Who we are?

Indicate the name and contact details of the data controller. This will usually be your business or you, if you are an individual entrepreneur. Where applicable, you should include the identity and contact details of the controller's representative and/or data protection officer.

What information do we collect?

Specify the types of personal information you collect, such as names, addresses, usernames, etc. You must include specific details about:
how you collect the data (for example, when a user registers, purchases or uses your services, fills out a contact form, subscribes to a newsletter, etc.)
what specific data you collect through each of the methods
data collection if you collect data from third parties, you must specify the categories of data and the source
whether you process sensitive personal data or financial information, and how you handle it

You may want to provide the User with relevant definitions regarding Personal Data and Sensitive Personal Data.

How do we use personal information?

Describe in detail all the service and commercial purposes for which you will process the data. For example, this may include items such as:
personalization of content, commercial information or user experience
the creation and administration of an account the realization
marketing and event communications
conducting polls and surveys
for internal research and development purposes
supply of goods and services
legal obligations (for example, fraud prevention)
meet internal audit requirements

Please note that this list is not exhaustive. You will need to register all the purposes for which you process personal data.

What legal basis do we have for processing your personal data?

Describe the relevant processing terms contained in the GDPR. There are six possible legal grounds:
consent
CONTRACT
legitimate interests interests
vital
public mission
legal obligation

Provide detailed information on any grounds that apply to your processing, and why. If you rely on consent, explain how people can withdraw and manage their consent. If you rely on legitimate interests, clearly explain what they are.

If you process special category personal data, you will need to meet at least one of the six processing conditions, as well as additional requirements for processing under the GDPR. Provide information on any additional grounds that apply.

When do we share personal data?

Explain that you will treat the personal data confidentially and describe the circumstances under which you might disclose or share it. For example, when necessary to provide your services or conduct your business operations, as set out in your processing purposes. You must provide information about:
how you will share the data
the guarantees that you will put in place
the parties with whom you may share the data and why

Where do we store and process personal data?

If applicable, explain whether you intend to store and process data outside the country of origin of the data subject. Describe the steps you will take to ensure that the data is treated in accordance with your privacy policy and the applicable law of the country where the data is located.

If you transfer data outside of the European Economic Area, describe the measures you will put in place to provide an appropriate level of data privacy protection. For example, contractual clauses, data transfer agreements, etc.

How do we secure personal data?

Describe your approach to data security and the technologies and procedures you use to protect personal information. For example, these can be measures:
to protect data from accidental loss
to prevent unauthorized access, use, destruction or disclosure
to ensure business continuity and disaster recovery
to restrict access to personal information
to conduct privacy impact assessments in accordance with the law and your company policies
to train staff and contractors on data security

to manage third-party risks, through the use of contracts and security reviews

Please note this list is not exhaustive. You should record any mechanisms you rely on to protect personal data. You should also indicate whether your organization meets certain accepted standards or regulatory requirements.

How long do we keep your personal data?

Provide specific information on how long you will retain the information in relation to each processing purpose. The GDPR requires you not to retain data longer than reasonably necessary. Include details of your data or records retention schedules, or link to additional resources where they are published.

If you cannot indicate a specific period, you must define the criteria you will apply to determine the retention period of the data (for example, local laws, contractual obligations, etc.).

You should also indicate how you safely dispose of the data after you no longer need it.

Your rights regarding personal data

Under the GDPR, you must respect the right of data subjects to access and control their personal data. In your privacy notice, you should describe their rights with respect to:
access to personal information
correction and deletion
withdrawal of consent (if the processing of data is subject to the condition of consent)
data portability
restriction of processing and objection
filing a complaint with the Office of the Information Commissioner

You should explain how individuals can exercise their rights and how you plan to respond to requests for data about the subjects. Indicate whether any relevant exemptions may apply and define the identity verification procedures you can rely on.

Include details of the circumstances in which the data subject's rights may be limited, for example if responding to the data subject's request may expose personal data about another person, or if you are asked to delete data that you are required to keep by law.

Use of automated decision making and profiling

When you use profiling or other automated decision-making, you must disclose it in your privacy policy. In such cases, you should provide details of the existence of any automated decision-making, together with information about the logic involved, and the significance and likely consequences of the processing of the individual.

How to contact us?

Explain how the data subject can contact you if they have questions or concerns about your privacy practices, personal information, or wish to file a complaint. Describe all the means by which they can contact you – for example online, by e-mail or by post.

If applicable, you may also include information about:

Use of cookies and other technologies

You can include a link to additional information or describe in the policy if you intend to set and use cookies, tracking technologies and similar to store and manage user preferences on your website, make advertising, enable content or analyze user and usage data. Provide information about the types of cookies and technologies you use, why you use them, and how someone can control and manage them.

Link to Other Third Party Websites/Content
If you link to external sites and resources from your website, state whether this constitutes an endorsement of and whether you assume any responsibility for the content (or information contained in) any linked website.

You may consider adding other optional clauses to your privacy policy, depending on your business situation.