What is a privacy policy?

A privacy policy is an information document that explains how a website, company or organization processes personal data. It should make clear which data is collected, for which purposes, on which legal basis, who may receive it and which rights affected individuals have.

For websites, the privacy policy is a central part of WordPress and website data protection. It does not replace legal advice, but it must match the actual technical setup of the website.

What does a privacy policy usually contain?

A privacy policy typically describes:

• controller and contact details
• purposes and legal basis of processing
• hosting, tools, plugins and third-party services
• cookies, tracking and consent tools
• contact forms, newsletters or user accounts
• storage periods or criteria for retention
• recipients or categories of recipients
• rights of affected individuals
• international transfers, if relevant

Article 13 of the GDPR describes information obligations when personal data is collected from the data subject. The legal text is available via EUR-Lex Article 13 GDPR.

Why generators alone are often not enough

Generators can provide a useful starting point, but they do not automatically know the actual implementation. If a website uses reCAPTCHA, consent tools, external fonts, embedded videos, analytics tools or server log files, the privacy policy has to reflect that.

The key is consistency between text and technology. A website should not omit services that are actually loaded. It also should not list tools that are no longer used. This is especially important for consent management platforms and tracking setups.

In short

A privacy policy informs visitors about the processing of personal data. It should be understandable, easy to access and technically accurate. For companies, it is a legally sensitive document and should be reviewed when hosting, forms, cookies, tracking or embedded services change.