0

Context:

We provide a paid-for web-based software-as-a-service application. This application requires users to register an account, and agree to our terms & conditions and privacy policy to be able to do so. We are based in the UK.

Question:

We’re unsure whether a cookie we want to use can be classed as mandatory to perform our services. The cookie in question is used for partner resellers and is used on our web portal.

The cookie is able to track users who have been referred to the website by one of our partner resellers via a special URL. A piece of code on the website reads the URL and looks out for a special ID that identifies the reseller. Once this ID is found, it is stored in the cookie. When the user purchases our services, this ID (which was previously stored in the cookie), is sent through to our API to inform us that this user was referred by one of our partner resellers.

When we receive this ID through our API, we pass it into our payment processor, Stripe. This can then apply referral discounts and also help us in knowing who needs to be paid what commission. This information is all then visible to our partner resellers within our integrated third-party reseller portal.

This cookie is necessary for our third-party reseller integration to work, and necessary for any referral links to actually provide discounts to customers. However, the cookie is not necessary for users who have not been referred by our partner resellers.

Can this cookie be classed as necessary in order for the platform to function?

Further Research

After further research, I've found descriptions of compliance such as:

"Including a pop up may not provide the best user experience, so some companies have opted for including the cookie disclosure within their Terms and Conditions. This can be a very effective and non-intrusive method, but there are a couple of caveats.

First, users have to agree to the use of cookies, so if you include the information in your T&Cs, you need a way for users to approve your T&Cs. This is usually done as part of a sign-up or registration process. If your website does not require users to sign up, this option probably won't work for you.

Second, you cannot simply add the cookie language to your existing Terms and Conditions because you need to gain consent specifically for the use of cookies. This means, if you already have users who have agreed to your T&Cs, after adding the cookie language you will need to prompt them to review and agree to the new T&Cs." [https://www.privacypolicies.com/blog/eu-cookie-law/]

This would mean that acceptance of our privacy policy would also mean acceptance of non-necessary cookies. However, I also thought that you weren't allowed to block access to websites if a user doesn't agree to the use of non-necessary cookies. Is this different for web applications like Stripe/Zendesk/other web-apps, as I've never seen a cookie manager within any of these platforms.

Thanks for any insight you can give!

Improve this question
2
  • 1
    Could you clarify: are the cookies used for applying discount codes (strictly necessary to form and perform the contract with the user) or tracking traffic sources or resellers (totally not necessary). Also, the quoted guidance is bollocks: hiding stuff in the ToS fails to collect specific, informed consent. You generally can't make your services conditional on unrelated consent.
    – amon
    Commented Jan 17, 2020 at 14:51
  • The cookie is not required to purchase a license. If a user was to block this referral cookie then they would simply sign up to the platform as if they were never referred. The customer would then not receive a referral discount and the referrer would not receive any commission. The cookie isn't necessary to form a basic contract, but it is necessary to form a contract that the customer and reseller would be expecting (receiving discounts/commission). Thanks for the clarification on the ToS part!
    – Calco
    Commented Jan 17, 2020 at 16:14

1 Answer 1

Reset to default
1

You should not be asking users to "accept" your privacy policy - a very frequent error by the way - although you might ask someone to confirm that they have read it (This is different from accepting your terms and conditions). Providing a privacy notice is an obligation that rests with you as a data controller. Your notice must provide the user with the specific information detailed in GDPR Article 13.

Cookies are considered personal data if it is feasible for a link to be made between them and an individual data subject. If you are placing cookies on an individual's device, then you need to confirm a lawful basis for doing so. For most cookies this is "consent". Sometimes a cookie can be used without consent. For example, a cookie that is critical for security and control purposes. In these cases "legitimate interest" or "contract" may provide a lawful basis.

The cookies you are using should be described in your privacy notice (or a linked cookie notice) - and where they are non-essential, users should be given the option of accepting or rejecting them.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .