Privacy policy example for a small company website, section by section

A privacy policy example is only useful if it matches what your website does. The samples online run long because they’re written to cover every business at once. Yours can be short, because it only has to cover you.

Below is a worked privacy policy example for a small company website: one that sells a few things online, has a contact form and sends a newsletter. Each section gets a line or two of sample wording and a note on why it’s there. Then the parts EU, UK and US rules each add, and a five-minute check you can do on your phone.

What to include in a privacy policy

The lists in the different laws overlap a lot. Article 13 of the GDPR asks for the identity and contact details of the controller, the purposes and legal basis, the recipients, any transfer outside the EU, how long you keep the data, the rights people have and the right to complain to a supervisory authority. The UK’s ICO publishes the same list with “always” or “if applicable” against each item. California’s CalOPPA asks for the categories of information collected, the third parties it’s shared with, an effective date and your answer to Do Not Track signals.

Put them together and you get nine headings: who you are, what you collect, why, who receives it, where it goes, how long you keep it, people’s rights, how to complain, and cookies.

A privacy policy example, section by section

The sample is for a small shop that sells online, takes orders through a form and sends a newsletter. Swap in your own details. Where the law leaves a choice, the note says so.

Who we are

We’re [company name], and we run this website. You can reach us at [email address] or write to us at [postal address].

Article 13 puts the controller’s identity and contact details first. If you’ve appointed a data protection officer, their contact details go here too. In 2024 Romania’s ANSPDCP found that a company’s website did not show the identity of the operator, alongside cookies set before consent, and ordered the privacy policy corrected.

What we collect

When you order, we collect your name, delivery address, email address and what you bought. When you write to us, we keep your message. When you join the newsletter, we keep your email address.

Name the categories; “various data” tells nobody anything. If the order form has a phone number field, the phone number belongs here.

Why we use it

We use your order details to deliver what you bought and to answer questions about it. We use your email address to send the newsletter you asked for. We look at page statistics to see which pages get read.

One purpose per sentence reads well. It also makes the next thing EU and UK rules want, a legal basis for each purpose, easy to add.

Who receives it

We pass delivery details to our courier and payment details to our payment provider. Our email tool holds the newsletter list. We don’t sell your details.

Name the categories of recipient. The “we don’t sell” line only belongs if it’s true. In February 2024 the California Attorney General announced a settlement with DoorDash after an investigation found the company had sold customers’ names, addresses and transaction histories through marketing cooperatives. According to the complaint, its privacy policy did not say that this information was disclosed. DoorDash agreed to pay a $375,000 civil penalty.

Where it goes

Some of the companies we use store data outside the EU. Where they do, we rely on [the safeguard you use, such as standard contractual clauses].

Article 13 asks you to say whether data leaves the EU and what safeguard covers it. If everything stays in your own country, say so in one line. Which safeguard your email tool relies on, I can’t tell from your public pages. You may not know either until you read the tool’s terms.

How long we keep it

We keep order records for [six] years because tax rules ask us to. We keep messages for a year after the last reply. We keep your newsletter address until you unsubscribe.

Article 13(2)(a) asks for the period, or the criteria used to decide it. “For as long as we need it” is neither.

Your rights

You can ask us for a copy of your details, ask us to correct or delete them, or ask us to stop using them. Email us and we’ll sort it out.

EU and UK rules want the list spelled out: access, rectification, erasure, restriction, objection and portability, plus the right to withdraw consent where you relied on it. California wants the rights to know, delete, correct, opt out of sale or sharing, and limit, and the right not to be discriminated against for using them. There’s a plain explanation of the access right in what is a DSAR.

Complaints

If you’re not happy with how we’ve handled your details, tell us first. You can also complain to [the ICO, or your data protection authority].

Article 13(2)(d) asks for the right to lodge a complaint with a supervisory authority. The ICO says UK organisations should tell people they can complain to the ICO and give its contact details.

Cookies

This site sets one cookie to remember your basket. If you say yes in the banner, [analytics tool] sets cookies too. You can change your mind from the link in the footer.

Name the tools that run. In June 2025 Italy’s Garante issued a warning to a car dealer whose banner came back after visitors closed it and whose privacy policy lacked detail on tracking tools. No fine, an order to comply. A full worked version lives in cookie policy template.

What EU law adds

The GDPR’s list sits in Article 13, and the rule asks for it “at the time when personal data are obtained”. That means a link right beside the form.

Beyond the nine headings, Article 13 adds items a sample often leaves out:

• The legal basis for each purpose, and where it’s legitimate interests, what those interests are.
• Whether giving the data is part of a contract or a legal requirement, and what happens if someone doesn’t.
• Any automated decision-making with a legal or similar effect, with meaningful information about the logic involved.
• The safeguard behind any transfer outside the EU, and how to get a copy of it.

