Most business websites collect some personal data, so most need a privacy policy. Terms and conditions are a separate document with a separate job.
Most business websites need a website privacy policy, because almost every site collects personal data through a contact form, analytics or cookies. Terms and conditions are separate: they set the rules for using the site or buying from you. Rules differ by country and change, so treat any template as a draft and ask a lawyer to check it.
Do you need a website privacy policy?
If your website collects personal data, you should publish a website privacy policy that says what you collect and what you do with it. Nearly every business site collects some. A contact form takes a name and an email address. A newsletter box takes an email address. A shop takes names, delivery addresses and order history. Analytics and advertising tags set cookies or other identifiers that recognise a browser. Chat widgets, booking tools, embedded videos and maps from other companies can do the same.
Whether the law requires a policy, and what it must say, depends on the country. Many countries have data protection laws. Some apply according to where your visitors live, which can differ from where your business is. The rules also change, and they vary by sector and by the kind of data. This guide gives general points and is not legal advice. Ask a lawyer, or read the official guidance published by the data protection authority in each country you serve.
Outside the law, other services often ask for a policy. Google's terms for Analytics ask site owners to post a privacy policy that describes their use of cookies and similar identifiers, and to say that they use Analytics. Advertising platforms, payment providers, email tools and app stores have requirements of their own. These change, so read each provider's current documentation before you sign up.
A site with no form, no analytics and no embeds is still not free of data, because hosting providers normally keep server logs of visits. A very small site may need only a short policy. A lawyer can tell you what applies to yours.
Terms and conditions vs a privacy policy
A privacy policy is about the visitor's data. Terms and conditions are about the relationship between you and the people who use or buy from your site. The two documents answer different questions, so one cannot stand in for the other.
| Document | Question it answers | What it usually covers |
|---|---|---|
| Privacy policy | What do you do with my personal data? | What you collect, why, who receives it, how long you keep it and how people can ask about it |
| Terms and conditions, also called terms of use or terms of service | What are the rules for using this site or buying here? | Who may use the site, acceptable use, ownership of content, orders and payment, cancellations, limits on your responsibility and which country's law applies |
| Cookie notice | Which cookies and similar tools does the site use? | What each one does, who sets it and how a visitor can change their choice |
| Returns, refund and delivery policies | What happens if I send something back, and when will it arrive? | Conditions, time limits and who pays for return delivery |
| Disclaimer | How far can I rely on this information? | Where content is general information and not professional advice |
Whether terms are needed depends on the site and the country. A brochure site that shows your services has less to settle than a shop, a booking system or a site where users create accounts or post content. Terms matter most where money changes hands or where visitors can upload things. Even where no rule requires them, they are the place to write down conditions you may later need to point to. A lawyer can tell you which documents your kind of site should have.
What a privacy policy should cover
A privacy policy should describe what your site does today, in words a visitor can follow. The headings below suit most small business sites. Your lawyer may add to them or change the order.
- Your legal business name, your address and an email address for privacy questions.
- What you collect, for example names, email addresses, phone numbers, delivery addresses, order details, and technical data such as device and browsing information gathered by cookies and analytics.
- Why you collect each kind of data, in plain words: replying to an enquiry, delivering an order, sending a newsletter or measuring how the site is used.
- Who receives it, by type of provider: your payment gateway, email tool, courier, hosting company and analytics provider.
- Whether providers hold or process the data in other countries, if that applies. Each provider's documentation usually says.
- How long you keep each kind of data, or the rule you use to decide.
- Which cookies and similar tools you use, or a link to a separate cookie notice.
- What choices visitors have: how to ask what you hold about them, ask for a correction or deletion, or stop receiving marketing. The rights that exist differ by country.
- A modest, accurate statement of how you protect the data. The website security checklist shows what that protection normally involves. Promise only what you actually do.
- The date of the last update, and how you will tell people when it changes.
The test for every line is simple: is it true of your site today? A policy that describes tools you do not use, or leaves out ones you do, misleads the people who read it.
