Public offer and terms of sale for an online store: what to include

What a public offer or terms of sale for an online store usually contain, why the privacy policy and data consent are separate, and what differs in the EU, UK, US and the CIS.

Buyers rarely read your terms of sale, but they apply every time someone clicks “Pay”. They record when the contract is made, how long delivery takes, how to return an item and who's responsible for what. If they're copied from another store and don't match how you actually work, they can turn against you in a dispute with a customer.

What a public offer is

In Kazakhstan, Russia and much of the CIS, an online store's terms are usually called a public offer: a proposal to enter into a contract, addressed to anyone who accepts its terms. The buyer accepts by acting, by placing an order or paying, and the contract is made without signatures on paper. Elsewhere the same document is called terms of sale or terms and conditions, and the mechanics can differ: in some countries a product listing isn't legally an offer, and stores state that the contract is formed when they confirm or dispatch the order. Either way, the terms must say clearly what is sold, at what price, on what conditions and when the contract is made. If you sell only through a marketplace such as Amazon or Kaspi, the platform's rules govern much of the relationship with the buyer; your own terms are for your website and for sales through social media and messengers.

What terms of sale usually contain

• Definitions and general provisions: who the seller is, what counts as an order, where the terms are published.
• Subject: the sale of goods shown on the website.
• Placing an order and when the contract is made: what exactly counts as acceptance.
• Prices and payment: currency, payment methods, when the price is fixed, what happens if a price is wrong.
• Delivery: methods, times, costs, areas, and when the goods count as handed over.
• Receiving the order: how to check it on delivery and what to do if something is wrong.
• Returns and exchanges: deadlines, conditions, how refunds work, which goods can't be returned by law.
• Warranty and complaints: where to write and how quickly the seller replies.
• Liability and force majeure.
• Personal data: a short reference to the privacy policy.
• Disputes and governing law.
• Validity and changes: the version date and how changes are announced.
• Seller details: full legal name, registration number and tax ID where applicable, address, phone, email.

Digital goods, pre-orders and made-to-order items usually get their own clauses: when access is granted, what counts as a completed order, whether the buyer can cancel.

Why the privacy policy and data consent are separate documents

The terms govern the purchase. A privacy policy answers other questions: what data the store collects, why, how long it keeps it, who it shares it with (the courier, the payment provider, the email service) and how a person can have it corrected or deleted. Every visitor should be able to see it, not just those who are paying.

Consent to data processing isn't a text but an action: a box the person ticks themselves. In many countries consent can't be buried inside the terms or the policy, and the box can't be pre-ticked. In the EU, fulfilling an order usually doesn't need consent at all, since the contract itself is the legal basis; consent is needed for things like marketing emails and non-essential cookies. Marketing consent almost always needs a box of its own, because it doesn't follow from the purchase.

EU, UK, US: the basics for an international store

• Consumer law sets the minimum everywhere. Your terms can give buyers more, but not less; clauses that leave them worse off than the law allows generally don't hold.
• In the EU and the UK, online buyers generally have 14 days to cancel a purchase, with exceptions such as goods made to the buyer's specification. Personal data falls under the GDPR, and the UK has its own version of it.
• In the US there is no general federal right to return an online purchase, so your own return policy does most of the work, alongside state laws.
• Language: some countries require consumer information in the local language. If you sell across borders, check each market you sell into.

CIS specifics: Kazakhstan and Russia

• Language. Kazakhstan has rules on using Kazakh and Russian in consumer information, so check with a lawyer whether your terms need both languages. In Russia, consumer information must be in Russian.
• Data localisation. Russia and Kazakhstan require citizens' personal data to be stored in databases located in the country. That affects your hosting, CRM and email service: check where your customers' data physically sits.
• Separate consent. Russian law explicitly requires consent to personal data processing to be a document separate from any other.
• Regulator notification. In Russia a personal data operator generally has to notify Roskomnadzor, the regulator, before processing starts.
• Seller details. The buyer must be able to see who the seller is: name, registration number (BIN or IIN in Kazakhstan, INN and OGRN in Russia), address and contacts for complaints.

Typical mistakes in an online store's terms

• Someone else's terms: another company's details, another city, couriers you don't use, sometimes another country's law. The copied text may also be protected by copyright.
• Delivery and return times in the terms don't match the website or what actually happens.
• “No returns” where the law gives buyers the right to return goods.
• Seller details are missing or out of date.
• Data consent is hidden inside the terms, or the box is ticked by default.
• The privacy policy lists the wrong services: the analytics, email and CRM tools have changed, the text hasn't.
• The terms have no date or version number, so nobody knows which conditions applied to a given order.

Checklist before you publish

• Walk through the buyer's journey and check every step against the terms: cart, payment, delivery, returns.
• Make sure links to the terms and the privacy policy appear in the cart and before payment.
• Data consent is a separate box that isn't pre-ticked; marketing consent is another one.
• Check your company details and the contact for complaints.
• Date each version and keep the old ones: a dispute may be about an order placed six months ago.
• Give the final text to a lawyer who knows the law of the country you sell in.

A template or a draft saves time, but a lawyer should still check the final version: laws change, and a mistake in your terms tends to surface at the worst moment, in a dispute with a customer.

How VIT TEAM does it

The VIT TEAM legal specialist knows the law of Kazakhstan, Russia, Uzbekistan, Kyrgyzstan, Belarus, the EU, the UK and the USA. It drafts and checks offers, privacy policies and contracts, flags risks and keeps a risk register in its personal notebook. You can give it your store's real delivery and return conditions and get a draft built on them, not on someone else's template. Important documents should then be signed off by a real lawyer.

A legal specialist shift costs $49 for 24 hours, a month $379. For product cards on Kaspi, Wildberries, Ozon and Amazon there's the marketplace manager at $39 a shift. You can try it free for 7 days.