I’m currently working on a FOSS Discord bot. When I host an official instance of said bot, do I need a TOS and or Privacy Policy, or is a link to the license (in my case GPLv3) enough?
I live in Germany, if that makes a difference.
IANAL, and a bit unsure about the following information, but I think you do need a privacy policy if you process someones elses data(like for example their login data, private messages, etc) You may also need an Impressum when hosting the official website for the bot(germany specific, maybe look it up if you actually need to do this)
I dont think you need a TOS.
I do not need an imprint, since I do not make any money from my bot. (Imprint is only required, if the website / service has a profit intensive. Atleast thats the case in Gemany). You are probably right about the privacy policy though.
Tyvm for your comment
That’s not the correct criterion. There are multiple German laws that require imprint-style disclosures.
Some of them are indeed specific to commercial activities.
But the Impressumspflicht typically means §5 TMG which requires an Impressum for
geschäftsmäßige, in der Regel gegen Entgelt angebotene Telemedien
Rough English translation:
Telemedia offered in a business-like manner, typically for remuneration
Critically, “geschäftsmäßig” does not mean “commercial” or “profit-oriented”. In particular, nonprofit organizations also act geschäftsmäßig.
IANAL, but it doesn’t sound like your service wouldn’t be geschäftsmäßig.
All of this is irrelevant anyway because you very likely have to publish a privacy notice per Art 13 or Art 14 GDPR. This must include the identity and contact details of the data controller (i.e., you). The German data protection authorities expect that the identity includes your real name and a ladungsfähige Anschrift (address where you can be served), so pretty much exactly what would be included in an Impressum anyway.
Thank you for your comment.
Tbh, I dont see why my service would be geschäftsmäßig. I don’t collect donations, I don’t offer any way to pay me and I do not offer any telemedia in a business-like manner. Though I could not find a good definition for geschäftsmäßig, so if you found one, please link me to it.
About the GDPR: God damn it. I completely forgot about that. Thanks for bringing it to my attention. Though it is probably possible to use a P.O. box in order to not leak my home address.
Definitely take this all with a grain of salt—I am by no means a legal expert, this is just my advice.
Privacy Policy
Required by law in Germany if you are collecting any sort of data about your users (even if it is being collected by a third party through your app, or if it is entirely anonymous data).
Data Processing Agreement
Required by law in Germany for the same reasons as the Privacy Policy. This agreement makes it clear how your users’ data is used.
Cookie Policy
Required by law in Germany if your application uses cookies of any kind (mostly applies to web app and web technologies)
Terms of Service
Highly recommended. This may protect you immensely if and when you end up in a legal situation down the road.
Other
Otherwise, you should look into these as well if applicable:
- EULA (if distributing your app to be run on someone else’s device)
- DCMA Policy (if you host and share any user-generated content)
- Return Policy (if you are selling anything)
These documents matter most if (1) there is money involved or (2) when you are receiving, processing, storing, or sharing user-submitted content or any data about your users. This is because you are less likely to end up in a legal mess if you’re not taking people’s money or data.
Starting out, you can find templates for these online. A template will be better than nothing at all. Then, if you are able down the road, you can hire a legal professional to write and review your documents for you. A legal professional might recommend more specific documents or different versions of the same document as well.
Not sure about Germany, but in the United States it’s fairly inexpensive to start an LLC. You can then put legal documents under that new entity instead of your own personal name. This can protect you and your own belongings from any unfortunate financial or legal situations.
Again, if you’re not receiving money or any user data, you don’t have to worry quite as much. However, it never hurts to play it safe. Mistakes happen and anyone can get sued.
