# Privacy Policy — small business website template
## GDPR Articles 13 & 14 · ready to adapt

> Replace every [bracketed] field. Delete anything that does not apply to you.
> This template is a starting point and does not constitute legal advice.

---

**[Company name]**, [address], is the data controller for personal data
processed via [website URL]. Contact: [email]. Data protection contact: [name/email or "none appointed"].

## 1. What we process and why

| Purpose | Data | Lawful basis | Retention |
|---|---|---|---|
| Responding to contact enquiries | Name, email, message | Legitimate interests (Art. 6(1)(f)) — answering your request | 12 months |
| Newsletter | Email, signup date | Consent (Art. 6(1)(a)) — unsubscribe anytime | Until withdrawal + 30 days |
| Website analytics | Pseudonymised IP, pages viewed | Legitimate interests (Art. 6(1)(f)) — improving the site; cookie consent where required | 14 months |
| Invoicing and accounting | Name, address, billing details | Legal obligation (Art. 6(1)(c)) — bookkeeping law | [5 years / per local law] |

## 2. Recipients
We share data only with processors bound by data processing agreements:
[hosting provider], [email service], [analytics provider], [accountant].
We never sell personal data.

## 3. Transfers outside the EU/EEA
[None / e.g. "Our email provider may process data in the US under the EU-US
Data Privacy Framework" or "using Standard Contractual Clauses"].

## 4. Your rights
You may request access, rectification, erasure, restriction, portability of
your data, and object to processing based on legitimate interests. Withdraw
consent at any time (this does not affect earlier lawful processing).
Contact [email] to exercise your rights.

## 5. Complaints
You may lodge a complaint with your national supervisory authority:
[Datatilsynet / ICO / your local DPA, with link].

## 6. Cookies
See our [cookie notice / banner settings] for the full list and to change
your consent at any time.

## 7. Security
We protect your data with TLS encryption, access controls and
[2FA / encrypted backups — adjust to reality].

Last updated: [date]

---
*Free template from https://hermes-passiv.pages.dev/privacy-policy-template —
generate a version matched to your exact processing purposes at
/privacy-notice-generator.*