Privacy policy
A privacy policy is the document in which an organization tells people what personal data it collects, why, on what legal basis, with whom it shares it, how long it keeps it, where it transfers it and what rights they have.Most privacy laws require one and specify its contents. Articles 13 and 14 of the GDPR list them: the identity and contact details of the controller and of the DPO, the purposes and legal bases, the legitimate interests pursued, the recipients, transfers outside the EEA and their safeguards, the retention periods, the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, the right to complain to a supervisory authority, and whether providing data is a requirement. The CCPA (Civil Code section 1798.130) requires a description of the categories of personal information collected, sold or shared in the last 12 months, the purposes, the rights, and how to exercise them. Brazil's LGPD (Article 9), Australia's APP 1, Quebec's Law 25 and Türkiye's KVKK (Article 10) have comparable lists.
Cookies belong in it twice: as a category of data (online identifiers, device information, behavior) with its purposes and recipients, and through a link to the cookie policy that holds the detailed table. The policy should be reachable from every page, written plainly, and updated when tools change.
Cookiequiet's generator writes a privacy policy from a questionnaire prefilled by the scan, with the processors table, retention periods, rights and the supervisory authority of the company's country, for the GDPR, UK GDPR, ePrivacy, CCPA/CPRA, LGPD and the Swiss FADP. It is a starting point, not legal advice. See the privacy policy generator.