List the data your site collects before you write anything
Write the policy from a list of what the site really does, not from a template. On a small site the list is a short job. Go through the site with whoever built it and fill in a table like this one.
| Where data enters | What is collected | Who receives it | Question to answer |
|---|---|---|---|
| Contact or enquiry form | Name, email address, message, sometimes a phone number | Your mailbox, and possibly a form tool or customer database | Where do submissions end up, and who can read them? |
| Newsletter sign-up | Email address, sometimes a name or interests | Your email tool | Does the wording on the form say what people will receive, and does it link to your policy? |
| Checkout or booking | Name, address, order details, payment status | Payment gateway, courier, your store platform | Which provider handles payment details? |
| Analytics | Pages viewed, device, approximate location, a cookie or identifier | The analytics provider | Which tool, and what does its documentation say you must tell visitors? |
| Advertising or social tags | Browsing behaviour tied to an identifier | The advertising or social platform | Which tags are installed, and who added them? |
| Embedded video, maps and chat | IP address, sometimes cookies or chat messages | The company that provides the embed | Does it load before the visitor has made a choice? |
| Accounts and logins | Email address, login details, order or activity history | Your platform and its database | How long do you keep accounts that nobody uses? |
A developer can list the scripts that load on each page, and your host and each tool's help pages say what they record. If the site feeds an email list, the guide to getting started with email marketing covers consent and sign-up wording. Keep the finished table. It is also what your lawyer will want to see.
Cookie notices and consent banners
A cookie notice explains which cookies and similar tools your site uses. A consent banner asks the visitor to accept or refuse some of them. Some countries expect consent before non-essential cookies are set, and others do not. Which rule applies to you depends partly on where your visitors are, so ask a lawyer rather than copying what another site does.
A banner has to work as well as look right. One that offers a reject button while advertising and analytics tags still load does not match what it tells the visitor. Ask your developer to confirm that those tags wait for the visitor's choice wherever that is the intended behaviour, and test it yourself in a private browser window.
Can you copy a policy from another website?
No. A policy copied from another website is a poor fit for two reasons. It is usually protected by copyright, so copying it can create its own problem. More important, it describes another business, with different tools, different data and different promises. The cost shows up later, when a visitor asks about something the policy says you do and you do not.
Templates and policy generators are a fair starting point if you treat the output as a draft. Fill it in from your own list, delete what does not apply, add what is missing and have a lawyer read it. Search the finished text for another company's name, a placeholder in square brackets or a country you do not serve. Those are the usual signs of a policy that was pasted in without being read.
Where to publish the pages and when to update them
Link the privacy policy, the terms and any cookie notice from the footer of every page, so a visitor can reach them in one click from anywhere. Put a short line and a link beside each form that collects data, and on the checkout page. The website launch checklist includes adding these pages before go-live, along with the other final checks.
Show the date of the last update at the top of each document. Then review the documents whenever the site changes in a way that affects data. Typical triggers are a new analytics or advertising tag, a new email tool, a new payment gateway, a chat widget, customer accounts, a change of host and a new product line that collects more details. Give one person the job of asking, each time the site changes, whether the policy still describes it.
Who should check your policies
A lawyer who knows the data protection and consumer rules in the countries where you and your customers are should review the final text. A web developer can tell you what the site collects. Only a lawyer can say what the law requires of you, and a lawyer can do that well only if you hand over the facts.
Take the table of data entry points, the names of your providers, the countries your customers live in, what you sell and on what terms, and your current returns and delivery rules. For official guidance, look for the website of your country's data protection authority, which often publishes plain-language material for small businesses.
A web team can build the pages, link them from every footer, set up forms with consent wording and install a consent tool. The wording itself belongs to the lawyer. The website development service page describes the sites Liftup builds.
Questions and answers
Does my website need a privacy policy?
If your site collects any personal data, including through a contact form, analytics or cookies, you should publish one. Whether the law requires it depends on the country, and services such as Google Analytics ask for one in their own terms. Ask a lawyer what applies to you.
What is the difference between terms and a privacy policy?
A privacy policy explains what you do with visitors' personal data. Terms and conditions set the rules for using the site or buying from you, such as orders, cancellations and limits on your responsibility. One does not replace the other.
What should a privacy policy cover?
It should cover who you are, what data you collect, why, who receives it, how long you keep it, how cookies are used and how people can make requests about their data. It should describe what your site does today, not what a template assumes.
Can I copy a policy from another website?
You should not. Another site's policy is usually protected by copyright and describes different tools and promises. Use a template only as a draft, fill it in from your own list of the data your site collects and have a lawyer check it.
Who should check my policies?
A lawyer who knows the rules where you and your customers are should review them. Your developer should confirm what the site really collects, because the lawyer needs that list to do the work properly.
Do I need a cookie banner?
It depends on the country and on the cookies you use. Some places expect consent before non-essential cookies are set, and others do not. If you add a banner, make sure the tags respect the visitor's choice, and ask a lawyer which rules apply.
Do I need terms and conditions on a brochure website?
Not every site needs the same documents, and a brochure site has less to cover than a shop or a booking site. Ask a lawyer, and add terms before you take payments, accept bookings or let visitors post content.