Terms of Use and Privacy Policy: What Every Business Needs on Its Website

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Terms of use and privacy policies are often treated as footer bureaucracy, copied from whatever competitor’s site is handy. For a digital business, though, these two documents work as the contract governing the relationship with each user, and they determine who is responsible when something goes wrong. Well drafted, they limit liability, support the processing of data, and set where any disputes will be resolved.

The Difference Between the Two Documents

Although they appear side by side in the footer, terms of use and a privacy policy serve different functions. The terms of use are the adhesion contract between the company and anyone who accesses the platform. They set out what users may and may not do, the payment conditions, the cancellation rules, and the consequences of a breach.

A privacy policy has a different purpose. It describes what personal data the company collects, why, how long it keeps the data, and with whom it shares it. It is not an adhesion contract. It is a transparency instrument required by Brazil’s General Data Protection Law. Confusing the two produces incomplete documents that leave dangerous gaps in both areas.

Businesses that offer apps, marketplaces, or subscription services need both texts, designed to work together. Each refers to the other, but each answers different questions from the user and from the regulator.

Legal Basis: The Heart of a Privacy Policy

The most neglected element of a privacy policy is identifying the legal basis for each data processing activity. Brazilian law does not allow a company to collect personal information just because it would be convenient. Every operation must rest on one of the legal grounds the law provides, such as consent, performance of a contract, compliance with a legal obligation, or legitimate interest.

This choice has practical effects. When processing rests on consent, the user can withdraw it at any time, and the company must stop using that data. When it rests on performance of a contract, the processing is justified for as long as the relationship lasts, with no separate authorization needed. Choosing the wrong basis exposes the business to sanctions and to deletion requests that can bring entire operations to a halt.

A mature policy does not treat data as a single block. It separates the purposes, assigns the correct legal basis to each one, and explains how data subjects can exercise their rights of access, correction, and deletion. That level of detail is what distinguishes a document that protects the company from a generic text that only pretends to comply with the law.

They set out what users may and may not do, the payment conditions, the cancellation rules, and the consequences of a breach.

Cookies and Tracking Require Their Own Treatment

Cookies and similar tracking technologies deserve a dedicated section. The simple statement “this site uses cookies” is not enough. Users need to know what categories exist, what each one does, and how to decline those that are not strictly necessary for the page to work.

Essential cookies, which support login and the shopping cart, do not require prior consent because the service cannot function without them. Audience analytics cookies and targeted advertising cookies, by contrast, depend on the user’s freely given choice before they are activated. Loading those scripts before the visitor has made a choice is one of the most common failures found in enforcement inspections.

A well-built cookie banner offers real options, not a single “accept” button. It records the user’s choice, allows later review, and connects to the privacy policy, which details each category. This engineering, invisible to a hurried user, is exactly what demonstrates good faith to a supervisory authority.

Limitation of Liability: How Far the Company Answers

In the terms of use, the limitation of liability clause defines the boundary of what the company guarantees. It clarifies, for example, that the platform is not liable for outages caused by third-party failures, for misuse by the user, or for content the user publishes. Without that carve-out, any incident becomes a pretext for full liability.

This clause has limits, and ignoring them makes it useless. In consumer relations, the supplier cannot disclaim liability for defects in the product or service, nor shift to the consumer risks that are inherent to the business. A clause that tries to exclude all liability whatsoever tends to be considered abusive and, therefore, void.

Effective drafting works within those limits. Instead of denying liability in absolute terms, it confines the exclusion to legitimate situations, describes the user’s duties, and provides for the conduct expected when a failure occurs. That way, the company preserves the clause and keeps a judge from striking it down entirely at the first challenge.

Venue and Dispute Resolution

The venue clause (cláusula de foro) states where any disputes will be heard. For the company, choosing the court where it has its headquarters reduces costs and concentrates litigation in a single, familiar place. That benefit, however, is not absolute and depends on the type of relationship the document governs.

In contracts between businesses, the choice of venue is usually respected, as long as it does not make it impossible for one of the parties to mount a defense. In consumer relations, by contrast, the protective rule prevails: it allows consumers to sue in the courts of their own domicile, even if the contract designates another. Choosing a distant venue may be treated as an abusive clause and set aside by the judge.

The terms may also provide for alternative means of resolution, such as mediation or arbitration, which are useful for higher-value business disputes. What matters is that the clause is clear, suited to the profile of the users, and consistent with the rest of the contract, avoiding contradictions that weaken the document as a whole.

Living Documents, Not Filed Away

Terms of use and a privacy policy are not texts you draft once and forget. If the business model changes, a new feature appears, or a different data analytics tool comes into use, each relevant change calls for a review of the documents. Keeping an outdated text is almost as risky as having no text at all.

Periodic review also keeps pace with how enforcement and court decisions on data protection and digital relations are evolving. What was tolerated a few years ago may now amount to an irregular practice. For that reason, these documents call for ongoing legal oversight, not a one-time effort at the platform’s launch.

Treated seriously, they stop being a formality and become a business asset. They reduce litigation, demonstrate compliance to the regulator, and give reassurance to users who decide to entrust their data and their money to the company. The cost of drafting them to fit your business is always lower than the cost of fixing a conflict that generic documents failed to prevent.

Frequently Asked Questions

Can I copy another website’s terms of use for my business?

It is not advisable. Every business has its own model, collects different data, and takes on specific risks. A copied text reflects another company’s reality and tends to leave gaps precisely where they matter most for your case, such as the legal basis for processing and the limits of liability. The document protects you only when it is tailored to your actual operation.

My company is small. Do I still need a privacy policy?

Yes. The obligation to protect personal data does not depend on the size of the company. It depends on whether you collect and process information about people. A small online store that registers customers is already processing data and needs an appropriate policy. Size affects how complex the document is, not whether you need one.

What happens if I have no defined legal basis for processing data?

Processing personal data without relying on one of the legal grounds is unlawful and exposes the company to administrative sanctions, as well as deletion requests and possible damages claims. The lack of a legal basis also weakens your defense in the event of a security incident, because it shows that the data was being collected without justification. Defining and documenting the basis for each processing activity is an essential step toward compliance.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.