Free privacy policy generator

1. Who we are

[Your business name] ("we", "us") operates the website at [your-website.com]. This policy explains what personal data we collect from you, why we collect it, who we share it with, and the rights you have over it. We are based in [your country or state].

If you have a question about this policy or about the data we hold on you, write to us at [[email protected]].

2. Data we collect

We collect the following categories of personal data:

• Name
• Email address
• Device and IP address
• Cookies and analytics data

3. Why we collect it

We use the data above for these purposes, and no others without telling you first:

• Provide and run the service
• Answer support requests
• Measure usage and improve the product
• Prevent fraud and keep the service secure
• Meet legal and accounting obligations

4. Legal bases for processing (GDPR)

Where the GDPR applies to you, we rely on the following legal bases under Article 6 to process your data:

• Consent (Art. 6(1)(a))
• Performance of a contract (Art. 6(1)(b))
• Legal obligation (Art. 6(1)(c))
• Legitimate interests (Art. 6(1)(f))

Where we rely on consent, you can withdraw it at any time, and withdrawing it does not affect the processing we carried out before you did. Where we rely on legitimate interests, you can object and we will stop unless we can show compelling grounds to continue.

5. Cookies and tracking

We set the following categories of cookies and similar technologies on [your-website.com]:

• Strictly necessary
• Analytics and performance

Cookies that are not strictly necessary are set only after you accept them, and you can change or withdraw that choice at any time through the cookie settings on the site or through your browser settings.

6. Third parties and recipients

We share personal data with the service providers below, and only the data each of them needs to do its job. Each one processes the data on our instructions under a written agreement.

• Analytics: [provider name], to understand how the service is used.
• Hosting and infrastructure: [provider name], to store data and serve the site.

We also disclose data where the law requires it, for example in response to a valid legal request, and to a buyer if the business is sold, in which case this policy continues to apply until the buyer tells you otherwise.

7. Selling and sharing your data

We do not sell your personal information, and we do not share it for cross-context behavioural advertising as those terms are defined in the CCPA. We have not done so in the past 12 months.

8. How long we keep it

We keep your personal data for as long as your account is active, and for a limited period afterwards where we need the data to meet a legal or accounting obligation. When the period ends we delete the data or anonymise it so that it can no longer be linked back to you.

9. How we protect it

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, access controls that limit who can reach the data, and logging of administrative access. No system is perfectly secure, so we also keep a process for detecting a breach and, where the law requires it, notifying you and the regulator.

10. Your rights (GDPR)

If you are in the EU or the UK, you have the following rights over your personal data. To use any of them, email [[email protected]] and we will answer within one month.

• Access: get a copy of the data we hold on you.
• Rectification: correct data that is wrong or incomplete.
• Erasure: have your data deleted where we no longer have a reason to keep it.
• Restriction: tell us to stop using your data while a dispute is resolved.
• Portability: receive your data in a machine-readable format and move it elsewhere.
• Objection: object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent: where we rely on your consent, take it back at any time.
• Complaint: lodge a complaint with the supervisory authority (the data protection authority) in the country where you live or work. Article 77 of the GDPR gives you this right, and you can use it whether or not you have raised the matter with us first.

11. Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the following rights. To use any of them, email [[email protected]]. We will verify your identity before we act, and we will answer within 45 days.

• Know: ask what personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to.
• Delete: ask us to delete the personal information we collected from you, subject to the exceptions in the statute.
• Correct: ask us to fix personal information that is inaccurate.
• Opt out: tell us to stop selling or sharing your personal information.
• Limit: tell us to use sensitive personal information only for the purposes the statute permits.
• No retaliation: we will not deny you service, charge you a different price, or give you a lower quality of service because you used any of these rights.

An authorised agent may make a request on your behalf if you give them written permission and we can verify it.

12. International transfers

Some of the providers named above are based outside the EU and the UK, so your personal data may be transferred there. Where that happens we rely on an adequacy decision by the European Commission, or on the Commission's Standard Contractual Clauses together with any extra safeguards the transfer needs. Email [[email protected]] if you want a copy of the clauses we use.

13. Changes to this policy

We update this policy when what we do with data changes. The effective date at the top tells you when the current version took effect. If a change is significant we will tell you by email or with a notice on the website before it takes effect.

14. Contact us

Questions, requests, and complaints all go to [[email protected]]. Write to [Your business name], [your country or state].