Privacy and Quebec Law 25

Overview

These privacy settings are part of every plan.

Quebec's privacy law, often called Law 25, applies to businesses that collect personal information about people in Quebec. Settings → Legal gathers what BestWebby does for it in one place:

• the person in charge of personal information, published on your store's privacy policy;
• the cookie choices your shoppers made, counted per purpose;
• a checklist of what BestWebby does for you and what stays with you.

This page and that checklist are a guide, not legal advice. Following them does not by itself make a store compliant.

Name the person in charge of personal information

Law 25 asks every business to name a person in charge of protecting personal information, and to publish their title and contact details on its website. By default that is the head of the business, and they can delegate the role in writing.

1. Open Settings → Legal.
2. Enter the person's full name. If it is you, click Use the store owner's name to fill it in.
3. Enter an email address this person reads. It is never filled in for you: the address is published exactly as you type it.
4. Tick the box to confirm that this person agreed to be named and that the name and email may be published, then click Publish.

Only the account owner can change it. Stop publishing removes it from your store.

What shoppers see. Your store's privacy policy, under Who is responsible, says: The person in charge of the protection of personal information is followed by the name, with the email as a link. If you wrote your own privacy page in the Pages builder, the same notice is shown at the end of it. Until you name someone, the policy points shoppers to your contact page.

Cookie consent, one purpose at a time

Your storefront asks shoppers before it measures anything or loads any ad pixel, and it asks about each purpose separately:

• Analytics: counting visits and purchases (store statistics, and Google Analytics if you set it up).
• Marketing: ad pixels such as Meta and TikTok, and partner links. This choice appears only when your store runs one of them.

Shoppers can accept all, refuse everything optional in one click, or choose each purpose in Preferences. Nothing optional runs before they choose, and they can change their mind from the Cookie preferences link at the bottom of every page.

Each choice is kept in the shopper's browser and recorded for your store, without their IP address or name. Settings → Legal shows how many choices were recorded in the last 30 days, and how many allowed or refused each purpose.

How long the records are kept. A record is there to show what a shopper was asked and what they answered, so it is kept while that choice is in effect and for three years after it stops being in effect. A choice stops being in effect when the shopper makes a new one in the same browser (including withdrawing it), or when 12 months pass and the banner asks again. Three years later BestWebby deletes the record; the check runs once a day. Three years is the general time limit for bringing a civil claim in Quebec, so the record lasts as long as a complaint about that choice could still need answering. If your store's account is deleted, its records go with it.

If you switched the banner off in Settings → Tracking, shoppers are not asked, and Settings → Legal says so.

Requests from shoppers

• A copy of their data. Shoppers with an account can click Download my data in My account on your store. For anyone else, such as someone who only wrote to you on WhatsApp, texted or called, open them in Customers and click Download their data (owners, admins and managers can). Both give the same file: their profile, orders, reviews, appointments, offers, wishlist and consent records, and their conversations in every channel of the Inbox, found exactly the way erasure finds them: WhatsApp chats on either kind of number, emails, contact-form messages, text messages, call assistant transcripts and summaries, storefront chats they left their email on, and their WhatsApp, text message and email opt-in and opt-out records. Internal notes are left out, and other people's email addresses and phone numbers inside a message are replaced. A voicemail is listed but the audio is not in the file; your copy links to each recording so you can send it on. Each list holds the newest 1,000 entries (5,000 messages), and the file says when one was cut. Every download you make is in the audit log. The shopper's own download also includes the cookie choices recorded for the browser they download it from: a choice record is linked to nothing but that browser.
• Deletion. Shoppers with an account can ask for their account and data to be deleted from My account. The request reaches you as a notification. You erase the customer from their page in Customers with Erase (GDPR): the button names the European law, but it erases the same data whichever law the request is made under. Records the law requires you to keep, such as invoices, are kept with the personal details removed. The cookie choices recorded for the browser the request is made from are deleted as soon as the shopper asks, since nothing else links those records to them.
• Their conversations go too. Erasing a customer removes what they wrote to you and what you wrote back in every channel of the Inbox, found by their customer record, their email address and their phone number in any format: WhatsApp chats on either kind of number, emails, contact-form messages, text messages, call assistant transcripts and voicemail recordings, and storefront chats they left their email on. Conversations stay counted in your reports with nothing left to say who they were with. The deletion request itself stays in the Inbox as the record that it was asked for and carried out, without their name or address. A storefront chat where the shopper never gave an email cannot be linked to them, so it stays.
• Do-not-contact records are kept. If the person texted STOP, unsubscribed from email, is on the national do-not-call list copy, or sent STOP on WhatsApp, that record survives erasure, so a later import or a number typed in again cannot message them. Only what is needed to honour it is kept: the phone number or email address, and when they opted out.
• Anything else, such as a correction, comes to the person you named or to your contact page. Law 25 gives you 30 days to answer.

What BestWebby does, and what stays with you

For a question about how BestWebby handles your store's data, write to privacy@bestwebby.com.