# Privacy Notice / Privacy Policy Template

## Legal Basis
Arts. 13–14 (information to be provided), Art. 12 (transparent communication).
Art. 13 applies when data collected directly from subject; Art. 14 when collected indirectly.

---

## Required Sections (Art. 13/14 Checklist)

### 1. Identity and Contact Details of the Controller (Art. 13(1)(a))
> **[ORGANISATION NAME]** ("we", "us", "our")
> Registered address: [ADDRESS]
> Email: [PRIVACY@EMAIL.COM]

### 2. DPO Contact Details (Art. 13(1)(b)) — if applicable
> Our Data Protection Officer can be contacted at: [DPO EMAIL / ADDRESS]

### 3. Purposes and Lawful Basis (Art. 13(1)(c))
For each processing activity, state both purpose AND lawful basis:

| Purpose | Personal Data | Lawful Basis (Art. 6) |
|---------|--------------|----------------------|
| [e.g. Account creation] | [Name, email] | Contract (Art. 6(1)(b)) |
| [e.g. Marketing emails] | [Email, preferences] | Consent (Art. 6(1)(a)) |
| [e.g. Fraud prevention] | [Transaction data] | Legitimate interests (Art. 6(1)(f)) |

Where legitimate interests is relied upon, summarise the LIA outcome.

### 4. Legitimate Interests (Art. 13(1)(d)) — where applicable
> We process [DATA] for [PURPOSE] based on our legitimate interest in [INTEREST]. We have
> assessed that this interest is not overridden by your rights and interests because [REASON].

### 5. Recipients or Categories of Recipients (Art. 13(1)(e))
> We share your personal data with:
> - [SERVICE PROVIDER / PROCESSOR NAME]: for [PURPOSE], located in [COUNTRY]
> - [ANALYTICS PROVIDER]: for [PURPOSE]
> We do not sell your personal data to third parties.

### 6. International Transfers (Art. 13(1)(f))
> Where we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place,
> including: [Adequacy decision / Standard Contractual Clauses (SCCs) / BCRs — Art. 46].
> Details available on request.

### 7. Retention Period (Art. 13(2)(a))
> We retain your personal data for [PERIOD / criteria used to determine period].
> See our Retention Schedule for full details.

### 8. Data Subject Rights (Art. 13(2)(b))
> You have the right to:
> - **Access** your data (Art. 15) — request a copy of data we hold about you
> - **Rectification** of inaccurate data (Art. 16)
> - **Erasure** ("right to be forgotten") in certain circumstances (Art. 17)
> - **Restrict** our processing in certain circumstances (Art. 18)
> - **Data portability** for data provided by you under consent or contract (Art. 20)
> - **Object** to processing based on legitimate interests or direct marketing (Art. 21)
> - **Withdraw consent** at any time without affecting prior processing (Art. 7(3))
>
> To exercise your rights, contact: [EMAIL / FORM URL]
> We will respond within **one month** (Art. 12(3)), extendable by two further months for
> complex requests.

### 9. Right to Lodge a Complaint (Art. 13(2)(d))
> You have the right to lodge a complaint with your supervisory authority.
> In the UK: **ICO** — ico.org.uk | 0303 123 1113
> In the EU: [LEAD SUPERVISORY AUTHORITY if applicable]

### 10. Whether Provision is Statutory/Contractual (Art. 13(2)(e))
> [Where applicable: "Providing this data is a contractual requirement. Failure to provide it
> may mean we cannot [provide the service]."]

### 11. Automated Decision-Making / Profiling (Art. 13(2)(f))
> [If applicable: "We use automated decision-making including profiling for [PURPOSE].
> This has [significant / no significant] effect on you. You have the right to [request human
> review / object — Art. 22]."]
> [If not applicable: "We do not use automated decision-making that produces legal or similarly
> significant effects on you."]

---

## Drafting Checklist
- [ ] Written in plain, clear language (Art. 12(1))
- [ ] Provided free of charge (Art. 12(5))
- [ ] All Art. 13(1) and 13(2) fields covered
- [ ] Separate sections for each processing purpose
- [ ] Version date and review schedule included
- [ ] Accessible format (e.g., layered notice for website)