Legal
How to write a privacy policy for a small website
List what data you collect, why, on what lawful basis, who you share it with, how long you keep it, and how someone exercises their rights. Accuracy matters more than length — a policy describing things you do not do is worse than useless.
Before you start
- A complete list of what your site collects
- Your list of third-party processors
The steps
-
Step 1: Inventory what you actually collect
Contact form fields, analytics, cookies, server logs, order data. Check the network tab rather than relying on memory.
-
Step 2: List every third party receiving data
Analytics, hosting, email, payment processor, chat widget, embedded video.
-
Step 3: State the purpose for each
Why you hold it. "For marketing" is not a purpose; "to reply to your enquiry" is.
-
Step 4: State the lawful basis
Under UK and EU GDPR: consent, contract, legal obligation or legitimate interests. Name which applies to what.
-
Step 5: State retention periods
How long you keep each category, and what happens then.
-
Step 6: Explain how to exercise rights
Access, rectification, erasure, portability, objection — and a working contact route.
-
Step 7: Add the contact details
A real email address that a person reads.
-
Step 8: Date it and keep it updated
And revise it whenever you add a tool that collects anything.
Why a template alone is not enough
Templates describe a generic business. If yours says you use cookies for advertising and you do not, or omits the chat widget you installed last year, it is inaccurate — and an inaccurate policy is a worse position than a short honest one.
What it unlocks commercially
Google Ads, Merchant Center and most payment processors require a published privacy policy alongside contact details and terms. Beyond compliance, it is a prerequisite for selling.
The background behind this
Buying a website: the questions that decide what you actually own covers the reasoning in about 5 minutes — free, ungated, written from client work.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada, Ireland and Pakistan. These procedures are the ones I run on client work, written down rather than invented — including the ones where the honest answer is that the fix is not available on your current hosting.