Beyond a showcase site, it brings together a catalogue, a cart, online payment, tax and shipping calculation, customer accounts and an order management back office. In Québec, an online sale to a consumer is a distance contract under the Consumer Protection Act (s. 54.1), which directly affects what the site must display.
Short answer
You describe what you sell, to whom and with which tools: your request is reviewed by the Courtier TI team, then entrusted to the IT services company that will prepare your quote. The choice of platform, payment and integrations is set with you.
What an e-commerce project can cover
- Choosing the platform: hosted solution, open-source software or custom development
- The catalogue, product or service pages and search
- The cart, online payment and confirmation emails
- GST and QST setup, shipping methods and returns
- French and English versions, including the checkout
- The privacy policy and cookie management
- Connections to inventory, accounting or management software
- Hosting, security updates and training for your team
Hosted platform, open source or custom
A hosted platform such as Shopify handles hosting, updates and much of the security, in exchange for a subscription and limits on customization.
Open-source software such as WooCommerce on WordPress offers more flexibility, but you become responsible for updating the site, the theme and every plugin.
Custom development makes sense for a unique sales process, such as customer-specific pricing or complex product configuration. It calls for a solid maintenance plan from the start.
Payments: limit what touches card data
In its baseline controls for small and medium organizations, the Canadian Centre for Cyber Security recommends considering the Payment Card Industry Data Security Standard (PCI DSS). The PCI Security Standards Council explains that Self-Assessment Questionnaire A applies to merchants whose account data functions are completely outsourced to compliant third parties and who do not store, process or transmit that data in electronic form on their systems.
In practice, we recommend a payment form provided by a compliant processor, by redirect or embedded, so card numbers never pass through your servers. The Council also states that validation requirements are set by card brands, acquirers and other compliance enforcing entities: ask your payment processor which questionnaire applies to your site.
Website security
The Centre's baseline controls call for websites to address the OWASP Top 10 vulnerabilities and for organizations to understand the ASVS level they need to meet for each website. The OWASP Application Security Verification Standard provides a basis for testing a web application's technical security controls. The Centre suggests making ASVS a contractual requirement for outsourced websites.
For a store, add two-factor authentication on administrator accounts, tested backups and someone responsible for updates. See also our Cybersecurity page.
Québec-specific obligations
- French: section 52 of the Charter of the French language requires that, "regardless of the medium used", catalogues, brochures, folders, commercial directories, order forms and any other documents of the same nature available to the public be drawn up in French. Section 57 covers invoices, receipts, acquittances and other documents of the same nature. The Office québécois de la langue française states that consumers have the right to access a complete French version of a business's website.
- Information before the order: section 54.4 of the Consumer Protection Act lists what the merchant must disclose before the contract is entered into, including contact information, a detailed description of the goods or services, an itemized price list and charges, the total amount, the delivery method and the cancellation, return, exchange and refund conditions.
- Privacy policy: section 8.2 of Québec's private-sector privacy act requires publishing a confidentiality policy in clear and simple language on the website when personal information is collected through technological means.
- Tracking tools: if the site collects information with technology that allows a person to be identified, located or profiled, section 8.1 requires informing the person beforehand, including the means available to activate those functions.
- Privacy impact assessment: section 3.3 requires one for any project to acquire, develop or overhaul an information system involving personal information. A store that collects your customers' contact details generally fits that description.
How the project unfolds
- Scoping: products, customers, catalogue size, shipping methods and integrations
- Choosing the platform and the payment processor
- Mock-ups of the checkout journey, mobile first
- Bilingual content: product pages, policies, transactional emails
- Setting up taxes, shipping, returns and customer accounts
- Integrations with inventory or accounting
- Testing: test orders and refunds, in French and English, on several devices
- Launch, team training and the maintenance plan
Pitfalls to avoid
- Underestimating content: photos, descriptions and translations often take longer than development
- Confirmation emails, invoices or error messages left in English only
- Storing card numbers or receiving them by email
- Piling up plugins with nobody responsible for their updates
- Loading advertising or analytics tools before informing visitors
- Leaving the domain name, hosting or payment account in the provider's name rather than the business's
What to specify in your request
- What you sell, the approximate number of products and variants
- Target markets and site languages
- Your current platform, if any, and your payment processor
- Shipping, pickup and return methods
- Required integrations: inventory, accounting, shipping, point of sale
- Who will provide text and photos
- Your expectations for hosting, maintenance and support after launch
Frequently asked questions
Do we need to comply with PCI DSS if a processor handles payments?
Yes, but the scope can be reduced. According to the PCI Security Standards Council, Self-Assessment Questionnaire A is for merchants whose account data functions are completely outsourced to compliant third parties. The Council notes that validation requirements are set by card brands and acquirers: your payment processor can tell you which ones apply.
Does the website have to be in French?
The Charter of the French language requires catalogues, order forms and other documents of the same nature available to the public to be drawn up in French, regardless of the medium used (s. 52), as well as invoices, receipts and other documents of the same nature (s. 57). Other languages are allowed if the French version is available on terms at least as favourable. Plan for French throughout the checkout journey, including the cart, confirmation emails and invoices.
What information must be shown before the customer pays?
Section 54.4 of the Consumer Protection Act sets out the list, including your contact information, a detailed description of each good or service, an itemized list of prices and charges, the total, the delivery method and the return or refund conditions. This information must be presented prominently and in a comprehensible manner. Have your wording reviewed by a legal advisor if needed.
Does an online store require a privacy impact assessment?
Generally, yes. Section 3.3 covers any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information. The assessment is proportionate to the sensitivity of the information, and the person in charge of the protection of personal information must be consulted from the outset of the project.
Who looks after the site after launch?
That needs to be specified in the quote. A store needs security updates, backups, plugin monitoring and support during sales periods. Say in your request whether you want a maintenance contract or whether your team will handle it. Our guide How to prepare an IT quote request helps you describe it.