Website privacy policy: what should it include?

Is a privacy policy on your website required?

GDPR doesn't literally say you must have a document called a privacy policy. But you must clearly inform people when you process their data. Almost every business website does that. Think of:

• A contact or quote form with name, email and phone number.
• A newsletter sign-up.
• A booking module, webshop or login area.
• Analytics or ad pixels that collect data about visitors.
• A chat widget or WhatsApp button that stores messages.

This also applies if you're a freelancer (zzp'er) with just a simple form. The size of your business makes no difference to this duty to inform.

What should a website privacy policy include?

GDPR lists a number of things you must inform people about. A good website privacy policy covers at least:

• Who you are: company name, address, Chamber of Commerce (KvK) number and how people can reach you about privacy.
• Which data you process: for example name, email address, phone number, IP address or data about website use.
• What you use it for: sending a quote, scheduling an appointment, creating an invoice, sending your newsletter.
• On what basis: GDPR has six lawful bases, such as consent, performing a contract, a legal obligation or a legitimate interest. State which basis you use for each purpose.
• How long you keep data, or how you decide that period.
• Who you share data with: think of your hosting provider, email tool, accounting package or CRM.
• Whether data ends up outside the European Economic Area, and how you safeguard that.
• What rights people have: access, correction, erasure, restriction, objection and transferring their data.
• That people can always withdraw consent, if you rely on consent.
• That they can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
• Whether you make automated decisions or build profiles, and what that means for them.

Writing a privacy policy: how to go about it

You don't write a privacy policy from behind your desk on gut feeling. Start with an honest overview of what really happens. Here's how:

• List every place where data comes in: forms, phone, email, WhatsApp, bookings, payments.
• For each place, write down what data it is and what you use it for.
• Find out which tools that data ends up in, such as your email program, CRM, accounting or newsletter tool.
• Set the lawful basis and retention period for each purpose.
• Check whether you have a data processing agreement with those tools. Many providers offer one as standard.
• Write the policy in plain language, with subheadings per topic.
• Have the text checked by a lawyer if needed.

This overview is handy for you too. You'll often spot data you collect but don't use straight away. Better to stop asking for that altogether. Less data means less risk.

An example. An installer has a quote form on the site. The details arrive by email and then go into the accounting package if a job follows. The policy then says: we use your name, address, phone and email to prepare a quote (basis: steps prior to entering into a contract). If it doesn't become a job, we delete the request after a fixed period. If it does, we keep the invoice details for as long as the tax record-keeping rules require.

A privacy policy people actually read

Many privacy policies are long walls of legal text. That's not necessary, and GDPR actually asks for clear and plain language. A few tips:

• Start with a short summary of three or four sentences.
• Use subheadings such as 'What data', 'Why', 'How long' and 'Your rights'.
• Address the reader as 'you' if the rest of your site does too.
• Use a table or list per purpose: data, lawful basis, retention period.
• Put the date of the last update at the top or bottom.

Put a link to the privacy policy in the footer of every page, and close to every form. A short line under the submit button, such as 'We only use your details to answer your request', with a link to the full policy, works well. Read more about forms in a contact form that converts.

Common mistakes in a privacy policy

• Text copied from another business, mentioning services or tools you don't use.
• A generic template that's never been adapted to your own situation.
• No retention periods, or periods like 'as long as necessary' with no explanation.
• Analytics, ad pixels or a chat tool that are on the site but not in the policy.
• A policy that hasn't been updated in years, even though new tools have been added.
• Confusing it with the cookie policy. The two belong together, but they're not the same.

You can read about the difference between the privacy policy and the cookie banner, and the rules for cookies, in cookie banner GDPR rules.

Your website privacy policy: keep it up to date

A privacy policy isn't a document you write once and then forget. Every time you add a new tool, change a form or set up an integration with your CRM, for example, something may change. So schedule a short check at least once a year. Include it in your regular website maintenance.

If you use AI tools that process customer data, that deserves extra attention. Read how that works in AI and GDPR.

Help with a privacy-friendly website

In the websites and web applications Violexa builds, we take privacy into account from the start. Our forms only ask for what's needed, we make room for your privacy and cookie policies, and tracking only loads after consent. The legal text itself remains your responsibility. If in doubt, have it checked by a lawyer.

A custom website starts from €1,799 excl. VAT (€2,177 incl. VAT) per project. That includes design, development, a design that works on every screen, SEO basics, Google Analytics, CMS integration and training. Read more under websites and apps.

Want to know how your site measures up? Book the free quickscan: a 30-minute conversation, online or on site, followed by short written advice and a price indication.

Frequently asked questions