Privacy Policy for Websites & Apps
A privacy policy explains what user data you collect, why you collect it, and how you handle it. It isn't just paperwork — it keeps you legally, compliance- and regulatory-safe, and it earns the trust of customers, employees and investors. Nine codes of conduct cover everything a website or mobile-app policy needs.
Executive Summary
protect & build trustA privacy policy sets out the data your site or app receives, why you collect it, and what you do with it — and by law you must disclose this. It rests on nine codes of conduct: the information collected, how you use it, disclosure of personal data, its security, transfer to other countries, the rights of the company and the user, rules for children, grievance redress, and a cookies policy. Implement them and you are secured legally, compliance-wise and regulatory-wise; skip them — especially around children and cookies — and you risk lawsuits, fines and brand damage. A clear policy also builds trust with customers, employees and investors, which drives sales growth. The action: convene senior staff and lawyers to draft and implement it.
Safety + trust + sales
Legal, compliance and regulatory cover on one side; customer, employee and investor trust — and sales growth — on the other.
- Disclosure is the law.
- The children clause shields you.
- No cookies without consent.
Visual Knowledge Map — nine codes of conduct
what to coverInformation collected
Registration, subscription, cookie & logfile data, and info on others.
How you use it
Value, resale or advertising — and why you collect it at all.
Disclosure
State clearly what you'll do with personal data — required by law.
Security
Where servers are hosted, their location, and how data is protected.
Cross-border transfer
Why and how data moves abroad — and the method used.
Rights
Company and user rights — how to retrieve or delete data.
Children
Validity for under-18 and under-13 — the clause that protects you.
Grievances
A legal contact — phone/email — for complaints.
Cookies policy
Explain cookies; never use them without permission.
Core Concepts
key definitionsPrivacy policy
A statement of what data you collect, why, and how you handle it.
Cookies
A code stored in the browser so a return visit is streamlined and personalised.
Cookie tracking
Using cookies to follow a user's browsing across sites.
Personal information
Identifying data such as a mobile number or address.
Disclosure
Telling users plainly what you'll do with their data.
Data security
Protecting hosted data from breach and theft.
Cross-border transfer
Moving user data to servers or offices in another country.
Consent
The user's yes/no permission — required before using cookies.
Frameworks & Models
what/why/how, cookies, payoffWhat, Why, How
What a privacy policy is — the data you receive and store.
Why it matters — legal duty plus the trust it builds.
How to implement it — the nine codes of conduct.
How cookie tracking works
State the transfer method
- A company based abroad moving user data home must state why and how (hard drive, internet, etc.).
- An employee sending data by unsecured email risks it being intercepted…
- …or the file being opened on a shared device — so data leaks to others.
- Always specify the method of transfer.
What a good policy secures
Process Flow — implementing a policy
convene to publishConvene the team
Senior staff + lawyers.
Inventory data
What you collect & store.
Define use & disclosure
Why, and what you'll do.
Set security & transfer
Servers, protection, transfer method.
Rights, kids, cookies
Plus a grievance contact.
Publish & consent
Go live; capture cookie consent.
Relationship Diagram
policy to growthDependencies & Interactions
what depends on whatLegal protection depends on the policy — especially the children clause.
User trust depends on transparency about data.
Using cookies depends on user consent.
Lawful collection depends on clear disclosure.
Safe transfer depends on a secure, stated method.
A sound policy depends on senior staff + lawyers.
Key Takeaways
remember these- State what you collect, why, and how you use it.
- Disclosure of personal data is a legal duty.
- Cover security and the data-transfer method.
- Give users rights to retrieve or delete their data.
- Be explicit about children (under-18 and under-13).
- Provide a grievance contact.
- No cookies without consent.
- A policy earns trust — and trust drives sales.
Revision Sheet
layered recall- Privacy policy = what data, why, how handled.
- Nine codes; children & cookies are critical.
- Secures you legally & builds trust → sales.
- Codes 1–3: data collected; how used; clear, lawful disclosure.
- Codes 4–5: security (servers & location) and how data is transferred abroad.
- Codes 6–7: company/user rights (retrieve/delete); children under 18 and 13.
- Codes 8–9: a legal grievance contact; a cookie policy with consent — or face suits and fines.
Quick Reference Table
code → what to state| # | Code | What your policy must state |
|---|---|---|
| 1 | Information collected | Registration, subscription, cookie and logfile data, and information about other individuals |
| 2 | How you use it | Whether you create value, resell, or run advertising — and why you collect it |
| 3 | Disclosure | Clearly what you'll do with any personal information (a legal requirement) |
| 4 | Security | Hosting servers, their location, and how data is kept safe from breach |
| 5 | Cross-border transfer | Why data is transferred abroad and the method of transfer |
| 6 | Rights | Company and user rights, including how to retrieve or delete data |
| 7 | Children | Whether and why the service is valid for under-18 and under-13 users |
| 8 | Grievances | A legal department contact (phone/email) for complaints |
| 9 | Cookies | How cookies are used — only with the user's permission |
Frequently Asked Questions
common doubtsWhat is a privacy policy?
A statement explaining what user data your website or app receives and stores, why you collect it, and how you handle it — which by law you must disclose.
Why does my business need one?
It keeps you secure legally, compliance-wise and regulatory-wise, and it builds the trust of customers, employees and investors — which drives sales growth.
What are cookies and do I need consent?
Cookies are codes stored in the browser to personalise return visits. You cannot use them without the user's permission, which is why sites ask for a yes/no.
Why is the children clause so important?
Minors under 18 (and especially under 13) are a critical case. Stating clearly whether and why your service applies to them is often the one provision that protects you in a legal dispute.
What must I say about transferring data abroad?
Explain why the data is being transferred and the method used. Insecure transfers — like an unprotected email attachment — can leak data to third parties.
How do I create the policy?
Bring together senior employees and lawyers to draft a policy covering all nine codes, then publish and implement it across your website and apps.
Memory Hooks
make it stickThe three questions a policy answers.
Telling users is mandatory.
Be explicit on under-18 / under-13.
Permission first, always.
Practical Applications
putting it to workList the data you hold
Map registration, subscription, cookie and logfile data, then justify why each is collected and drop anything unnecessary.
Say what you'll do
State plainly how personal data is used — value, resale or advertising — to meet your legal disclosure duty.
Lock down storage & transfer
Name where servers are hosted, protect against breach, and define a secure method for any cross-border transfer.
Honour user rights
Give users a clear way to retrieve their data or delete their account, and set out both parties' rights.
Write the children clause
State whether and why the service is valid for under-18 and under-13 users — the clause that shields you in court.
Open a grievance channel & cookies
Publish a legal contact for complaints and a cookie policy that takes consent before any tracking.