# Privacy Notice

**Version:** [VERSION]  
**Effective date:** [EFFECTIVE_DATE]

## 1. Who We Are

[COMPANY_NAME] operates [DOMAIN] and the service described below:

[SERVICE_DESCRIPTION]

For the processing described in this notice, our role has been assessed as:
**[PROCESSING_ROLE]**. A service may act in different roles for different
processing activities; explain those distinctions where relevant.

**Contact**

- Privacy/legal email: [CONTACT_EMAIL]
- Postal address: [COMPANY_ADDRESS]
- Website: [DOMAIN]
- EU/UK representative, if legally required: [GDPR_REP_EMAIL]

## 2. Scope

This notice applies to the people, products, websites, applications, and
processing activities listed here:

[[REVIEW: IDENTIFY THE PEOPLE, SERVICES, DOMAINS, APPS, AND PROCESSING ACTIVITIES IN SCOPE, PLUS MATERIAL EXCLUSIONS]]

If we process customer-submitted personal data only on a business customer's
instructions, the customer's privacy notice may govern that activity and our
Data Processing Agreement may describe our processor obligations.

## 3. Personal Data We Process

The table must reflect actual data flows, including data supplied by users,
created by the service, received from customers or partners, and collected from
devices or public sources.

[DATA_INVENTORY_TABLE]

Do not use broad categories such as “any information you provide” when the
actual categories can be identified. State whether providing particular data is
required and what happens if it is not provided.

## 4. Why We Process Personal Data

Describe each distinct purpose. Where a law requires a legal basis or other
condition, identify the basis that actually applies and document the supporting
assessment outside this notice.

[PROCESSING_PURPOSE_TABLE]

Do not claim consent when the product does not obtain a valid, specific choice.
Do not claim legitimate interests without identifying the interest, necessity,
and balancing assessment. Contract necessity is narrower than general business
convenience.

## 5. Cookies and Similar Technologies

We use the technologies described in our cookie notice and inventory:
[DOMAIN]/cookies

Nonessential technologies must not load before a valid choice where prior
consent is required. Users must be able to revisit and withdraw their choice as
easily as they gave it. Cookie/preference settings: [COOKIE_SETTINGS_URL]

## 6. Vendors, Subprocessors, and Other Recipients

We disclose personal data only as described below and in our contracts and data
maps. Classify each recipient accurately—for example, processor/service
provider, independent controller, joint controller, or other third party.

[VENDOR_TABLE]

Also describe any disclosure to affiliates, professional advisers, authorities,
business-transfer counterparties, or other recipients only when it actually
occurs and the wording is legally appropriate.

## 7. California Disclosures

Publish this section only after assessing whether California law applies and
whether any practice constitutes a sale, sharing, or use/disclosure of sensitive
personal information subject to limitation rights.

[CALIFORNIA_DISCLOSURE]

Where an opt-out obligation applies, implement the required frictionless method
and applicable opt-out preference signals, including Global Privacy Control,
before asserting that the service honors them. The notice must also include the
required look-back-period categories, purposes, sources, and recipient
categories.

## 8. International Transfers

[TRANSFER_DETAILS]

Identify actual origin and destination countries, recipient roles, and transfer
mechanisms. Do not state that Standard Contractual Clauses, adequacy, the
EU-U.S. Data Privacy Framework, the UK Extension, or another mechanism applies
unless it has been verified for the relevant transfer and entities. Document any
required transfer-risk assessment and supplementary measures.

## 9. Retention and Deletion

[RETENTION_SCHEDULE]

State category-specific criteria or periods for production systems, logs,
support tools, analytics, legal/accounting records, backups, and vendor copies.
Explain account deletion, legal holds, dispute preservation, anonymization, and
backup expiry accurately. Do not use one arbitrary period for all data.

## 10. Privacy Choices and Rights

Rights vary by location and processing activity. Describe only rights and appeal
mechanisms that apply, while preserving any broader rights the company chooses
to offer.

[RIGHTS_REQUEST_PROCESS]

Explain available methods, identity/authority verification, authorized agents,
appeals, response timing, fees or refusals permitted by law, and how to lodge a
complaint with the appropriate regulator. Collect only information reasonably
necessary to handle the request.

Marketing preferences, cookie choices, account deletion, and sale/share opt-out
may require different workflows. Link each implemented method directly.

## 11. Children and Age-Restricted Use

[CHILDREN_POSITION]

Minimum age: [MIN_AGE]

Do not rely on boilerplate age language. Confirm the intended audience, age
screening, actual knowledge, parental-consent design, app-store classification,
and applicable children's-privacy laws before publication.

## 12. Security

We use the verified controls summarized below:

[SECURITY_SUMMARY]

Describe controls at an appropriate level without exposing exploitable details
or promising absolute security. The summary must align with customer contracts,
security documentation, actual architecture, and vendor responsibilities.

## 13. Automated Decision-Making and AI

[[REVIEW: DISCLOSE MATERIAL PROFILING, AUTOMATED DECISIONS, GENERATIVE-AI DATA USE, MODEL PROVIDERS, HUMAN REVIEW, TRAINING/RETENTION CHOICES, AND AVAILABLE RIGHTS IF RELEVANT; OTHERWISE REMOVE THIS SECTION]]

## 14. Changes to This Notice

State how material changes are assessed, versioned, communicated, and made
effective. Do not promise email notice unless the company can reliably provide
it and the applicable law or contract requires or supports that method.

[[REVIEW: INSERT THE ACTUAL NOTICE-OF-CHANGES PROCESS]]

## 15. Contact and Complaints

Questions or requests may be sent to:

- Email: [CONTACT_EMAIL]
- Address: [COMPANY_ADDRESS]
- Rights-request method: [RIGHTS_REQUEST_PROCESS]

[[REVIEW: ADD THE RELEVANT DATA PROTECTION OFFICER, REPRESENTATIVE, REGULATOR, AND APPEAL/COMPLAINT INFORMATION IF REQUIRED]]