There is a version of this page on thousands of small business websites. It was copied from a competitor, or generated in twenty seconds by a free tool, and nobody has read it since. Occasionally you can tell, because it still names the company it was copied from.

It sits in the footer looking like a formality, which is the misunderstanding worth clearing up. A privacy policy is not a page you need for appearances. It is a statement of what you do with other people’s information, and it is enforceable.

What it actually is

Under the General Data Protection Regulation, if you decide why and how personal data gets used, you are a data controller, and you have obligations that do not depend on your size. A one-person business collecting email addresses through a contact form is a controller, exactly like a company of five hundred.

Your privacy policy is how you tell people what you are doing. That is why a copied one is genuinely worse than none at all. It describes somebody else’s practices, so every sentence in it is either irrelevant or untrue about you.

What has to be in there

The essentials are more specific than most people expect. Who you are and how to reach you. What data you collect, and that means actual categories rather than the phrase certain information. Why you collect it, and the lawful basis for each purpose.

Then who you share it with, which includes your payment processor, your hosting, your email platform and anything doing analytics.

How long you keep things, and why. Whether data leaves the European Economic Area and what protects it when it does. The rights people have, and how to exercise them. And the supervisory authority they can complain to, which in Cyprus is the Office of the Commissioner for Personal Data Protection.

The part that catches people out

Your policy has to match reality. If it says you do not use analytics and your site loads Google Analytics on page one, the document is wrong. If it says data stays in the European Union and your mailing list runs on an American platform, the document is wrong.

This is why generated policies drift out of true so quickly. They were accurate on the day they were made, and then somebody added a pixel for an ad campaign and nobody thought to revisit the footer.

Cookies are the clearest example. A policy that lists the cookies you set means nothing if the banner fires analytics before anyone has agreed to them, and that is the default behaviour of most plugins until someone configures them otherwise.

The document and the website have to say the same thing, because a regulator looks at what the site does, not what the footer claims.

The fix is unglamorous. Write down every tool that touches customer data, your payment provider, your host, your mailing list, your analytics, anything running ads, and check the policy names them. Generic is where the trouble starts, because a generic policy describes a business that does not exist.

If you want to check where you stand, the Office of the Commissioner for Personal Data Protection publishes guidance written for businesses operating in Cyprus. It is worth half an hour, not least because it is the same office a customer would complain to if they felt you had mishandled their data.

Lawful basis, in plain terms

This is the part that sounds technical and is not. For each thing you do with personal data, you need a reason the law recognises. Fulfilling an order runs on contract. Keeping tax records runs on legal obligation. Securing your site and preventing fraud usually runs on legitimate interests. Marketing emails run on consent, which is why that unsubscribe link is not optional.

Write them down once and the policy more or less drafts itself, because every section after that is just describing what you already decided.

Someone has to own it

In a small business this usually falls to whoever set the website up, which means it quietly belongs to nobody. Give it to a person by name, even if that person is you, because the obligation does not disappear for being unassigned.

That matters most when a complaint arrives. Someone asking for a copy of their data, or asking you to delete it, triggers a response deadline of one month. Working out who handles that while the clock runs is not a good use of the month.

When to look at it again

Review the policy whenever you add a tool that touches customer data, start selling somewhere new, or change how you handle payments or marketing. In practice, once a year plus whenever the site changes meaningfully is a reasonable rhythm.

Final Thoughts

Nobody reads privacy policies for pleasure, and most customers never open yours. The people who do tend to be a regulator responding to a complaint, a corporate client running a supplier check, or a customer who has become unhappy about something.

All three are reading closely, and all three can tell when a document was never about them.

#GDPR #DataProtection #SmallBusiness #Compliance #PrivacyPolicy #Dizable