Anatomy of a Privacy Notice
Learn what belongs in a privacy notice, and why.
Example Studio is fictional. Open a lesson to learn what to include and why. Legal examples use the EU GDPR, with UK and US rules where labeled. This portfolio’s actual privacy notice.
The FINE-BUT-LARGE Print
MIND YOUR OWN BASKET
The publisher
Who is responsible for your information?Who runs this place?
Example Studio publishes articles, offers browser tools, sends an optional newsletter, and runs a small online shop. This notice explains how those activities use your personal information.
Responsibility. For the purposes described in this notice, Example Studio determines the purposes and means of processing and acts as the controller of the personal information concerned.
What this covers. This notice applies to the publication, browser-based tools, optional newsletter, online store, and associated support and privacy-request handling. It covers information supplied directly by individuals and information generated through use of those services.
Contact. The designated contact in this illustrative scenario is [email protected]. Example Studio and this address are fictional; this demonstration does not establish an operating business or a live request channel.
Our practices
Advertising, sale, and profilingYour information is not for sale
We do not sell personal information, supply data brokers, or use advertising that follows you across unrelated sites. We do measure readership, newsletter engagement, and shop performance; each works differently.
No sale. Personal information is not sold, rented, or otherwise provided to data brokers for their commercial exploitation.
No cross-site ads. The services do not implement cross-context behavioral advertising, third-party advertising pixels, or advertising profiles based on activity across unrelated websites.
Three kinds of measurement. Aggregate publication statistics, subscriber-linked engagement records, and consent-based shop analytics are separate processing activities. Their information categories, purposes, recipients, and controls are described in the corresponding sections.
No significant automated decisions. No solely automated decision-making, including profiling, is used to produce legal effects concerning an individual or similarly significantly affect that individual.
01 / Reading
Website delivery and account accessRead first. Sign in only if needed.
Public articles do not require an account. Our host receives your IP address and connection details to deliver pages and keep them secure. Signing in uses temporary cookies; it does not turn your reading history into an advertising profile.
Information. The hosting and delivery providers process IP addresses, browser and device attributes, requested URLs, timestamps, and response or security events in connection with HTTP requests and access logs.
Purpose and recipients. These records are processed by contracted hosting and content-delivery providers for service delivery, fault diagnosis, and the legitimate interests of maintaining service availability and security, subject to applicable law.
Sign-in cookies. Authentication links and transient authentication cookies expire after 10 minutes; authenticated session cookies have a maximum duration of 7 days. They support requested account access and are not used for advertising.
Retention. Routine access logs are retained for 30 days. A relevant subset may be retained for the duration of a documented security incident, dispute, or legal obligation. Such extensions are limited to the records necessary for that purpose.
Separation. The publisher does not combine routine access-log records with subscriber profiles for behavioral profiling or advertising.
02 / Browser tools
Browser processing and saved resultsYour work stays on your device
The tools process what you enter on your device. We do not receive those inputs for processing. Loading the tool still sends ordinary page requests to our host. Saved work and downloads remain until you remove them.
Your input. Tool input, including entered text, selected files, and configuration, is processed locally in the browser. The publisher and its hosting providers do not receive those inputs for processing.
Page delivery. Requests for the tool application and its assets disclose the same connection information described in Website delivery and account access. This network delivery is distinct from the processing of tool inputs.
Saved copies. Where a tool provides saved work, that work persists in browser storage until removed through the tool or browser controls. Downloaded files remain in the device filesystem until removed by the user. Server-side account deletion does not remove either category of local copy.
From the recipe box
Publication readership statisticsReadership, by the recipe
Ingredients
Page address, referring site, browser or device category, approximate country, and visit time. An IP address may briefly help derive connection details, but is not stored in analytics records.
Method
A short-lived identifier helps count visits. It does not follow you across days or unrelated sites.
Storage
Event records are kept for 30 days; aggregate page totals are kept for 12 months.
Purpose and choice. Our legitimate interest is improving the publication, where the law allows that basis. Where the law requires consent, we ask before processing instead.
Ingredients. The analytics provider processes the requested page, referring source, browser and device category, approximate country derived from the connection, and event time. Raw IP addresses may be used transiently to derive the necessary connection attributes but are not stored in the analytics records.
Method. A short-lived, site-specific identifier is used to estimate visits within a day. It is not used as a persistent cross-day identifier or shared identifier across unrelated websites.
Result. Event-level analytics records are retained for 30 days; aggregated page and source statistics are retained for 12 months. The provider processes the records under the publisher’s instructions for readership analysis.
Purpose and choice. Readership analysis is undertaken for the legitimate interest of improving publication content, where that basis is available. Consent is obtained before the relevant processing where applicable law requires it; legitimate interest does not displace a consent requirement.
