If your site has even a simple contact form asking for a name and phone number, you're collecting personal data. In Azerbaijan this area is governed by the Law "On Personal Data" (11 May 2010, No. 998-IIIQ). Small businesses need to know the basic rules too — both for legal reasons and for customers' trust.
What is personal data?
Any information that can identify a person directly or indirectly: name, surname, phone, email, address, ID card details, a photo and so on. On a website it's usually collected in:
- contact and enquiry forms;
- order and sign-up forms, and user accounts;
- newsletter subscriptions;
- online chat and WhatsApp conversations;
- analytics and advertising tools (through cookies).
The basic rules for a site owner
- Get consent. Every form that collects data should have a checkbox showing the user consents to their data being processed, with a link to the consent text. The box must not be pre-ticked.
- State the purpose openly. Explain why you're collecting the data (fulfilling an order, replying to an enquiry, notifications).
- Don't collect more than you need. If a name and phone are enough to reply to an enquiry, don't ask for a date of birth and address.
- Separate consent for marketing emails. Automatically using data given for an order to send marketing isn't right; give users the option to opt out at any time.
- Protect the data. HTTPS, strong passwords, restricted access rights and backups are part of your legal responsibility too (see 7 steps to keep your website secure).
- Respect users' rights. Users can ask for their data to be corrected or deleted — decide how and within what time you'll respond to such requests.
- Set a retention period. Once the purpose is fulfilled, delete or anonymise data you no longer need.
Third parties
If form data is passed to an email service, a CRM, an SMS provider or an analytics tool, that counts as processing too. In your privacy policy, mention in general terms which services data is passed to, and only use trustworthy services.
Which documents should be on the site?
At minimum, a Privacy policy and a Consent to personal data processing text. If you sell online, terms of use and return rules as well. You can look at our own documents as an example: Privacy policy and Consent to personal data processing.
A quick checklist
- Every form has a consent checkbox and a link to the document;
- The privacy policy can be opened from the site footer;
- Forms only ask for the fields you need;
- Newsletter sign-up has confirmation and one-click unsubscribe;
- In the admin panel, only the staff who need it can see the data.
This article is for general information only and is not legal advice. For specific questions about your business, we recommend consulting a lawyer.
