Privacy Policy and Terms for Business Websites: What to Include

A privacy policy is the page on a website that tells visitors what personal data the business collects, why it collects it, how long it keeps it and what rights people have. Almost every business website needs one, because almost every business website collects something: a name in a contact form, an email address in a newsletter box, an IP address in a server log or an identifier in an analytics tool. Alongside it, many sites publish terms and conditions, which describe the rules of using the site or buying from it. The two documents do different jobs, they are often confused, and both are commonly copied from a stranger’s website with the wrong company name still inside.

This guide explains what each document is for, what a good privacy policy contains, what terms usually cover for services and for online sales, how to keep the documents true to what your site really does, and how to maintain them over time. It is practical guidance for business owners, not legal advice. The exact duties depend on your country, your sector and the data you handle, so have a qualified lawyer review the final texts, especially if you sell to consumers or process sensitive data.

Two Documents, Two Purposes

The privacy policy is about information. Under European data protection rules, a business that collects personal data must tell people who it is, what it does with the data, on what legal basis, with whom it shares it, how long it keeps it and how they can exercise their rights. The obligation to inform exists whether or not a policy page is the chosen format, but a clear page linked from every form and from the footer is the normal way to deliver it. The overview of the rules on the European Commission data protection page gives the official starting point.

Terms and conditions are about the relationship. They set out the agreed rules for using the website, buying a product or hiring a service: what you provide, what the customer pays, how and when, what happens if something goes wrong, which law applies and how disputes are handled. They are a contract document, and for consumers they are limited by mandatory consumer protection rules that a business cannot override.

What a Good Privacy Policy Contains

A policy should be written for a visitor, not for a regulator, while still covering the points the rules expect. The following elements form a solid checklist.

1. Who you are. The full legal name of the company, its registered address and a working contact email. If a data protection officer is appointed, add their contact details.
2. What data you collect. List categories in plain words: contact details from forms, order and payment details, account data, messages, technical data such as IP address and browser type, and information collected by cookies or similar tools.
3. Why and on what basis. For each purpose, name the reason and the legal basis: performing a contract, a legal obligation, a legitimate interest that you explain, or consent. Do not list every basis for every purpose. A table that matches purpose to basis is easier to read.
4. Who receives it. Name the types of recipients: hosting and email providers, payment processors, analytics and advertising providers, couriers and accountants. Say whether data is transferred outside the European Economic Area and what safeguard applies.
5. How long you keep it. Give concrete periods or the criteria for deciding them, such as accounting rules for invoices or a fixed period for unanswered enquiries.
6. Rights of the person. Access, correction, deletion, restriction, objection, portability and the right to withdraw consent, plus how to exercise them and the right to complain to the supervisory authority.
7. Cookies and tracking. Either describe them or link to a separate cookie notice. Our guide to cookie consent and website privacy compliance explains what the banner and the notice must do.
8. Automated decisions. If anything makes decisions about people without human review, explain it. For most small sites, the honest statement is that none does.
9. Updates. The date of the latest version and how you announce material changes.

The most important quality is accuracy. A short policy that matches reality beats a long one that describes tools you do not use and misses the ones you do.

Start From a Data Map, Not a Template

Before writing a word, find out what the site really does. The simplest way is a one-page inventory that anyone on the team can fill in.

1. List every place data enters. Contact forms, newsletter boxes, quote requests, checkout, account registration, live chat, comment sections, job applications, file uploads and booking tools.
2. List every tool that receives it. The email service, the customer database, the analytics tool, advertising pixels, chat widgets, embedded maps, video players and font services.
3. Note where each tool is located and who runs it. This determines the recipients and the transfer information.
4. Note how long the data stays. Check the retention settings in each tool, not only the policy you intend to write.
5. Decide who answers requests. A named person or a shared mailbox, with a rule about the response time.

This map also prepares you for tasks that come later, such as answering a request from a customer to see their data, or reviewing a new plugin. Third-party scripts are a frequent source of surprise, and our article on third-party scripts shows how to find the ones your pages load without anyone remembering adding them.

Common Forms and Tools That Need a Line in the Policy

• Contact and quote forms. Say that you use the details to reply, how long you keep unanswered requests and where the form data is stored. Our guide to web form design also argues for collecting fewer fields, which makes the policy shorter as well.
• Newsletters. State that sending requires consent, how to withdraw it and which service delivers the emails. The article on email marketing compliance covers the sender rules.
• Analytics. Name the tool, say what it measures and whether it uses cookies. A cookie-free tool may need less, and the article on privacy-friendly website analytics explains the choice.
• Live chat. Conversations contain whatever visitors choose to type, so describe retention and who can read the transcripts.
• Advertising pixels. Describe the tool, the purpose and the consent mechanism, because these usually need prior agreement.
• Payments. Explain that the payment provider handles card data and that you receive only the confirmation and limited details.
• Recruitment. If the site accepts applications, state how long CVs are kept and who sees them.

What Terms and Conditions Usually Cover

The right content depends on what you sell. A service business that quotes each job needs different terms from an online shop, and a website with only information needs very little. A typical set contains the following parts.

For Services

• A clear description of the service and what is excluded.
• How quotes work, how long they remain valid and how changes are priced.
• Payment schedule, invoicing, late payment and the treatment of deposits.
• The customer’s obligations, such as providing access, content and decisions on time.
• Ownership of work product and licences, with the point at which rights pass.
• Confidentiality, limits of liability and termination.
• Governing law and the place for disputes.