Article 12 sets the tone: “concise, transparent, intelligible and easily accessible form, using clear and plain language”. The sample above is written to that line. The wider EU list is in the GDPR compliance checklist.

What UK law adds

The UK GDPR keeps the same Article 13 list. The ICO says to provide the information at the time you collect the data, to use a mix of techniques such as layering, dashboards and just-in-time notices, and to review and update it regularly.

Two smaller points from the ICO’s list catch people out. The right to object has to be brought explicitly to people’s attention and kept separate from other information. And the complaint line should name the ICO and give its contact details.

What US law adds

CalOPPA applies to an operator of a commercial website that collects personally identifiable information about consumers living in California. It asks the operator to “conspicuously post” a privacy policy, and gives 30 days to post one after being notified that it’s missing. The policy has to do all of these:

• Identify the categories of personal information collected and the categories of third parties it may be shared with.
• Describe any process for reviewing and requesting changes to that information, if one exists.
• Describe how material changes to the policy are notified.
• Identify its effective date.
• Disclose how the operator responds to browser Do Not Track signals, if it tracks people across other sites.
• Disclose whether other parties may collect information about a visitor’s activity across different sites.

The Attorney General’s 2014 guide on the same law recommends plain language, short sentences, headers and a home page link containing the word “privacy”.

The CCPA applies on top for for-profit businesses past a threshold, such as gross annual revenue over $25 million. For those, the policy has to describe consumers’ rights and how to exercise them, give instructions for submitting requests, and, where the business sells or shares personal information, include the Do Not Sell or Share link. In September 2025 California’s privacy agency announced that Tractor Supply would pay $1,350,000 to resolve allegations that included a privacy policy that did not notify consumers of their rights. The US list is in the CCPA compliance checklist.

Privacy notice template or your own words?

A privacy notice template from a generator covers every case, which is also its problem. It describes things you don’t do and skips things you do. Look back at the two cases above: the DoorDash settlement turned on a disclosure the policy didn’t mention, and the Italian warning on tracking tools it didn’t name. Both had a policy.

Start from the nine headings and write what’s true under each. If a heading has nothing under it, say so: “We don’t send data outside the UK” is a complete section.

Check your own privacy policy on your phone

1. Open your home page and scroll to the footer. Look for a link with the word “privacy” in it. If you have to search for it, it isn’t conspicuous.
2. Open every form on the site and note the fields. Compare them with the “what we collect” section. Every field should appear there.
3. Say yes in the cookie banner, then read the cookies section. Does it name the tools that run? Does the banner’s list match?
4. Find the complaints line. Does it name a regulator and give a way to reach them?
5. Find the retention line. Is there a period, or a way of deciding one?
6. Look for a date. If there isn’t one, add it, along with a line on how you tell people about changes.
7. Read it aloud. If a sentence takes more than one breath, split it.

Peeky reads the public pages of your site. For the privacy policy, the checks are EU-08, UK-07 and US-13 in the Handbook.

Questions people ask

What is a privacy statement?

It's the same document as a privacy policy or a privacy notice: the page that tells visitors what you collect, why, who gets it and what they can ask for. The ICO calls it privacy information and says it has to be provided at the time you collect someone's data. The name on the link doesn't matter. What's under it does.

What should a privacy policy include?

Who you are and how to reach you, what you collect, why, who receives it, whether it leaves your country, how long you keep it, what people can ask for, and how they can complain. Article 13 of the GDPR lists these items, and the US lists overlap with them. Add a cookies line if your site sets any.

What are the major privacy laws for a website?

For visitors in the EU it's the GDPR, and for the UK it's the UK GDPR, both built on the same Article 13 list. In the US, CalOPPA asks any commercial website that collects personal information about Californians to post a privacy policy, and the CCPA adds rights and a Do Not Sell or Share link for businesses above its thresholds.

Does a small website need a privacy policy?

If a form on it collects a name or an email address, the EU and UK rules expect the Article 13 information at the point of collection, and CalOPPA expects a posted policy from any commercial website collecting personal information about California residents. The California Attorney General's page says the CCPA itself applies above thresholds, such as gross annual revenue over $25 million, so many small companies sit outside that one law but inside the others.

Is a privacy policy the same as a cookie policy?

No. The privacy policy covers everything you do with personal data; the cookie policy, where you have one, lists what the site stores in the browser and why. Many small sites fold the cookie list into one section of the privacy policy, which is fine as long as it names the tools that run. There's a worked cookie policy template in the Casebook.