Privacy policy for websites

Few entrepreneurs take into account the problems of Internet privacy policies when they create their web pages. However, with the approval of the GDPR (RGPD), that will have to change if they want to do business on the Internet.

In this article we will detail the elements of a satisfactory privacy policy and offer a free template at the end so you can start creating your own agreement.

Basic points of an Internet privacy policy

First, let's look at basic information about the privacy policy of a website.

What type of web needs a privacy policy?

Any web or service that collects information from its users, performs analytics of its users or shows ads needs to have one. If the business is located in the European Union or you plan to do business with EU citizens, you will have to make sure that your privacy policy complies with the standards of the GDPR law.

Why are these policies necessary?

Your privacy policy explains to users:

• What information do you collect?
• How you collect the information
• How you guard and protect the information

Is there a difference between the types of information that are collected?

Yes. Most policies separate personally identifiable information from non-private data.

The National Institute of Standards and Technology (NIST) defines personally identifiable information such as:

«Any information about an individual who has an agency, including  any information that can be used to identify or trace the identity of an individual, such as name, social security number, place and date of birth, maiden name of the mother or biometric records; and any other information linked or linked to an individual, such as medical, educational, financial or employment information. »

Non-private data is defined as follows:

«Information that may correspond to a specific person, account or profile but is not sufficient to identify, contact or locate the person to whom the information refers.»

Examples include:

• Type of browser
• Information about browser plugins
• Local time zone
• Date and time of the requests of each visitor (eg: arrival, departure of each web page)
• Language preference
• Web from which you came to the website in question
• Type of device (desktop computer, laptop, smartphone)
• Screen size, color depth of the screen and system fonts

Many users who are concerned about sharing this non-private data use browser extensions to hide their availability. In addition, VPNs  help not to share certain types of non-private data. For example, a VPN can mask the time of the visit to the web as well as the visitor's local time zone. 

Are there legal consequences if I do not publish a privacy policy?

Yes. Collecting data without informing users of the activity is punishable by law. You also run the risk if you violate the terms of your policy by collecting more than you have reported or modify the collection / use of the data without updating the policy.

Websites that do not comply with the GDPR law  can suffer fines of up to 20 million Euros or 4% of their global income.

Privacy policy templates - free

Due to its length and complexity, most privacy policies are not usually read. In fact, a study found that they tend to be so complex that it would take the average citizen 30 full days to read the privacy policies of the websites they visit in a year.

One of the changes that web owners must make in order for their privacy policy to comply with the GDPR law is to reduce it, making it concise and easy to understand.

As complex as they may be, they also inform the main Internet concerns of many users: information security, protection against fraud and personal privacy. Since Internet consumers are becoming more aware of privacy issues, it is in the best interests of web owners to make their privacy policy as clear and concise as possible. In the following analysis we detail the most important sections of these agreements and offer a template in understandable language that avoids legal jargon.

# 1: Gathering information

Every policy should explicitly describe what information the web and its methods collect, and what will happen to the information.

# 2: Use of information

After detailing the collection of information, the policies should describe how the owners of the website use it. Facebook had problems with this message when it wanted to update its privacy policy in 2013: the company wanted to expand its policy so that it could use personal information of its members, including children under 18, for advertising purposes.

Facebook eventually abandoned the idea when control bodies informed the Federal Trade Commission of this. In 2014, Facebook released a version of its policy written in plain English, which cut legal jargon by two-thirds.

The companies (and their websites) that take the security of your information seriously:

• Never sell personally identifiable information to third parties
• Anonymize and / or encrypt information to protect against possible leaks
• They only store the information for a short period of time

# 3: Considerations of e-Commerce

For e-Commerce or online sales websites, the policy should detail the security measures on the private financial information of the users collected to process transactions. This includes credit card numbers, social security numbers or bank account information.

# 4: Disclosure of information to third parties

The relationship (s) of the web with third parties should be written in a clear and understandable language. Ideally, your website does not sell or share personally identifiable information unless there is a determining legal reason, and must also detail what your company does with non-private data.

# 5: Security and information monitoring

The best privacy policies of today highlight the security of your information and the use of cookies.

Google suffered problems with its privacy policy last year due to its disclosure of cookies. The Information Commissioner's Office of the United Kingdom forced the Internet giant to include information on who could collect "anonymous identifiers" (which are similar to cookies) and the purpose for which the company used that information .

# 6: Unsubscribe methods

All privacy policies must show how a customer can cancel their subscription to unwanted communications.

# 7: Consent

The standard Internet privacy policy states that users claim to agree with the policy simply by using the web. In addition, the policy must explain the rights of the individual, such as sending those to send a request to delete or modify part of the information and / or see the information that has been collected from him / her.

Summary: Your online privacy policy increases user confidence

Your privacy policy offers valuable protection to your company and your users, but most importantly: it creates a higher level of trust. By presenting concise policies and written in simple language that describe specific protections, your website will have an advantage over competitors with complex and confusing policies.

Note: the language of the template offered in this article should only be taken as a starting point. Each website has different methods and intentions, and the best privacy policies reflect a high level of personalization. To ensure the effectiveness of your policy, consult the subject with specialized lawyers and investigate the policies of companies similar to yours. But the most important thing is to keep checking out www.vpnmentor.com  for more information about privacy policy language and privacy issues!