For Online Sales to Consumers

• Total price including taxes and delivery costs, shown before the customer commits.
• Payment methods, delivery times and what happens when an item is unavailable.
• The right of withdrawal, how to use it and the return process, including a withdrawal form where required.
• Legal guarantees for faulty goods, which cannot be removed by the terms.
• Complaint handling and information about out-of-court dispute resolution where applicable.
• Identity, address and contact details of the seller.

Pages for shipping and returns also deserve clear wording, and our article on shipping and returns pages shows how to present them so that customers read them. The European Commission consumer protection page summarises the mandatory rules. Consumer protection rules in the European Union give people rights that no clause can take away, so a term that claims the opposite is not only useless but may count against you.

Acceptance and Proof

A document that nobody agreed to is a weak contract. For terms, make acceptance an active step: a checkbox that is not pre-ticked, or a button whose label says that the order creates an obligation to pay, with a visible link to the terms next to it. Keep a record of the version the customer accepted, with a date. For privacy, you do not usually need a tick box, but you must make the information available before the data is collected, which means a link beside the form and not only in the footer.

Keep dated versions. When you change the policy, store the old text and the date it was replaced, so that you can show what applied at the time a customer joined or ordered. A simple archive page or an internal folder is enough.

Keeping the Documents True

Policies fail because the site changes and the text does not. A new plugin starts collecting data, a marketing tool is added, an email provider is swapped, and the policy still describes last year’s setup. Build a few habits that prevent that.

• Add a line to the launch checklist. Whenever a new form, tool or integration goes live, someone checks whether the policy needs a change. Our website launch checklist is a good place for this item.
• Review twice a year. Compare the data map with the policy. Tick off each tool and each retention period.
• Give one person ownership. Without a named owner, nobody updates it.
• Test the rights process. Send yourself a mock request and see how long it takes to find the data.
• Link to the policy in the right places. Footer, cookie banner, forms, checkout, account creation and email footers.

Mistakes That Make Documents Worse Than Nothing

• Copying a competitor’s text. It describes their tools, their country and their company, and it may be protected by copyright as well.
• Listing tools you do not use. It frightens readers and hides the real ones.
• Promising what you cannot deliver. A claim such as “we never share data” is untrue if a payment processor, a host or an email service handles it for you.
• Burying the text in legal fog. Visitors should be able to understand it without a dictionary. Short sentences and headings help.
• Using one document for everything. Combining privacy, cookies and sale terms into a single wall of text makes each part harder to find and update.
• Forgetting the cookie banner link. A banner without a route to the notice does not give the information it promises.
• Leaving the date off. Readers and authorities want to see how current the document is.

A Worked Example

A small design studio sells fixed-price website packages to other businesses and runs a blog with a newsletter. The owner makes a one-page data map and finds six entry points: a contact form, a quote request form, a newsletter box, a live chat widget, a job application page and the blog comments. Four tools receive the data: the website host, an email service, a customer database and an analytics tool with cookies disabled.

The policy is rewritten around that list. It names the company and address, explains the purpose and legal basis for each entry point in a table, lists the four recipients by type, gives retention periods of twelve months for unanswered enquiries and six years for invoices, and explains rights and the contact address. A separate cookie notice describes the consent banner. The terms are limited to a short document for package sales, which says what each package includes, how change requests are priced, when payment is due, who owns the finished work and which law applies. A lawyer reviews both documents once, and the owner adds the policy check to the launch list for every new tool. Six months later, when a feedback widget is added, the policy is updated before the widget goes live, and the archive records the change.

When to Involve a Professional

A template can start the work, but some situations call for a lawyer. Seek advice if you sell to consumers in several countries, process health, financial or children’s data, run profiling or large-scale tracking, transfer data to countries outside the European Economic Area, operate a marketplace or accept user-generated content in volume. For websites that we build, our website development team prepares the technical side, such as forms, consent tools and links, and the final legal wording stays with the client’s adviser.

Frequently Asked Questions

Does a small business website really need a privacy policy?

If it collects any personal data, including a name and email in a contact form or an IP address in an analytics tool, then yes. Under European rules, you must tell people how the data is used, and a policy page is the standard way to do so.

Can I use a free generator or template?

You can use it as a first draft, but you must adapt it to your actual data and tools. Remove sections that do not apply, add the ones that do and have a lawyer review the final text if the stakes are high.

Do I need terms and conditions if I do not sell online?

Not always. Sites that only present information need very little. Once you take orders, bookings or payments, or offer a service under conditions, written terms protect both sides and are strongly advisable.

Where should I link the privacy policy?

In the footer of every page, next to every form that collects data, in the cookie banner, on the account creation page and in the footer of marketing emails. It should be reachable in one click from any point of data collection.

How often should I update it?

Whenever your data practices change, and at least a couple of times a year as a check. Record the date of each version and keep the old ones.

Can I write the documents in English only?

If you address customers in other languages, provide the information in a language they understand. For consumers in particular, rules may require local language versions of key terms, so check the requirements of the countries you sell to.

The Bottom Line

A privacy policy explains how your site handles personal data, and terms and conditions set the rules of the sale or service. Build them from a real inventory of forms and tools, write them in plain language, link them where data is collected and where orders are placed, and keep dated versions. Review them whenever the site changes, assign an owner and ask a qualified lawyer to check the final wording where the stakes or the markets warrant it. A short, accurate pair of documents earns more trust than a long copied one.