You may have heard about GDPR fines and wondered whether your business website is at risk. The short answer: a showcase website, with no online shop or customer accounts, has limited obligations. Limited does not mean none, though. Here is what actually applies, without the jargon.

What GDPR changes for a showcase website

GDPR (the General Data Protection Regulation) governs the collection of personal data: name, email address, phone number, IP address. A website that only displays your opening hours, your address and photos of your business collects nothing from its visitors. In that case, your GDPR obligations remain minimal.

Things change as soon as the site includes a contact form, a call button that triggers statistical tracking, or an audience analytics tool. From that point on, four points need to be addressed: legal notices, information about cookies, retention of the data submitted through the form, and the right of access for the people concerned.

Unlike GDPR, legal notices are a requirement for any professional website under French law, even a simple showcase page with no form. This obligation comes from French commercial law and applies regardless of whether you collect any data.

This information usually fits on a single page, accessible from the site's footer. It is not just a formality: it is the first thing checked in the event of a dispute or an inspection.

Cookies: what actually needs to be in place

A cookie is a small file stored on the visitor's browser. Some are essential to the site's operation (remembering a chosen language, securing a connection) and require no consent. Others, such as detailed audience measurement tools or advertising pixels, need the visitor's explicit consent before they are activated.

For a simple showcase website, without a full Google Analytics setup or an advertising pixel, there is often no cookie banner to display at all. If you add a third-party statistics tracking tool, you then need to offer a genuine choice: accept or refuse, with both options equally easy to select. A banner that only offers an Accept button does not meet the requirement.

How to check what is installed on your site

Ask the person or service that manages your website which third-party scripts are loaded. If the answer is none, apart from the security certificate, there is nothing more to do on this point.

The contact form and the retention period

If your site includes a form (quote request, appointment booking), the messages it collects contain personal data: name, email, sometimes phone number. Two simple rules apply. First, briefly inform the visitor how this data will be used (to respond to their request, nothing else) next to the form. Second, do not keep these messages indefinitely: a reasonable retention period, tied to handling the request and then a limited archiving stage, needs to be set.

Key point: there is no need for a complex legal text. A sentence such as Your details are used only to respond to your message and are kept for a maximum of 3 years is enough in the vast majority of cases for a local shop.

The right of access, rectification and deletion

Anyone whose data you hold (a customer who filled in your form, for example) can ask you what information you have about them, request a correction of inaccurate information, or ask for their data to be deleted. GDPR sets a one-month deadline for responding to this type of request.

For a small business, in practice this means: listing a contact email address in your legal notices or privacy page, and deleting a message or a contact from your inbox when the request is made. No complex tool is needed, since the volume of such requests remains very low for most local tradespeople and shops.

What SiteServi does, and what remains your responsibility

A SiteServi website is generated from your Google Business Profile listing: opening hours, address and phone number sync automatically, usually within a week of a change made to your listing. The HTTPS security certificate is included on both plans, Essentiel and Premium alike.

However, the content of your legal notices (your SIRET number, your legal status, your address) and the retention period stated for a contact form remain information that only you can provide, since it concerns your business directly. SiteServi does not collect advertising tracking data on the sites it hosts, which limits the cases where a cookie banner becomes necessary.

If you have a question about a specific situation (an association receiving donations, a tradesperson using an external booking system), a legal professional remains the right resource. The French government website service-public.fr also offers up-to-date practical guidance on these topics.

This article provides general pointers and does not constitute legal advice. For a specific situation, consult a professional or refer to official resources.