Privacy policy
If your website processes personal data, you must explain this. Even loading a page sends the visitor’s IP address to the server, which records it in its logs.
What must be included
- Who is responsible, including their address and contact details.
- Which data is processed and for what purpose.
- On what legal basis – consent, contract or legitimate interest.
- How long data is retained, or how the retention period is determined.
- Who receives the data, including transfers to third countries.
- Individuals’ rights: access, rectification, erasure, objection and complaint.
Why templates often do not fit
A privacy policy must describe what your website actually does. A template listing Google Analytics, a Facebook pixel and a newsletter you do not use is inaccurate. Equally, it must not omit services you actually use. Both are problems.
Accessibility
As with the legal notice, the privacy policy must be accessible from every page within two clicks and clearly labelled. Its link usually appears beside the legal notice in the footer.
Further in Legal & privacy
- Legal notice – Who needs a legal notice, what it must contain and the mistakes that can lead to legal demands.
- Google Fonts – Why loading fonts from Google’s servers can cost money and how to fix it in ten minutes.
- Embedding YouTube and Google Maps – Both can set cookies before anyone clicks. What this means and how the two-click approach works.