Free UK privacy notice template for small businesses

Privacy notice

Last updated: [date]

This notice explains how [organisation name] uses your personal information, and your rights.

Who we are

[Organisation name] ([for a company: company number [number], registered office [address]]) is the controller of your personal information. You can contact us about anything in this notice at [privacy@yourdomain] or [postal address]. [If you have a Data Protection Officer: Our Data Protection Officer can be contacted at [dpo@yourdomain].]

What we collect and why

[List each thing you do with personal information, what information it involves, and the lawful basis. A table works well. For example:]

• [To process and deliver your order: your name, address, email and phone number. Lawful basis: contract.]
• [To answer your enquiry: your name, contact details and message. Lawful basis: legitimate interests, in replying to people who contact us.]
• [To send you our newsletter: your email address. Lawful basis: consent, or for existing customers, the soft opt-in.]
• [To keep financial records: order and payment details. Lawful basis: legal obligation.]

[If you rely on legitimate interests, say what the interest is, as in the example above.]

Who we share it with

We share your information only where we need to, with: [types of recipient, for example our delivery company, our payment provider, our website host, our email marketing service and our accountant]. [Name the tools on your website that collect visitor information, for example your analytics and advertising tools.] We do not sell your information.

Sending information outside the UK

[If any of your suppliers are outside the UK: Some of our suppliers are based in [countries]. Where this happens we rely on [UK adequacy regulations / the International Data Transfer Agreement / the UK Extension to the EU-US Data Privacy Framework, for certified suppliers] to protect your information.] [If nothing leaves the UK, say so.]

How long we keep it

[Give a period or the criteria for each type of record, for example: We keep order records for [period] for tax purposes. We delete enquiries [period] after our last contact.]

Cookies and similar technologies

[Say what your website stores on or reads from visitors' devices, or link to your cookie policy: See our cookie policy at [link].]

Do you have to give us your information?

[Explain when it is required, for example: We need your address to deliver your order. If you do not give it, we cannot complete your purchase. Everything else is optional.]

[Only if it applies: Automated decisions]

[If you make significant decisions about people automatically, with no meaningful human involvement: describe the decision, how it works in plain words, and what it means for the person. Explain that they can make representations, ask for a person to review the decision, and contest it.]

Your rights

You have the right to ask for a copy of the information we hold about you (the right of access), and to ask us to correct it, delete it, or restrict how we use it. You can object to us using it, including for direct marketing at any time. Where we rely on your consent you can withdraw it at any time, for example by using the unsubscribe link in our emails. Where we hold information you gave us on the basis of consent or a contract, you can ask for it in a reusable format (data portability). To use any of these rights, contact us at [privacy@yourdomain].

Complaints

If you are unhappy with how we have handled your personal information, you have the right to complain to us. Contact [privacy@yourdomain] or see our complaints procedure at [link]. We will acknowledge your complaint within 30 days.

You also have the right to complain to the UK data protection regulator, the Information Commission (formerly the Information Commissioner's Office). [Add its current website.]

Changes to this notice

We review this notice regularly. If we plan to use your information for a new purpose, we will tell you before we do.