E-commerce website compliance: compliance status and upgrade plan

Situations relevant to e-commerce website compliance

• An online retailer opened its website without reviewing the pre-contractual information or the withdrawal rules.
• A brand is launching a digital sales channel in Morocco and in the European Union.
• A services platform processes personal data without a record of processing activities.
• A website places cookies without a prior review of the rules governing them.
• A company is preparing to put a mock-up online and wishes first to check its compliance.

Process

1. Purchase and onboarding. The client first acquires the Digital compliance and e-commerce website intake form (CV-05). ASKonsult then opens the secure exchange space.
2. Synchronous scoping. Session 1, a 60-minute videoconference, sets the territorial scope, Morocco or the EU. It also settles the pages and processing activities examined, as well as the go-live timetable.
3. Asynchronous collection. The client then completes the intake form, grants read access to the website and submits the existing notices and policies. Written questions flow in both directions.
4. Analysis and correction. The firm’s in-house engineering team then reviews the website point by point and annotates its corrections: pre-contractual information and withdrawal (Law No. 31-08), Law No. 09-08 and the GDPR. The review also covers cookies, payment, the domain name and the trademark.
5. Synchronous delivery. Finally, session 2, a 90-minute videoconference, presents the compliance report and the upgrade plan. It concludes with the handover of the validated deliverable.

Deliverable

The e-commerce website compliance deliverable first comprises a compliance report. This report ranks the discrepancies identified by order of criticality. A simplified record of processing activities then lists the website’s personal data processing operations. The upgrade plan, in addition, orders the corrections to be undertaken. Finally, the list of formalities to be completed rounds off the whole. ASKonsult hands over the deliverable at session 2, after a final review.

Prerequisites

The package first requires the completed Digital compliance and e-commerce website intake form (CV-05). Access to the website or its mock-up then enables the review of the pages. The list of technical and payment service providers is also among the expected items. Time frames run from receipt of a complete file.

Frequently asked questions

How is the package quote established?

The quote rests on a qualification exchange prior to subscription. This exchange covers in particular the number of user journeys, processing activities and territories covered, Morocco or the EU. The special conditions then set the scope, timetable, number of sessions, expected documents and deliverable. ASKonsult then creates the order from the accepted quote.

How are the sessions and asynchronous work distributed?

The package includes two videoconference sessions, 2 hours 30 minutes in total. Scoping lasts 60 minutes; delivery, 90 minutes. Between these two sessions, collection and review take place asynchronously, through the secure exchange space. Written questions flow there in both directions. In addition, the firm schedules the sessions in advance, in set time slots.

Which texts does the e-commerce website compliance review cover?

The review first examines pre-contractual information and withdrawal in light of Law No. 31-08. It then covers personal data, in light of Law No. 09-08 and the GDPR. Cookies, online payment, the domain name and the trademark finally complete the review. The territorial scope set at scoping then determines the applicable texts.

Does the package include technical corrections and declarations?

No. The package establishes the compliance status and the upgrade plan, without technical intervention on the website. Declarations to the National Commission for the Control of Personal Data Protection (CNDP) likewise remain the client’s responsibility. The list of formalities to be completed nevertheless guides the client in these steps. Finally, the client remains the sole decision-maker on the corrections undertaken.

Do the access rights and documents submitted remain confidential?

The firm treats as confidential the read access to the website and the notices and policies submitted. These items circulate solely through the secure exchange space and serve only the purposes of the service. This obligation also survives the end of the relationship. Reciprocally, the client undertakes the same discretion with regard to non-public tools and deliverables.

What follows the package?

The white paper “Digital compliance: e-commerce website, personal data, master plan” (LB-11) extends the reflection beyond the website. When the need for support becomes recurring, the Steering subscription (A-02) takes over. This tier is indeed intended for growing SMEs and mid-sized companies. The upgrade plan then serves as a basis for monitoring the corrections.

Out of scope

The package excludes the development or technical modification of the website. Nor does it include an IT security audit. Declarations to the CNDP on behalf of the client also remain outside the service. Contract drafting, finally, falls to an authorised professional, to whom ASKonsult refers the client when the matter so requires.