Account & Billing
Privacy and Quebec Law 25
Name the person in charge of personal information and publish them on your privacy policy, see the cookie choices your shoppers made, and know which privacy duties BestWebby handles and which stay with you.
Overview
Quebec's privacy law, often called Law 25, applies to businesses that collect personal information about people in Quebec. Settings → Legal gathers what BestWebby does for it in one place:
- the person in charge of personal information, published on your store's privacy policy;
- the cookie choices your shoppers made, counted per purpose;
- a checklist of what BestWebby does for you and what stays with you.
This page and that checklist are a guide, not legal advice. Following them does not by itself make a store compliant.
Name the person in charge of personal information
Law 25 asks every business to name a person in charge of protecting personal information, and to publish their title and contact details on its website. By default that is the head of the business, and they can delegate the role in writing.
- Open Settings → Legal.
- Enter the person's full name. If it is you, click Use the store owner's name to fill it in.
- Enter an email address this person reads. It is never filled in for you: the address is published exactly as you type it.
- Tick the box to confirm that this person agreed to be named and that the name and email may be published, then click Publish.
Only the account owner can change it. Stop publishing removes it from your store.
What shoppers see. Your store's privacy policy, under Who is responsible, says: The person in charge of the protection of personal information is followed by the name, with the email as a link. If you wrote your own privacy page in the Pages builder, the same notice is shown at the end of it. Until you name someone, the policy points shoppers to your contact page.
Cookie consent, one purpose at a time
Your storefront asks shoppers before it measures anything or loads any ad pixel, and it asks about each purpose separately:
- Analytics: counting visits and purchases (store statistics, and Google Analytics if you set it up).
- Marketing: ad pixels such as Meta and TikTok, and partner links. This choice appears only when your store runs one of them.
Shoppers can accept all, refuse everything optional in one click, or choose each purpose in Preferences. Nothing optional runs before they choose, and they can change their mind from the Cookie preferences link at the bottom of every page.
Each choice is kept in the shopper's browser and recorded for your store, without their IP address or name. Settings → Legal shows how many choices were recorded in the last 30 days, and how many allowed or refused each purpose.
How long the records are kept. A record is there to show what a shopper was asked and what they answered, so it is kept while that choice is in effect and for three years after it stops being in effect. A choice stops being in effect when the shopper makes a new one in the same browser (including withdrawing it), or when 12 months pass and the banner asks again. Three years later BestWebby deletes the record; the check runs once a day. Three years is the general time limit for bringing a civil claim in Quebec, so the record lasts as long as a complaint about that choice could still need answering. If your store's account is deleted, its records go with it.
If you switched the banner off in Settings → Tracking, shoppers are not asked, and Settings → Legal says so.
Requests from shoppers
- A copy of their data. Shoppers with an account can click Download my data in My account on your store. The download includes the cookie choices recorded for the browser they download it from: a choice record is linked to nothing but that browser.
- Deletion. Shoppers with an account can ask for their account and data to be deleted from My account. The request reaches you as a notification. You erase the customer from their page in Customers with Erase (GDPR): the button names the European law, but it erases the same data whichever law the request is made under. Records the law requires you to keep, such as invoices, are kept with the personal details removed. The cookie choices recorded for the browser the request is made from are deleted as soon as the shopper asks, since nothing else links those records to them.
- Anything else, such as a correction, comes to the person you named or to your contact page. Law 25 gives you 30 days to answer.
What BestWebby does, and what stays with you
| BestWebby | You |
|---|---|
| Asks for consent to analytics and to marketing separately, records each choice, and deletes each record three years after the choice stops being in effect. | Name the person in charge and keep their contact current. |
| Lets shoppers download their data, and sends you their deletion requests. | Answer access, correction and deletion requests within 30 days. |
| Publishes the person in charge on your privacy policy. | Do a privacy impact assessment before a new system or project that handles personal information, and before sending it outside Quebec. |
| Tells you without undue delay if a security incident at BestWebby affects your store's data, as our data processing agreement sets out. | Keep a register of confidentiality incidents, and report serious ones to the Commission d'accès à l'information and to the people affected. |
| Publish your own rules for how your business handles personal information. |
For a question about how BestWebby handles your store's data, write to [email protected].