Privacy Policy.

Under Art. 19 revFADP, anyone who collects personal data must inform the people concerned appropriately. On a website this almost always involves several processes: contact forms, server log files, analytics and advertising services, embedded maps or videos, newsletter sign-ups and booking systems. The minimum information includes the identity and contact details of the controller, the purpose of processing, the recipients or categories of recipients and, if data is transferred abroad, the countries concerned and the safeguards provided for it.

The policy has to match the actual website. That sounds obvious, but it is the most common shortcoming: the privacy policy names services that were removed long ago and is silent about new ones that were added through a plugin or Google Tag Manager. A typical case is an analytics or advertising pixel installed by a marketing provider without anyone updating the policy. If the website specifically targets people in the EU, the requirements of the GDPR also apply, which go further on certain points, for example regarding the statement of legal bases.

An example from practice: a landscaping business uses a contact form, embedded Google Maps, an analytics tool and, recently, Google Ads with conversion measurement. The privacy policy dates from the year the website was built and mentions only the form. To update it, a list of all embedded services is enough. The most reliable way to compile it is to open the website in the browser with the network panel open and note which third-party servers are contacted. The policy is then supplemented accordingly, and services no longer in use are removed. Fewer embedded services mean less text and less risk.

The honest distinction: this entry is not legal advice. Generators provide a usable basis if they are fed the services actually in use; they do not, however, know by themselves what is running on the website. Whether a cookie banner is also needed is a separate question. A website with as few third parties as possible is also faster and needs less explaining, for instance with cookie-free measurement.