable medium” as it does not allow a consumer to store information which has been addressed to  him personally; the content can be changed;and it does not allow the consumer to reproduce the information unchanged.

How to Provide Information Correctly

In light of the above ruling if you enter into distance contracts with consumers which are subject to the Distance Selling Regulations, make sure that you do not rely on a link to a web page to provide customers with the required information.

Instead you should provide the required information:

  • via  email before the products or services are delivered; or
  • send the consumer a hard copy of the information by fax or in a posted delivery note.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Terms and Conditions – Email Marketing Rules

There are a number of guidelines and laws that have to be complied with when sending marketing emails and text messages in the UK. If you are a SaaS supplier who provides email marketing services as part of your SaaS services to customers you should ensure that your SaaS customers comply with the following rules and Regulations. Also do not forget that you may need to comply with the rules yourself when carrying out your own email marketing campaigns.

Privacy and Electronic Communications Regulations 2003

The Regulations apply to marketing by email, text message, telephone or fax sent to individuals. The rules apply to promotions appearing on your own website, through a SaaS partner’s website, in a third party e-newsletter, or as part of an advertising or email campaign.

Important note: The rules do not apply to emails sent to organisations, although you must still comply with the disclosure provisions referred to below.

Consent

The general rule is that you cannot send email marketing unless you have obtained prior consent from the person concerned. However, there is an exception if you send marketing emails to existing customers for similar products and services, provided that:

  • the individual was given a simple opportunity to opt out from receiving marketing  emails when their details were collected; or
  • the individual is given a simple way to “opt out” in future emails i.e. via an unsubscribe option.

Disclosure

When sending an electronic marketing message, you must tell the recipient who you are and you must provide a valid contact address.

CAP Code Advertising Rules

The CAP Code which sets out the rules administered by the Advertising Standards Authority (ASA) has now been amended to include the same rules as above in relation to marketing emails and test messages. Note that the Code also covers on-line banner ads, pop-ups and moving image posters. Although the CAP Code lacks the force of legislation it should be followed by all businesses to avoid sanctions being imposed, for example, adverse media coverage or denial of advertising space.

Terms to Include in your SaaS Agreement

If you are a SaaS supplier providing email marketing services to SaaS customers you need to ensure that the customer will be liable for any breaches of the above rules. You should include the following terms in your SaaS agreement:

  • A warranty that the customer will comply with the above rules when sending marketing emails; and
  • An indemnity from the customer against all claims made by third parties relating to breaches of the above rules.

Additionally you should exclude all liability for any breaches of email marketing rules and the content of any such emails.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Terms and Conditions – Online Sales

SaaS Agreements – Online Sales – Terms and Conditions

Many SaaS suppliers now conclude sales of SaaS products with customers online, usually by having customers “click” acceptance of terms and conditions published on their website. SaaS suppliers need to ensure that their online terms and conditions include the following information, in order to create a legally enforceable SaaS agreement with the customer.

E-Commerce Regulations

These Regulations apply to all SaaS suppliers who sell or advertise SaaS services online. The Regulations apply BTB (business to business) and BTC (business to customer).

The SaaS supplier must provide the following information on its website:

  • legal name i.e. XYZ Ltd. If this is different from your trading name any differences should be explained;
  • geographical address,  which must be the registered office if you are a company;
  • which country your business is registered in;
  • the registration number of your company;
  • details of any supervisory body which regulates your business i.e. the FSA;
  • VAT number and where you are registered for VAT;
  • clear details of prices and whether or not delivery and/or tax is included.

It is advisable to include all of the above information (as applicable) in your online terms and conditions.

Incorporation of Terms

In order for a SaaS customer to be legally bound by your online terms and conditions, the content of the terms and conditions must be drawn to the customer’s attention before the SaaS products are purchased.

Customers should be required to:

  • “click” acceptance to your terms and conditions; or
  • read, or scroll through the terms and conditions;

before purchasing the SaaS products.

Changes to Terms and Conditions

If you want customers to be legally bound by future changes to your online terms and conditions, you must state this in your online terms and conditions. You should also make the terms and conditions available on your website at all times, so that they can be stored or reproduced by customers.

