Following recent media coverage about organisations handling personal data, now is a good time to focus on the issue of privacy. This month we explain why a privacy policy is important to your online presence. Having one in force shows a duty of care to your website visitors and customers. So, does your website have a privacy policy and if not, why not?
Their Purpose
A privacy policy is much more than another page of text on your website. As with any policy, it has significant meaning and a role to play. Its primary purpose is to explain fully and clearly how customer data will be:
- collected
- secured
- stored
- used
- shared
It represents a legally binding agreement between you and your site visitors, with responsibilities on both sides. If it does not cover your terms and conditions, these should be displayed elsewhere on your website.
A meaningful privacy policy will demonstrate that you respect and protect the privacy of your website visitors and customers. Convince them their privacy is protected and they will be more inclined to trust in you and your business.
Policy Users
If you have a personal website you do not need a privacy policy. If you are a sole trader and your website is a commercial venture, then you do. All SMEs, limited companies, businesses and organisations with an internet presence need a privacy policy.
As a business, regardless of size and sector, you have certain obligations under the Data Protection Act (DPA) to ensure your customers and site visitors know and understand what you are doing with any data collected about them.
Even if your website does not sell products online, it should still display a privacy policy. This is because, even without realising it, you may still be collecting information about your website visitors. We covered this point in an earlier Newsletter entitled “Your website and the DPA”.
Policy Requirements
First and foremost, a privacy policy should explain clearly and concisely what data you will collect and hold about the individuals who visit your site, and/or the products and services they use.
Your privacy policy should be specific about (a) the information you collect, (b) how you gather the data, and (c) what you use it for. As an example, please take a look at our privacy policy. If you do not have a policy in place, you may need to perform an audit of your processes to verify the type of data you collect, and how it is handled. Such an audit may reveal previously unknown data collection and retention.
It is important to ensure that your privacy policy is comprehensive, accurate and truthful. It should be in plain English, easy to read and understand. Don’t forget, how your privacy policy is worded will have a positive or negative impact on its readers, influencing their decision on whether or not to use your website.