What is intellectual property,and why your website needs a privacy policy

Intellectual property, or IP, is a general legal term for rights in creations of the human mind: intangible assets such as an invention, software, a design, a trade name or content. For a technology company, intellectual property is often its most important asset.

How do you protect intellectual property?

There are many ways to protect IP. First and foremost, by handling your legal relationships properly with everyone who works with the company, for example:

• Agreements with service providers.
• Agreements with suppliers.
• Agreements with developers.

And of course by using the legal protection that fits each asset best: registering a patent, a trademark or a design, one of them or several together.

What must a website have, legally?

Today every company or business has a website. From a legal point of view, two documents matter most:

1. Terms and conditions.
2. A privacy policy.

What is an EULA?

We all know the message that sometimes pops up when we install an app or open a website and asks us to accept the terms. In most cases that is an EULA.

EULA stands for End User License Agreement. It sets the business and legal terms between a company and its customers for the use of a licence: what customers may and may not do with the licence they have been given.

There is a wide range of such agreements, and the clauses are tailored to each company.

What is a privacy policy?

A privacy policy tells users what information is collected about them and what is done with it. A few principles:

• Every company has its own policy.
• The company should publish the policy, and every change to it, on its website or in its app.
• In Israel, the policy is written in line with the Privacy Protection Law, 5741-1981.

13 points to cover in a privacy policy

1. Who operates the website, its address and how to contact it.
2. What information the website collects about users, distinguishing between information users give knowingly (for example in an online form) and information collected while they browse (for example their IP address and the pages they view).
3. Whether the information identifies the user personally.
4. How the collected information will be stored.
5. Whether users are legally required to provide the information, or whether it is up to them.
6. What the information will be used for.
7. Whether the information will be passed to third parties and, if so, to whom and in what circumstances.
8. Whether the website uses tools that can track visitors, such as cookies or web beacons.
9. If it does: what those tools are, what they are used for, whether visitors can switch them off, and what happens if they do.
10. Whether the website lets third parties, such as advertisers or ad networks that place banners on the site, track its users. If so: by what means, for what purpose, what personal information is exposed, and how users can avoid it.
11. What steps the website takes to secure the information, and how much protection they offer visitors.
12. A notice of the user's right to review the information held about them, and to have it corrected or deleted, under the Privacy Protection Law.
13. Whether the privacy policy may be updated from time to time, when an update takes effect, and where and how it will be published.

What is the GDPR?

The GDPR, the General Data Protection Regulation, is a set of European Union rules that took effect on 25 May 2018.

1. Its aim is to strengthen the privacy of people whose details are held in databases. It does this in two ways: by setting legal rules on how data must be protected, and by fining those who break them.
2. It applies to almost anyone who holds data on EU residents and citizens, even if the data holder is not located in the EU and does not operate from there. In other words, Israeli companies that sell products or provide services to people or organisations in the EU are also subject to the GDPR and must comply with it.
3. Among other things, the GDPR requires consent to collect or share data about EU citizens. Consent must be freely given and active. For example, a checkbox such as "I agree to my details being included in a database" must not be ticked by default.
4. Withdrawing consent must be visible, easy, clear, understandable and simple.
5. In every case, consent must be documented in writing: who agreed, when, how, and what information they were shown before agreeing.

This article is general information, not legal advice. For advice on your situation, contact the office.