Customer Cancellation Rights

If you are selling SaaS products to consumers the provisions of the Distance Selling Regulations 2000 (as amended in 2005) will apply and from Autumn 2013 the new EU Consumer Rights Directive will also apply. These contain provisions about mandatory “cooling off” periods and customer cancellation rights, with limited exceptions. However, if you only sell SaaS products BTB, these rules do not apply.

Other Laws

In addition to the E-Commerce Regulations, depending on whether or not you supply SaaS products BTB or BTC, other laws such as the Unfair Contract Terms Act 1977, the Unfair Terms in Consumer Contracts Regulations 1999 and the Supply of Goods and Services Act 1982 will apply to your online terms and conditions.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

Website Legal Requirements – Online Sales – New Consumer Rights

If you supply goods and services to consumers via the Internet you will need to change your terms and conditions of sale to incorporate the new EU Consumer Rights Directive before the end of 2013. The new directive harmonises consumer rights protection across the EU for all BTC (business to customer) online sales of goods and services. The directive must be implemented into UK law before the end of 2013 (probably in a Consumer Bill of Rights) which will result in the following compulsory rules applying to online sales.

Cooling-off Period

Customers will have 14 days (instead of the current 7 days) to cancel an online contract for no reason, free of charge. The 14 days will start on receipt of goods (where goods, or goods and services, are purchased) and on the date of the contract (where services are purchased). There is an exception for digital content – where the sale is deemed to be concluded from the moment that downloading begins, provided that:

  • you have obtained the customer’s prior express consent; and
  • the customer has acknowledged that there is no right to cancel.

Suppliers must inform customers of their right to withdraw from the contract within the cooling-off period, otherwise the customer’s right to withdraw will automatically extend to 12 months.

If a contract is cancelled during the cooling-off period, provided that the goods are returned within 14 days of the customer giving notice of cancellation, the supplier must refund:

  • the price within 14 days of the cancellation date; and
  • the postage costs for returning the goods, unless the supplier clearly informed the customer prior to the contract being concluded, that these costs would not be refunded.

Pre-Contract Information

The following minimum information must be provided to customers before online sales are concluded.

  • the name and full address of the supplier;
  • exactly what is being bought;
  • the price (including any additional charges or costs, such as taxes and delivery costs);

The above information must be provided in a way which allows the customer to store, access and reproduce the information for as long as may be necessary in connection with the online sale.

Also note that before the online sale is concluded the total price, including all charges should be made clear. The use of ‘pre-ticked boxes’ to conceal hidden charges will no longer be acceptable.

Delivery Date

Goods must be delivered without undue delay and in any case no later than 30 days from the conclusion of the contract.

Surcharges and ‘Hotlines’

Suppliers must not charge customers more for specific payment methods than they pay themselves i.e. fees for using a credit or charge card. In addition customer service telephone numbers must be charged at a basic NOT premium rate.

What to do Next

In preparation for the changes, you should review your current terms and conditions and customer policies now to adapt them to comply with the new rules.  Customers are more aware of their online rights and increasingly make complaints. Also, national regulators will also be keen to enforce the new rules and make public examples of non-compliant companies.

Help

Irene Bodle is an IT lawyer specialising in Internet Law and SaaS Agreements with over 15 years experience in the IT sector. If you require assistance with any Internet Law, SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Jurisdiction – Information made Available on the Internet

The Court of Appeal has asked the European Court of Justice (ECJ) to determine where publication takes place when information is made available via the internet in relation to a claim for breach of database rights in the UK.

Current UK Rules

Currently the infringement takes place in the country where the hosting server is based (SaaS provider hosting centre), rather than in the country where the information is actually read or used (downloaded). However, the Court of Appeal has asked the ECJ to clarify the position, to confirm whether infringement takes place in the hosting country or the country where the information is downloaded, or both.

Football Dataco v Sportradar

This issue arose when Football Dataco Ltd created statistics on behalf of the English and Scottish football league and claimed that Sportradar GmbH (a German company with a Swiss parent company, and with servers outside of the UK) had breached its database rights by making the information available to users in the UK.

The High Court used laws covering satellite television to determine that the country from which the information was sent i.e. where the servers were based was the place where the infringement occurred. However it has asked the ECJ to clarify the position.

Implications of the ECJ Decision

It will be important for all SaaS providers to closely monitor the ECJ decision in due course, as hosting servers are not always based in the same country as the users accessing the information and the decision could have wider implications for copyright infringement claims in relation to SaaS Agreements.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: