A neutral-form website/app privacy policy, adapted for the UK GDPR and the Data Protection Act 2018. Drafted for organisations operating in England & Wales.
How to use this template, read this first - Replace every
[SQUARE-BRACKET]field before use, and delete anything that does not apply to you. - A privacy policy must be accurate about what you actually do, copying a generic policy that does not match your real data practices can itself breach the law. Map your data flows first. - A privacy policy is not the same as a cookie banner: cookies and similar technologies are also governed by PECR (the Privacy and Electronic Communications Regulations 2003), which generally requires consent for non-essential cookies. - The regulator is the Information Commissioner's Office (ICO). Have a solicitor or privacy specialist review before publishing.
---
Privacy Policy
Last updated: [DATE]
1. Who we are (the "controller")
[ORGANISATION NAME] ("we", "us") of [ADDRESS] is the controller of your personal data. Contact: [EMAIL]. [Our Data Protection Officer / privacy contact is [NAME, CONTACT], if applicable.]
2. What personal data we collect
We may collect: [identity and contact details; account details; order/transaction data; communications; technical data such as IP address and device information; usage data; marketing preferences]. [Specify any special category data and how it is handled.]
3. How we collect it
[Directly from you (forms, account sign-up, purchases); automatically (cookies and similar, see our Cookie Policy); from third parties such as [ ].]
4. Why we use it, and our lawful basis
We use your data for the purposes below, each with a lawful basis under the UK GDPR:
- To provide our services / fulfil your order, performance of a contract.
- To comply with legal obligations (e.g. accounting, tax), legal obligation.
- To improve and secure our services / prevent fraud, legitimate interests.
- To send marketing by direct electronic means (such as email or SMS), legitimate interests (where the PECR soft opt-in applies for existing customers) or consent (where consent is relied on under PECR, which you may withdraw at any time). Note: direct electronic marketing must separately comply with PECR; the soft opt-in removes the need for prior PECR consent for certain customer marketing but does not itself replace the need for a UK GDPR lawful basis.
5. Cookies
We use cookies and similar technologies. Non-essential cookies are used only with your consent. See our [Cookie Policy] and cookie banner for details and controls.
6. Who we share it with
We may share data with [service providers/processors (e.g. hosting, payment, delivery); professional advisers; authorities where required by law]. We require processors to protect your data and act only on our instructions.
7. International transfers
[Where we transfer data outside the UK, we ensure an appropriate safeguard applies, such as UK "adequacy" regulations or the International Data Transfer Agreement / Addendum.]
8. How long we keep it
We keep personal data only as long as necessary for the purposes above and to meet legal requirements. [Summarise your retention periods.]
9. Your rights
Under the UK GDPR you have the right to: access your data; have it corrected; have it erased; restrict or object to processing; data portability; and to withdraw consent. To exercise these, contact [EMAIL]. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
10. How we protect your data
We use appropriate technical and organisational measures to keep your data secure.
11. Changes to this policy
We may update this policy from time to time; the "last updated" date shows the latest version.
12. Contact
Questions about this policy or your data: [EMAIL / ADDRESS].
--- This template is a starting point and not legal advice. A privacy policy must reflect your actual data practices and comply with the UK GDPR, the Data Protection Act 2018 and PECR, have a qualified solicitor or privacy specialist review and adapt it before publishing. Governing law: England & Wales.