.png)
Update your policy pages
When is the last time you updated your privacy policy? 🤔
If the answer is when you first launched your store, then it's time for a review.
You need to have an up-to-date privacy policy page, terms and cookie policy (if applicable) so your customers have a clear understanding of how your store collects and handles data. Not only are these pages legally required, but they help communicate that your business cares about their customers and that they can trust shopping on your site.
5 quick tips for better policy pages:
What's working for LAC swim:
- A styled privacy policy page that matches the store design.
- Organized, accordion-style dropdowns which make it easy to read.
- Built-in data request button so that customers can make requests like marketing unsubscribes directly from the privacy policy.
You can get the privacy policy example above for your store! Other robust privacy features like a cookie consent banner and more for free with Enzuzo.
Review third-party apps & tools
If you are one of the 87% of Shopify merchants that use third-party apps or themes for your eCommerce store, you'll need to check their privacy practices.
Your customers' personal information is scattered throughout the many tools and apps you've integrated with your store, which is why it's important to vet these platforms in advance to protect your customers' privacy and minimize risk.
Shopify requires all third-party apps and themes to have a privacy policy, which you should review before installing to know what data they collect and to ensure they're compliant.
.png)
Review sales channels & payment gateways
If you use an affiliate service or additional sales channels like Google or Facebook, look into their privacy practices to ensure they're in compliance with applicable laws. This principle also applies to payment gateways like Shopify Pay and PayPal.
Some sales channels also have data collection and privacy requirements for you to use their services. For example, Google Shopping ads have specific expectations for their users' data collection and use.
Clearly communicate marketing consent
Marketing and communications tools can help you stay top of mind for your customers, but not at the cost of their privacy rights.
When your customers consent to your cookies or marketing communications, they should have a clear idea of what they’re agreeing to and give their consent freely.
Design your opt-in forms, pop-ups, cookie bar and other ways that you gather consent with:
Tips from our friends from 
Marketing consent is everything for a healthy, legally compliant marketing program. When it comes to email marketing, capturing consent sets the right expectations between brand and consumers.
This consent helps keep messages from being marked as spam, which ultimately impacts email deliverability for all subscribers. For SMS, it's a no-brainer. There may be no easier way to harm a customer relationship than by sending an unwanted SMS marketing message.
If you're not capturing consent, you're never going to have a fully optimized, sustainable, and increasingly profitable marketing program.
Greg Zakowicz | Omnisend
Give customers more control over their data
Be respectful
Once you have your customers' data, please treat it with the same respect you would like your own. Fast Company calls this practice "data etiquette."
Aka, don't spam your customers!
By collecting only the data your company needs and using it within the terms your customer agreed to, you can deliver a better customer experience, build trust, and stay compliant with upcoming data laws in advance.
Establish a data privacy workflow
A team that prioritizes customer privacy is proactive. Set your team up for success with a workflow to follow, so they know how to handle situations like privacy requests or policy changes by answering these questions:
List the personal information you collect
A list of all of the information you collect from your visitors and customers will provide you with an easy reference for compliance updates and customer data requests. Include the data collected through these channels:
Designate a “data privacy officer”
Agree on a team member who will become the dedicated person responsible for data privacy compliance for your store. This “data privacy officer” should:
Have a data breach response plan
When you experience a data breach, you need to act fast. An established data breach response plan will provide the guidance you need to reduce the impact of a data breach and maintain customer trust in the aftermath. Signifyd recommends including these steps in an eCommerce data breach action plan:
Create a data retention policy
Implement a policy that defines how long you should keep customer data in your system. Once that period ends, securely and permanently remove the data.
Data retention policies offer two advantages to eCommerce businesses. First of all, you won’t have to worry about your data monitoring needs increasing over time. Second, laws like the GDPR require you to keep data for no longer than you need it.
Stay up-to-date on privacy laws
You must stay updated on relevant privacy laws to maintain a business that complies with them.
Easier said than done, right? Actually, it doesn’t have to be. Forbes suggests taking these actions to stay on top of privacy regulations:
Review your websites and policies at least every year
As you stay educated on your region’s privacy laws, remember to compare them to your current privacy habits on at least a yearly basis. You should also keep an eye out for privacy updates to your third-party channels, such as plug-ins, payment gateways and sales channels.
Pro Tip: Add a Google Calendar Event for an Internal Privacy Audit to remind yourself or the team.
Give privacy updates to your customers
Whenever you change your privacy policies or practices, your customers should be some of the first people to know. After updating your store’s privacy, notify your customers through the channels they’ve opted into.
Software companies, like Figma in the below example, update their customers all the time when they make significant privacy or terms changes, so why not your brand?
