A privacy policy explains how your business handles the personal data of the people who use your website. The GDPR rests on a basic principle: people have the right to control their own personal data. As a business that handles personal data, you’re responsible for explaining how you process it – and that’s where a privacy policy comes in. In Loopia Sitebuilder you create it as a separate page and link to it from your forms and footer.
Note: this article is for information only and isn’t legal advice. We strongly recommend consulting a lawyer before you publish your privacy policy, to make sure it complies with the law.
What is personal data?
Under the GDPR, personal data covers any information that can identify an individual. It’s a broad area and includes, among other things:
- Email addresses
- First and last names
- Locations (city, town and country)
- Delivery or billing addresses
- National identity numbers or equivalent identifiers
Even seemingly anonymous data can count if it can be combined with other data to identify an individual.
Personal data isn’t limited to the basics – it extends to the digital world too. Everything from IP addresses to cookie data can be classed as personal data. Your website may also handle personal data from people who have never contacted your business directly. Your privacy policy must therefore clearly explain what kinds of personal data you process and why.
Why do I need a GDPR-compliant privacy policy?
Your business may already have a privacy policy to comply with various national laws, such as the California Online Privacy Protection Act (CalOPPA), Canada’s PIPEDA, Australia’s Privacy Act, the UK’s Data Protection Act, the EU’s former data protection directive or Singapore’s PDPA.
The GDPR, however, is in a class of its own and sets requirements that go beyond these laws. Even if your existing privacy policy meets them, it may not meet the stricter GDPR requirements.
Is a privacy policy mandatory?
Under the GDPR, the privacy policy (also called a privacy notice) is a cornerstone of your business’s compliance. It’s mandatory under the GDPR and required by several other national laws too. A GDPR-compliant privacy policy:
- Shows that you take responsibility for protecting your customers’ personal data.
- Gives your customers clarity about the scope of the personal data your business handles.
- Confirms that your data protection practices are lawful.
Remember that the privacy policy must apply to everyone whose personal data you may process, including visitors to your website.
Tips for writing a privacy policy
- Open with a brief introduction to your business and the purpose of the policy.
- State clearly the date the policy takes effect.
- Include your business’s legal name and postal address.
- Give contact details for your data protection officer (DPO).
Note: the GDPR requires your privacy policy to be written in clear, plain language, avoiding legal jargon. You can find more requirements in the EU’s official guidelines, and published example privacy notices can give you guidance.
Showing your privacy policy on your Loopia Sitebuilder site
The most important places to point visitors to your privacy policy are any forms where you collect names and email addresses, and your footer.
Adding a privacy policy link to the Form block
- Create the privacy policy page in Loopia Sitebuilder – the process is the same as for a cookie policy page (a blank page with a Text block).
- Add the Form block where you want it on the canvas, click the form itself and tick Display GDPR consent field on the Form settings → Advanced tab.
- Click the Privacy policy link in the consent field and click the link icon.
- Choose Open a page as the click action in Link settings and select your privacy policy page from the list.
- Click Submit and publish your site for the changes to go live.
Showing your privacy policy in the footer
- Go to your Footer block and click the footer navigation to open List settings. (If footer navigation isn’t enabled, go to Block settings and tick Footer navigation.)
- Click the blue (+) button to add a new item.
- Choose Open a page as the click action and select your privacy policy page from the list.
- Type the navigation item’s name in the Title field and click Submit in this and the next window.
Always keep your privacy policy as a separate document from your terms and conditions.