Under Construction
This Privacy Policy sets out how we, [insert name of your company or business e.g. ABC
Limited], obtain, store and use your personal information when you use or interact with our
website, [insert URL e.g. www.websitename.com] (our website), or where we otherwise obtain
or collect your personal information. This Privacy Policy is effective from [insert the date when
this privacy policy takes effect]1.
Please read this Privacy Policy carefully. We recommend that you print off a copy of this
Privacy Policy and any future versions in force from time to time for your records.
Contents2 • Summary
• Our details
• How we collect or obtain personal information about you
• Personal information we collect or obtain about you
• How we use your personal information
• How long we retain your personal information
• How we secure your personal information
• Our use of cookies and similar technologies
• Transfers of your personal information to other countries and safeguards used
• Your rights in relation to your personal information
• Your right to object to the processing of your personal information for certain purposes
• Consequences of not providing your personal information to us
• [Our use of automated decision-making, including profiling]3 • Changes to our Privacy Policy
• Changes to your information
• Children’s Privacy
• California Do Not Track Disclosures
• Copyright, credit and logo
1 You must insert the effective date of your privacy policy so your users know when your privacy policy takes effect. If you have
not previously uploaded a privacy policy to your website, or if you are replacing your existing privacy policy with this privacy
policy, the effective date will be the date when you first upload this privacy policy to your website.
2 When you upload this privacy policy to your website, you should ensure that the titles in this “Contents” section link to the
relevant headings in the main body of the privacy policy. For instance, the “Our details” title in this “Contents” section should link
to the “Our details” heading in the main body of the privacy policy.
3 Where you use automated decision-making or profiling, you must disclose this in your privacy policy. ‘Automated decisionmaking’ is where a decision is made by a machine without human involvement, such as where a machine decides whether or not
a person should be taken on as a client or whether to provide someone with credit. ‘Profiling’ is the use of personal information
to predict an individual’s behaviour, such as their performance at work, economic situation, health, personal preferences,
interests, reliability, behaviour, location or movements. Most businesses, unless they are in specific sectors (such as insurance or
finance), do not engage in automated decision-making or profiling and this title can be deleted from the “Contents” section of this
privacy policy, as can the corresponding clause entitled “Our use of automated decision-making, including profiling” in the main
body of the privacy policy. However, you must be sure that your business does not use automated decision-making or profiling
before deleting these provisions.
© 2017 GDPR PRIVACY POLICY. ALL RIGHTS RESERVED.
PROTECTED BY COPYRIGHT INFRINGEMENT DETECTION SOFTWARE.
Summary4
This summary provides an overview of how we obtain, store and use your personal information.
It is intended to provide a very general overview only. It is not complete and must be read in
conjunction with the corresponding full sections of this Privacy Policy.
• Data controller: [insert the name of the data controller]5 • How we collect or obtain your information:
o when you provide it to us (e.g. by contacting us [or placing an order on our
website] [insert any additional ways in which you usually collect information
from users e.g. by signing up to your newsletter]),
o from your use of our website, using cookies, and
o [occasionally,]6
from third parties
• Personal information we collect: name, contact details, [IP address] [information
about your computer] [and] [insert any additional information you collect about
individuals]. • How we use your personal information: for administrative and business purposes
(particularly to contact you [and process orders you place on our website]), [to improve
our business and website,] [for advertising and analytical purposes,] [in connection with
our legal rights and obligations] [and] [for certain additional purposes only with your
explicit consent].7 • Disclosure of your personal information to third parties: only to the extent
necessary to [run our business,] [fulfil any contracts we enter into with you,] [where
required by law or to enforce our legal rights] [and] [insert any other circumstances in
which you may disclose personal information to third parties]. • Do we sell personal information to third parties: [Yes/No]
4 This summary section is designed to meet the GDPR’s requirement for a privacy policy to be in a concise, transparent, intelligible
and easily-accessible form and uses the ICO’s suggestion of adopting a layered approach in order to achieve this. The individual
can then look at the corresponding section in the main body of the privacy policy if they require more information on any particular
aspect of your privacy policy. If you use an individual’s personal data in a way they would not reasonably expect, you should
ensure that you include it in this summary section. 5 The data controller is the person responsible for deciding the purposes for which personal information is processed (i.e. used)
and the means by which such processing is done. In the vast majority of cases, this will be the company (if your business is a
company) or you, the sole trader (if you run your business as a sole trader), which receives the personal information from the
website (e.g. enquiries and orders) and is therefore the same person or entity set out at the beginning of the privacy policy. You
will normally be aware of who the data controller is if you have appointed someone else for this function. If you are unsure about
who the data controller is, you should seek appropriate professional advice.
6
Include the word ‘occasionally’ if you only occasionally receive information from third parties (i.e. the nature of your business
does not involve the regular receipt of information about individuals from third parties). If you regularly receive information from
third parties you should delete the word occasionally.
7 Here you should summarise the purposes for which you use an individuals’ personal data. If you are unsure whether to include
any of the optional sections in this clause, it is generally safer to include them where you might not use the data for that purpose,
than to omit them and then process data for those reasons.
© 2017 GDPR PRIVACY POLICY. ALL RIGHTS RESERVED.
PROTECTED BY COPYRIGHT INFRINGEMENT DETECTION SOFTWARE.
• How long we retain your personal information: for no longer than necessary, taking
into account any legal obligations we have (e.g. to maintain records for tax purposes)
and any other legal basis we have for using your personal information e.g. your
consent, performance of a contract with you or our legitimate interests as a business. • How we secure your personal information: using appropriate technical and
organisational measures such as [storing your personal information on secure
servers,]8
[encrypting transfers of data to or from our servers,] [encrypting payments
on our site via Secure Sockets Layer (SSL)] [and] only granting access to your personal
information where necessary [and] [insert any additional security measures you use to
protect personal information]. • Use of cookies: [we do not use cookies on our website / we use cookies [and similar
information-gathering technologies such as web beacons] on our website [including
[analytical] [and] [targeting cookies]. To find out more please visit our cookies policy
here: [insert link to cookies policy]]9 • Transfers of your personal information outside the European Economic Area: we
[will / will not / may] transfer your personal information outside of the European
Economic Area. [Where we do so, we will ensure appropriate safeguards are in place].
10
• Your rights in relation to your personal information
o to access your personal information and to be informed about its use
o to correct your personal information
o to have your personal information deleted
o to restrict the use of your personal information
o to object to the use of your personal information
o to complain to a supervisory authority
o to withdraw your consent to the use of your personal information
Our details
The data controller in respect of our website is [insert name of company or individual] [(insert
company registration number, if applicable)] of [insert address]. You can contact the data
controller by writing to [insert correspondence address for the data controller] or sending an
email to [insert email address].
8
Include this section if the servers on which you store personal information are secure. You are required to put in place
organisational safeguards to minimise the risk of loss or corruption of personal information. If your servers are not secure, it is
strongly recommended that you migrate to secure servers to meet this requirement.
9 You must specify whether or not you use cookies on your website, whether they include analytical or targeting cookies or web
beacons. We strongly recommend that you confirm with your web developer or software providers before stating that you do not
use cookies as many sites, plugins or website-building platforms place cookies on users’ devices without the operator being
aware of this. If you do use cookies, you should provide a link to your cookies policy here.
10 Where you transfer personal information outside the European Economic Area (EEA), you must ensure appropriate safeguards
are in place before you transfer that personal information. For further information on such safeguards please see the full section
entitled ‘Transfers of your personal information to other countries and safeguards used’.
.bmp)
.bmp)