⚠️ Template — not legal advice. Replace every [BRACKETED] value, remove jurisdictions you don't serve, and have it reviewed before publishing. Pair it with the Cookie Policy and the consent banner already built into your sites.

Privacy Policy

Last updated: [DATE] · [COMPANY NAME] ("we", "us", "our")
On this page: Who we areWhat we collectWhy & lawful basis SharingTransfersRetention Your rightsCookiesContact

1. Who we are

[COMPANY NAME] operates [WEBSITE URL] and provides web design and related services. For data protection purposes, the data controller is [COMPANY NAME], [REGISTERED ADDRESS]. You can contact us at [EMAIL].

UK: We are registered with the Information Commissioner's Office (ICO), registration number [ICO REG NUMBER].

2. What information we collect

We only collect what we need to respond to you and provide our services:

We do not intentionally collect special-category data through our forms. Please don't send us sensitive personal or health information via our website.

3. Why we use it, and our lawful basis

PurposeLawful basis (UK/EU GDPR)
Reply to your enquiry & provide a quote/auditLegitimate interests / steps to enter a contract
Deliver our services & manage our relationshipPerformance of a contract
Measure and improve our site & ads (analytics/pixels)Consent (via the cookie banner)
Send occasional relevant updates (if you opt in)Consent — withdraw any time
Comply with legal/accounting obligationsLegal obligation

4. Who we share it with

We never sell your personal data. We share it only with service providers ("processors") who help us operate, under contract and appropriate safeguards, such as: [HOSTING e.g. Netlify/Hostinger], [EMAIL/CRM e.g. Google/Airtable], [ANALYTICS e.g. Google Analytics], [AD PLATFORMS e.g. Meta, TikTok], and [SCHEDULING e.g. Calendly]. We may disclose data where required by law.

5. International transfers

Some providers are outside the UK/EEA (e.g. the USA). Where data is transferred internationally, we rely on appropriate safeguards such as the UK IDTA, EU Standard Contractual Clauses, or an adequacy decision.

6. How long we keep it

We keep enquiry data for up to [e.g. 24 months] after last contact, client records for as long as needed to provide services and for [e.g. 6–7 years] afterwards for legal/accounting reasons, and analytics data per the retention set in our tools. We delete or anonymise data when it's no longer needed.

7. Your rights

UK & EU (GDPR / UK-GDPR)

You have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent at any time. To exercise any of these, email [EMAIL]; we respond within one month. You can also complain to the ICO (ico.org.uk) or your local supervisory authority.

USA (California — CCPA/CPRA & similar)

If you are a California (or similar-state) resident, you have the right to know what personal information we collect, to request deletion, to correct it, and to opt out of "sale"/"sharing". We do not sell your personal information. To make a request, email [EMAIL]. We will not discriminate against you for exercising these rights.

UAE (PDPL)

If you are in the UAE, you have rights of access, correction, deletion, restriction and objection, and to withdraw consent, under Federal Decree-Law No. 45 of 2021. Contact [EMAIL] to exercise them.

8. Cookies & tracking

We use cookies and similar technologies for essential functionality and, with your consent, for analytics and advertising. Non-essential cookies load only after you accept them in our banner. Full details are in our Cookie Policy.

9. Children

Our services are for businesses and are not directed at children under 16. We do not knowingly collect their data.

10. Changes

We may update this policy; the "Last updated" date shows the latest version. Material changes will be highlighted on this page.

11. Contact

Questions or requests: [EMAIL] · [COMPANY NAME], [REGISTERED ADDRESS].