Last updated: 1 August 2026. This is a template. Before publishing, have it reviewed against the law in your jurisdiction and replace every placeholder in bold.
1. Who we are
[Company legal name], registered at [registered address], company number [number], is the data controller for the personal data described in this policy. Data protection contact: [privacy@example.com].
2. What we collect
- Information you give us — name, email, phone, company and anything you write in a message or brief.
- Information collected automatically — IP address, browser and device type, pages visited, referring page. Collected through our analytics provider.
- Information from clients — during a project we may process data belonging to your customers. In that case you are the controller and we are the processor, governed by a separate agreement.
3. Why we process it
- To answer your enquiry — legal basis: steps taken at your request before entering a contract.
- To deliver a project — legal basis: performance of a contract.
- To improve the site — legal basis: legitimate interest, limited to aggregated analytics.
- To send you a newsletter — legal basis: your consent, withdrawable at any time.
- To meet accounting obligations — legal basis: legal obligation.
4. How long we keep it
- Enquiries that do not become projects: 24 months.
- Client project records: 7 years after the final invoice, for accounting.
- Newsletter subscriptions: until you unsubscribe.
- Analytics data: 14 months.
5. Who we share it with
We do not sell personal data. We share it only with processors necessary to operate: our hosting provider, email provider, analytics provider and accountant. Each is bound by a data processing agreement. [List your actual providers here.]
6. International transfers
Some providers are located outside [your region]. Where that happens, transfers rely on [standard contractual clauses / adequacy decision].
7. Your rights
You may request access to your data, correction, deletion, restriction of processing, portability, or object to processing based on legitimate interest. You may also withdraw consent at any time. Write to [privacy@example.com] and we will respond within thirty days.
If you are unsatisfied you may complain to your supervisory authority: [name and link].
8. Cookies
We use strictly necessary cookies to make the site work, and analytics cookies only after you consent. You can change your choice at any time through the cookie settings link in the footer. [Adjust to match what your site actually sets.]
9. Security
Encryption in transit, access limited to staff who need it, credentials rotated after each project handover. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authority as required by law.
10. Children
Our services are not directed at anyone under 16 and we do not knowingly collect their data.
11. Changes
Material changes will be announced on this page with an updated date. Continued use after a change means you accept the updated policy.
