Privacy and Quebec Law 25

Overview

These privacy settings are part of every plan.

Quebec's privacy law, often called Law 25, applies to businesses that collect personal information about people in Quebec. Settings → Legal gathers what BestWebby does for it in one place:

• the person in charge of personal information, published on your store's privacy policy;
• the cookie choices your shoppers made, counted per purpose;
• a checklist of what BestWebby does for you and what stays with you.

This page and that checklist are a guide, not legal advice. Following them does not by itself make a store compliant.

Name the person in charge of personal information

Law 25 asks every business to name a person in charge of protecting personal information, and to publish their title and contact details on its website. By default that is the head of the business, and they can delegate the role in writing.

1. Open Settings → Legal.
2. Enter the person's full name. If it is you, click Use the store owner's name to fill it in.
3. Enter an email address this person reads. It is never filled in for you: the address is published exactly as you type it.
4. Tick the box to confirm that this person agreed to be named and that the name and email may be published, then click Publish.

Only the account owner can change it. Stop publishing removes it from your store.

What shoppers see. Your store's privacy policy, under Who is responsible, says: The person in charge of the protection of personal information is followed by the name, with the email as a link. If you wrote your own privacy page in the Pages builder, the same notice is shown at the end of it. Until you name someone, the policy points shoppers to your contact page.

Cookie consent, one purpose at a time

Your storefront asks shoppers before it measures anything or loads any ad pixel, and it asks about each purpose separately:

• Analytics: counting visits and purchases (store statistics, and Google Analytics if you set it up). A page A/B test counts as analytics too: only a shopper who allowed it gets the bw_xv cookie (90 days) that keeps them on one version, and a shopper who refuses sees your published page and is not counted.
• Marketing: ad pixels such as Meta and TikTok, and partner links. This choice appears only when your store runs one of them.

Shoppers can accept all, refuse everything optional in one click, or choose each purpose in Preferences. Nothing optional runs before they choose, and they can change their mind from the Cookie preferences link at the bottom of every page.

Each choice is kept in the shopper's browser and recorded for your store, without their IP address or name. Settings → Legal shows how many choices were recorded in the last 30 days, and how many allowed or refused each purpose.

How long the records are kept. A record is there to show what a shopper was asked and what they answered, so it is kept while that choice is in effect and for three years after it stops being in effect. A choice stops being in effect when the shopper makes a new one in the same browser (including withdrawing it), or when 12 months pass and the banner asks again. Three years later BestWebby deletes the record; the check runs once a day. Three years is the general time limit for bringing a civil claim in Quebec, so the record lasts as long as a complaint about that choice could still need answering. If your store's account is deleted, its records go with it.

If you switched the banner off in Settings → Tracking, shoppers are not asked, and Settings → Legal says so.

Requests from shoppers

• A copy of their data. Shoppers with an account can click Download my data in My account on your store. For anyone else, such as someone who only wrote to you on WhatsApp, texted or called, open them in Customers and click Download their data (owners, admins and managers can). Both give the same file: their profile, orders, reviews, appointments, offers, wishlist and consent records, and their conversations in every channel of the Inbox, found exactly the way erasure finds them: WhatsApp chats on either kind of number, emails, contact-form messages, text messages, call assistant transcripts and summaries, storefront chats they left their email on, and their WhatsApp, text message and email opt-in and opt-out records. Internal notes are left out, and other people's email addresses and phone numbers inside a message are replaced. A voicemail is listed but the audio is not in the file; your copy links to each recording so you can send it on. Each list holds the newest 1,000 entries (5,000 messages), and the file says when one was cut. Every download you make is in the audit log. The shopper's own download also includes the cookie choices recorded for the browser they download it from: a choice record is linked to nothing but that browser.
• Deletion. Shoppers with an account can ask for their account and data to be deleted from My account. The request reaches you as a notification. You erase the customer from their page in Customers with Erase (GDPR): the button names the European law, but it erases the same data whichever law the request is made under. Records the law requires you to keep, such as invoices, are kept with the personal details removed. The cookie choices recorded for the browser the request is made from are deleted as soon as the shopper asks, since nothing else links those records to them.
• Their conversations go too. Erasing a customer removes what they wrote to you and what you wrote back in every channel of the Inbox, found by their customer record, their email address and their phone number in any format: WhatsApp chats on either kind of number, emails, contact-form messages, text messages, call assistant transcripts and voicemail recordings, and storefront chats they left their email on. Conversations stay counted in your reports with nothing left to say who they were with. The deletion request itself stays in the Inbox as the record that it was asked for and carried out, without their name or address. A storefront chat where the shopper never gave an email cannot be linked to them, so it stays.
• Do-not-contact records are kept. If the person texted STOP, unsubscribed from email, is on the national do-not-call list copy, or sent STOP on WhatsApp, that record survives erasure, so a later import or a number typed in again cannot message them. Only what is needed to honour it is kept: the phone number or email address, and when they opted out.
• Anything else, such as a correction, comes to the person you named or to your contact page. Law 25 gives you 30 days to answer.

Your register of confidentiality incidents

Law 25 asks you to keep a register of every confidentiality incident: personal information accessed, used or disclosed without authorization, or lost, including incidents with no risk of harm. Canada's federal privacy law, PIPEDA, asks for a record of every breach of security safeguards too. Settings → Privacy incidents is where you keep it. Owners and admins can open it.

1. Click Record an incident. Give it a title, describe what happened, and choose the kind of incident and where it happened.
2. Tick the kinds of personal information involved, or say why they are not known yet, and enter how many people are affected and how many of them are in Quebec. Write what happened and how many people, never who they are: the text boxes refuse email addresses and phone numbers. A reference such as an order number is fine.
3. Enter when it happened, when you became aware of it, and when you determined it happened (the day you became aware unless you change it).
4. Write what you did to reduce the risk of harm and to stop it happening again. The contact for the incident is filled in from the person in charge you named in Settings → Legal; change it if someone else handles this one.
5. Under Risk assessment, tick the laws that apply, rate how sensitive the information is and how likely it is to be misused, tick the possible harms, and write the reasons for your assessment. Answer whether there is a risk of serious injury (Quebec) or a real risk of significant harm (PIPEDA).
6. Under Notices, record the date of each notice once you have sent it: to the Commission d'accès à l'information (shown once Quebec is ticked and saved), to the Office of the Privacy Commissioner of Canada (shown once Federal is ticked and saved), to the people affected, a public notice and why it was used, other organisations you told, or that notice to the people affected is held off because it could hamper an investigation.
7. Click Close incident when it is dealt with. It cannot be closed until the reasons for your assessment are written down and, when you answered yes to a risk question, the notices it calls for are recorded. A notice sent later can still be recorded on a closed incident.

BestWebby does not notify anyone for you. It does not report to the Commission or the Privacy Commissioner, and it does not contact the people affected. The register keeps the record of what you did. It is a record-keeping tool, not legal advice, and keeping it does not by itself make your store compliant.

Nothing is deleted. A record made in error is voided with a reason (with a code from your authenticator app if you use two-factor authentication) and stays in the list and in the download. Download CSV gives the whole register, void records included, oldest first. Each record shows how long you must keep it: five years after you became aware of the incident, or 24 months after you determined it happened if that ends later. Erasing a customer does not change the register, because it holds no customer's details. If you delete your account, or it is due to be deleted for non-payment, the confirmation and the warning emails say how many records you must still keep and until when, so you can download the register first.

What BestWebby does, and what stays with you

For a question about how BestWebby handles your store's data, write to privacy@bestwebby.com.