Website Privacy Policies

What is a website privacy policy?

A website privacy policy (sometimes referred to as a privacy notice) provides information on how an organisation collects, stores and processes personal data of its website users. This includes any personal information a website user may provide when he or she signs up to a newsletter or purchases a product online.

Personal data means any information about an individual from which that person can be identified, such as name, email address or telephone number. It can also include technical data such as internet protocol (IP) address or login data.

Do organisations need a privacy policy on its website?

If a business collects personal data from website visitors then the simple answer is yes.

There are many different methods in which businesses may collect personal information from its website users. Most commonly businesses collect personal data when users create accounts on its website, purchase online goods or services or fill in an online enquiry form. Organisations may also collect data via automated technologies such as cookies.

Under data protection laws, a business is required to provide an individual with certain information at the point their personal data is collected. The easiest way to provide this information is through a privacy policy.

What should the policy include?

The policy should first and foremost provide the full name and contact information of the business collecting the data.

Other information that should be included in the policy:

• the types of personal data collected;
• the reasons why personal information is collected;
• what the business intends to do with the persona data;
• the lawful basis for processing the personal data and any legitimate interests where relevant;
• who the personal data will be shared with;
• the details of any transfers of the personal data to any countries or organisations outside the EU;
• how long the personal data will be held for;
• an individual’s information rights, such as their right to obtain a copy of their personal data;
• an individual’s right to lodge a complaint with a supervisory authority.

Where should the policy be placed on a website?

A privacy policy should be placed in an easily accessible location on a website. It is good practice to have a link to the policy on every page of the website; with the homepage being the most prominent.

Businesses should also signpost website users to its privacy policy when they are about to enter personal information via the website. The language of the privacy policy should be clear, concise and involve no legal jargon. It is also practical to use headers to break up the text of the policy.

If you need any advice on website privacy policies, please contact a member of our team in confidence here or on 02920 829 100 for a free initial call to see how they can help.