privacy policy: real practices, checklist, copying trap

web · 2026-10-13 · 6 min

a privacy policy is your site describing its REAL data practices in plain language — not a copied shield, not legal decor. regulators (ICO's right-to-be-informed guidance, EU equivalents) require: who you are, what you collect, why, who gets it, how long, and people's rights. the checklist, the placement, and the copying trap.

the required contents (small-site version)

identity + contact (business name, email, address — a policy without a reachable human is decoration). data collected (forms, analytics, cookies, embeds, logs — itemized, actual). purposes + lawful basis per item (contact replies, order fulfillment, marketing with consent — basis named, not implied). recipients (newsletter tool, host, analytics, payment processor — vendors named). retention (how long each category lives). rights + how to exercise them (access, erasure, objection — with the email/mechanism). cookies section (what, why, consent mechanics — or linked cookie notice). DPO/representative/transfers/automated-decisions where applicable (usually N/A for micro-sites — say so briefly).

placement and language

linked in the footer of every page AND at collection points (forms link it beside submit — awareness matters, not just availability). concise, plain, accurate (ICO: intelligible, easily accessible, transparent). updated when practices change (new analytics, new newsletter, new pixel — policy follows reality within days). versioned mentally (know what it said when — disputes reference dates).

the copying trap (don't)

a copied policy describes SOMEONE ELSE's vendors, purposes, and retention — fiction that fails the first complaint and doubles embarrassment (wrong contacts, phantom tools, unexercisable rights). generators are starting points requiring full customization; a policy is a description task (inventory → words), not a download task. pair it with real practices: GDPR in simple words and cookie banner.

FAQ

terms and conditions too?

separate document, separate job: privacy describes data handling (required); terms govern the relationship (refunds, liability, IP — wise for shops/services, not data law). don't merge them into mush.

italy/germany impressum?

some jurisdictions require publisher identity disclosures beyond privacy (german impressumspflicht; italian professional-register/company details where applicable). check YOUR obligations — identity transparency has more than one source.