Privacy policy

What a privacy policy has to deliver

A privacy policy informs visitors and customers about which personal data is collected, for what purpose, on which legal basis, how long it is kept and to whom it is passed on. It is therefore an obligation of the operator, not a request for permission.

The decisive yardstick is agreement with the actual operation. A policy that does not name tools that run in the shop is not incomplete but incorrect. And an incorrect policy is attackable even when nobody suffered damage.

Which details belong in it

Required are the controller with contact details and, where appointed, the data protection officer. The processing activities follow, ordered by purpose: order, payment, shipping, customer account, newsletter, analytics, advertising, contact form and reviews. Each activity needs its purpose, the data involved, the legal basis, the recipients and the retention period.

The rights of the data subject come on top, meaning access, rectification, erasure, restriction, portability and objection, plus a note on the right to complain to a supervisory authority. For transfers outside the EU the basis for that transfer has to be stated as well.

Why templates from portals are not enough

• They do not know the operation: a template has no idea which newsletter service, payment tool and analytics programme are in use.
• They age silently: when a tool is replaced and the policy is not updated, it names a provider that no longer runs.
• They name recipients wrongly: besides the provider, third party recipients and processors have to be correct too.
• They stay too general: a paragraph on security with three standard sentences does not replace a statement on retention.

How it stays current

Three measures suffice. First maintaining the tool list, from which the policy is written. That is the actual source; the policy is only its text made visible. Second a review date on a steady rhythm, for instance yearly, and additionally with every change to payment methods, analytics tools or marketing channels. Third a version note with a date and a short note on what changed. That helps not only the proof but also the visitor, who re-reads the policy after a notice.

The details missing most often

Four points regularly fail to appear. The concrete retention period per activity, replaced by the vague phrasing that data is kept as long as necessary. The recipients of data outside the EU, including the reason for the transfer. The legal basis per purpose, often only noted as legitimate interest. And consent as a basis of its own, although it is revocable differently from a statutory permission.

Frequent questions

• Is a linked policy in the footer enough? Yes, the link belongs permanently reachable on every page.
• How often to review? Yearly and with every change to tools.
• Does it have to be translated? In a multilingual shop yes, every language needs its own version.