Privacy Policy Examples for UK Businesses: What Should You Include?

Oct 8

6 min read

If your business has a website, collects customer details or runs any kind of online marketing, there's a good chance you need a privacy policy. The tricky bit is working out what it should actually say, because most of the examples you find online are either written for American companies or so generic they don't describe how your business really works.

A privacy policy explains what personal information your business collects, why you collect it, how you use it and what rights people have over it. Every business is different, but there are a handful of sections that turn up in almost every UK business privacy policy, and a few areas that catch people out once they start advertising.

Do you actually need one?

Short answer, probably yes. If you collect any personal data at all, and that includes something as simple as a name and email address through a contact form, then UK GDPR expects you to tell people what you're doing with it. That covers most businesses with a website.

It's worth saying that a privacy policy isn't just a legal box to tick. If somebody is about to hand over their details, a clear policy is one of the small things that makes a business look like it knows what it's doing. The businesses that get this wrong tend to be the ones who copied something off another website three years ago and haven't looked at it since.

What information do you collect?

Start by explaining the types of personal data your business might collect. For most businesses that's some combination of:

Names
Email addresses
Telephone numbers
Billing or delivery addresses
Enquiry details
IP addresses and website usage data
Marketing preferences
Payment information

Only list what you actually collect. There's no benefit in padding this out with things that don't apply to you, and it makes the policy harder to keep accurate.

How do you collect it?

People give you information in more ways than you'd think, so it's worth setting out where it comes from. Somebody might complete a contact form, place an order, sign up to your newsletter, book a consultation, submit a lead form through Facebook or Instagram, or just get in touch by phone, WhatsApp or email.

That last group catches people out. If you're running lead generation ads, the data comes to you through Meta or Google before it ever touches your website, and your policy should reflect that.

Why are you using the data?

Your policy should explain the reasons you process personal information. Common ones include responding to enquiries, processing orders, delivering a service, sending appointment reminders, sending marketing, improving your website, measuring advertising performance and meeting legal or accounting obligations.

You'll also need to think about the lawful basis for each of those under UK GDPR. Marketing emails and enquiry handling usually sit on different bases, and it's worth getting that right rather than lumping everything together.

Who else sees it?

Almost every business uses third party platforms somewhere, and customers are entitled to know when their information passes through them. That might be your website provider, payment processor, email platform, CRM, delivery company, analytics or advertising platforms.

This is the section that most often goes out of date. A business running Meta Ads and Google Ads will be using tracking technology to understand what visitors do on the site, and that needs to be covered. Same goes for anything you've plugged in to automate your lead follow up. If you added a tool six months ago and never revisited the policy, it's probably out of step.

How long do you keep it?

Personal information shouldn't sit in your systems forever without a reason. Your policy should either state how long you keep things, or explain how you decide. Different types of information will warrant different periods, so an enquiry that went nowhere two years ago isn't the same as an invoice you need to keep for tax purposes.

What rights do people have?

Under UK data protection rules, individuals have a number of rights over their information. Depending on the circumstances those can include the right to access what you hold, correct anything inaccurate, request deletion, restrict how you use it, object to certain uses and withdraw consent.

You should also tell people how to get in touch if they want to use any of those rights, and make sure that route actually works. A privacy email address that nobody checks is worse than not having one.

A simple structure to follow

If you want a straightforward layout to work from, something like this covers most businesses:

Who we are. The business name and how to contact you.
Information we collect. What personal data you may hold.
How we collect it. The different routes people give you their details.
How we use it. Your reasons for processing, and the lawful basis.
Sharing information. Which providers or organisations may process it.
Data retention. How long you keep things, or how you decide.
Your rights. What people can ask you to do.
Cookies and website tracking. Analytics, pixels and advertising technology.
Contact details. How to raise a privacy question or complaint.

You can see how that works in practice on the Moduli privacy policy, which follows roughly the same shape.

Don't just copy somebody else's

It's tempting to find a policy you like the look of, swap the business name and paste it onto your site. I'd avoid it, mainly because it rarely describes what your business actually does.

An ecommerce store taking online payments has a completely different setup to a local tradesperson collecting enquiries through a contact form. One is processing card data through a payment provider and shipping addresses through a courier, the other probably isn't doing either. If your policy describes systems you don't use and misses the ones you do, it isn't doing its job.

The other problem is that copied policies tend to be the ones that never get updated, because nobody really understands what's in them.

The bit most businesses miss: cookies and tracking

If your website uses Google Analytics, the Meta Pixel, Google Ads conversion tracking or anything similar, cookies are a separate consideration from your privacy policy. Depending on what's running, your site will usually need a cookie notice and a consent mechanism, not just a paragraph buried in the policy.

This is the area that changes most often, because it changes every time you add a marketing tool. Install a pixel for a campaign, add a chat widget, connect a new booking system, and your cookie setup has quietly moved on without the policy catching up.

A reasonable habit is to revisit your privacy and cookie policies whenever you add a new marketing platform, CRM or analytics tool. It takes ten minutes and it saves you finding out the hard way. If you're having your website built or refreshed, that's the natural point to get it sorted properly rather than bolting it on afterwards.

Frequently asked questions

Do I need a privacy policy if I only have a contact form? Most likely yes. A contact form collects personal data, which means people should be told what happens to it. The policy can be short, it just needs to be accurate.

Is a privacy policy the same as a cookie policy? No. The privacy policy covers personal information generally. The cookie policy covers what your website stores on somebody's device and usually needs its own consent banner. Plenty of businesses combine them into one page, which is fine, but both areas need covering.

Do I need one if I only advertise on Facebook and don't have a website? If you're collecting enquiries through lead forms, you're collecting personal data, so yes. Meta also requires a privacy policy link on lead generation forms before they'll run.

How often should I update it? Whenever something changes in how you collect or use data. In practice that usually means whenever you add a new marketing tool, CRM, analytics platform or email marketing system.

Can I write it myself? A lot of small businesses do, and for a simple setup that's often fine. If you're processing payments, handling sensitive data or operating at any scale, it's worth getting proper advice rather than guessing.

Where to start

If your policy hasn't been looked at since the site went live, the quickest win is to list every tool currently connected to your website and your marketing, then check whether each one appears in the policy. Most of the gaps show up straight away.

If you'd like a hand working out what your website and tracking setup is actually doing, get in touch and I'll take a look.