Privacy policy

A privacy policy is a transparency document, not a contract the visitor agrees to. Under GDPR you must give people this information when you collect their data, and a privacy policy linked from every page and every form is the usual way to do it. It is separate from terms of service, which set the rules for using a site or buying from it.

It must describe what you actually do. A copied template that mentions tools you do not use, or misses ones you do, can create more problems than it solves. This page is general information, not legal advice.

How it works

Under GDPR the policy must cover, in clear and plain language: who you are and how to contact you, the categories of data you collect, the purposes for each and the lawful basis you rely on (and, where that is legitimate interests, what those interests are), who receives the data (including suppliers such as hosting, email and analytics), whether data is transferred outside the EU and under what safeguard, how long it is kept, and the rights people have, including withdrawing consent at any time and the right to complain to a data protection authority. If you have a data protection officer, their contact details go in too.

Writing it starts with an inventory: every form, tool and integration that touches personal data. A contact form, a newsletter signup, a booking system, analytics, embedded maps and video, chat widgets and payment providers each need a line explaining what they collect and why. The cookie information can live in the same document or in a linked cookie policy.

Other laws add their own requirements. Several US states, including California, have privacy laws with specific disclosure rules for businesses that meet their thresholds, and app stores require a privacy policy link for apps. If you serve customers in several regions, the policy may need sections for each.

Example

A landscaping company's site has a quote form, a newsletter and an embedded map. Its privacy policy names the company and its contact email; explains that quote requests are used to reply and prepare a quote, on the basis of steps taken before a contract; that newsletter emails are sent only with consent and anyone can unsubscribe; and that the map provider may receive the visitor's IP address when the map loads.

It lists the hosting company, the email provider and the newsletter tool as recipients, says quote requests that do not become jobs are deleted after a stated period, and explains how to request access or deletion. When the company later adds a live chat widget, it updates the policy the same week and changes the "last updated" date at the top.

Why it matters for your business

A clear, accurate policy is a legal requirement wherever GDPR or similar laws apply, and it is checked by regulators, by platforms such as app stores and ad networks, and by careful customers. It also forces a useful internal exercise: knowing what data you hold and why, which makes requests and breaches far easier to handle. The cost is a few hours to write and the discipline to keep it current. For complex processing, such as health data or large-scale marketing, have it reviewed by a professional. To check yours, read it next to your list of tools and forms: every one should be mentioned, and nothing should be mentioned that you do not use.

Common mistakes

• Copying another company's policy, so it describes tools and practices that are not yours.
• Never updating the policy after adding new forms, plug-ins or tracking tools.
• Leaving out the lawful basis and retention period, which GDPR specifically requires.
• Hiding the link where visitors cannot find it, instead of placing it in the footer and next to every form.

Questions people ask

Is a privacy policy legally required?

If you collect personal data from people in the EU or UK, including through a contact form or analytics, you must provide the information a privacy policy contains. Many other countries and US states have similar rules. In practice almost every business website needs one. This is general information, not legal advice.

Can I use a privacy policy generator or template?

A generator or template is a reasonable starting point for a simple site, but you must edit it to match exactly what you collect, which tools you use and how long you keep data. An inaccurate policy can mislead visitors and fail legal requirements.

How often should I update my privacy policy?

Whenever your data practices change: a new form, tool, supplier, purpose or retention period. Review it at least once a year even if nothing seems to have changed, and show the date of the last update at the top.