The key law is the Civil Code ( Burgerlijk Wetboek ), and more specifically Book 6 (Boek 6) regulating, among other things, distance selling.

Other legal acts of significant importance are:

1. Telecommunications Act ( Telecommunicatiewet ),
2. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

The Civil Code imposes not only a number of obligations but also prohibitions on the seller, in particular:

• informing the consumer about the data identifying the entrepreneur (including the name of the entrepreneur and the trade name, address details, contact details – e-mail address and telephone number, tax identification number) or the main features of the product, the total price of the product and the method of payment, the ordering process and the method of completing the purchase,
• informing the consumer about the right to withdraw from the contract within at least 14 days of receiving the goods without giving any reason (this period is extended to 12 months if the entrepreneur fails to comply with this obligation),
• informing the consumer about the claims he or she is entitled to in connection with the non-conformity of the goods with the contract (repair, replacement, reduction of the rating, withdrawal from the contract, whereby the seller is liable for as long as the product can be expected to function or be useful, but not less than 2 years . The consumer should inform the seller about the defect within a reasonable period – assumed to be 2 months),

However, the fact that the above-mentioned information is only available on your website is not sufficient. You must provide the consumer with this information, for example, by email or PDF file. Additionally, you are obligated to provide the consumer with a withdrawal form, which you can make available online on your website.

In addition, as a seller, you are obliged to:

• sending the order confirmation to the consumer immediately after concluding the contract, and
• prohibition of misleading consumers through unfair advertising,
• prohibition of using aggressive sales techniques.

Also remember to avoid geo-blocking. This means you must treat consumers from other EU countries the same as consumers from your home country. Therefore, if you're based in Poland and sell online in Poland and the Netherlands, you can't refuse to sell to a consumer living in another EU country, such as Belgium or Germany. This doesn't mean you have to provide delivery to that country. The consumer must arrange delivery, and you can't simply refuse to enter into a contract.

This law is important for marketing activities. It primarily regulates issues such as:

• consent via e-mail or SMS to marketing communications (e.g. sending newsletters),
• the obligation to obtain consent to cookies,
• personalization of advertisements.

However, the Telecommunications Act does not exhaustively address these issues. Compliance with the General Data Protection Regulation is also important.

The basic document required by personal data protection regulations is a privacy policy, which should contain at least the following information:

• Data controller details – i.e. information identifying the store owner, such as name and surname (or company name), registered office address and contact details.
• Purposes and method of data processing – explanation of what personal data will be collected, for what purpose and using what methods.
• Sharing data with third parties – information about possible data transfer, indication of recipients and the purpose of such sharing.
• User rights – a description of the rights of data subjects, such as the right to access, rectify, delete data or object to their processing.
• Cookies and tracking technologies – clearly defining what cookies are used, for what purposes, and how the user can manage consent.

However, it should be remembered that to comply with personal data protection regulations, simply posting a privacy policy with the above information on the seller's website is not sufficient. It is also necessary to take legally required organizational and technical measures.

Failure to comply with the above-mentioned provisions may result in negative consequences from the Dutch equivalent of the Personal Data Protection Office, the Autoriteit Persoonsgegevens (AP ), including the imposition of financial penalties.