Privacy Policy

The GDPR requires you to tell people how you use their personal data at the moment you collect it. A privacy policy (or privacy notice) is how most websites do that. It must be concise, transparent, easy to find and written in clear and plain language (Article 12).

What it must contain (Article 13)

• Your identity and contact details, and those of your data protection officer if you have one.
• The purposes of each processing activity and the legal basis for each.
• The legitimate interests you rely on, when that is the legal basis.
• The recipients or categories of recipients, including your processors.
• Any transfer outside the EU and the safeguard used (adequacy decision, standard contractual clauses).
• How long you keep each kind of data, or the criteria used to decide.
• People's rights: access, rectification, erasure, restriction, objection, portability.
• The right to withdraw consent at any time, where processing is based on consent.
• The right to complain to a data protection authority.
• Whether providing the data is required, and what happens if they do not.
• Any automated decision-making or profiling, with meaningful information about the logic involved.

When you get data from someone else (a partner, a list, a public source), Article 14 adds the categories of data and where it came from.

Making it work in practice

1. Start from reality: list every form, tool and integration on the site before writing a word.
2. Layer it: a short summary at the top, with details below or one click away.
3. Link it everywhere data is collected: sign-up, checkout, contact and newsletter forms, and the footer.
4. Keep cookies consistent: the cookie information in the policy must match your banner.
5. Date it and update it when you add a tool, change a purpose or move data to a new country.

This guide is general information about EU rules, not legal advice. Requirements can differ by country and by business: check with your data protection authority or a lawyer for your case.