03 / Email
Optional newsletter and engagementNews only when you ask for it
The newsletter is optional and free. We store your email, the name you give us, and your subscription choices. Opens and clicks are recorded only if you separately allow engagement tracking. Unsubscribing stops the emails; deleting your account is a separate request.
Information. The subscription platform stores the email address, optional name, signup source, subscription status, and records of the choices and consent associated with the subscription.
Delivery. The contracted email-delivery provider processes subscriber contact information on the publisher’s instructions to send the requested newsletter. Subscription is optional, free of charge, and is not a condition of public article or tool access. No payment information is collected for subscription.
Engagement tracking. Where separate consent has been provided, tracking pixels and tagged links associate recorded opens and clicks with the subscriber record for issue-performance analysis. Those engagement records are retained for up to 12 months. Newsletter signup alone is not treated as consent to engagement tracking.
Unsubscribe. Unsubscribing withdraws permission for future newsletter delivery. It does not itself delete the underlying account, retained records, previously delivered messages, or downloaded files. Account deletion may be requested separately.
After deletion. Following an account-deletion request, a minimal suppression record comprising the email address and opt-out status is retained where necessary to honor the individual’s communication preference. Other records are erased unless a specific legal, security, or dispute-related retention requirement applies.
04 / Shopping
Orders, payments, and fulfillmentFrom checkout to your doorstep
Our checkout provider takes payment. We use your contact, delivery, and order details to pack and send your purchase, answer questions, and handle returns. Payment providers handle full card details; we receive payment status, not your full card number.
Information. Order processing involves purchaser name, email address, shipping and billing addresses, purchased items, transaction amount, payment status, and associated customer communications. The information is supplied through checkout or support interactions.
Fulfillment. The publisher uses order records to fulfill the purchase contract, provide transaction updates, and administer support and returns. Contracted commerce and support providers assist with those activities; delivery carriers receive the name, address, and any delivery information required for shipment.
Payments. Payment-card information is processed by the payment provider. The publisher receives a transaction reference and payment status and does not receive the full payment-card number. Payment providers may separately determine processing required for their fraud-prevention and legal obligations.
Security and records. Connection, privacy-choice, and transaction information is processed to operate and protect the store and investigate fraud, based on applicable legitimate interests. Required transaction and accounting records are retained for 7 years in this example to meet the assumed accounting obligations.
At the checkout
Store cookies and privacy preferencesChoose your cookies
Essential cookies keep checkout, sign-in, and security working. Optional shop analytics start only after you choose them. You can reject or change optional cookies without losing essential checkout functions.
Essential. Strictly necessary cookies support shopping-cart state, authentication, transaction security, and storage of privacy preferences. These functions are distinguished from optional measurement or advertising purposes.
Optional. Optional store-analytics cookies process session and source information, transaction events, conversion metrics, and approximate location only after the individual opts in. No advertising integrations are enabled in this scenario.
Your choice. Privacy settings provide accept, reject, and change-choice controls for nonessential cookies. A preference record is retained for 6 months. Withdrawing consent stops subsequent optional processing without affecting processing already lawfully performed.
The service providers
Recipients and service-provider rolesWho helps run the place?
Pages & accounts
Hosting and access
Newsletter
Email delivery
Readership
Visit statistics
Orders
Payments and delivery
Specialist providers help host pages, send email, measure visits, take payment, and deliver orders. They receive information for those jobs. We may also share relevant records when a legal obligation, dispute, or business transfer requires it.
Hosting and access. Hosting, delivery, and authentication processors receive connection and account-access records to operate the publication and related services under the publisher’s instructions.
Email and measurement. Email processors receive subscriber contact information and subscription preferences. Measurement processors receive publication-event records and, where consent has been given, subscriber-associated engagement records for the specific purposes described above.
Orders and payments. Commerce and support processors receive relevant transaction and communication records. Carriers receive delivery information. Payment providers process payment details and may act independently for their own regulatory or fraud-prevention purposes.
Other recipients. Relevant information may be disclosed to professional advisers, competent authorities, or other parties where necessary for a legal obligation, the establishment or defense of claims, or protection of rights. A merger, sale, or restructuring may entail a transfer subject to applicable privacy requirements and appropriate restrictions.
The records desk
Retention periods and deletionDifferent records, stated limits
Routine access logs last 30 days; engagement records last up to 12 months; required order records last 7 years. Account deletion and unsubscribe are separate. A documented legal or security need can justify keeping specific records longer.
Sign-in and sessions. Transient sign-in links and cookies expire after 10 minutes. Authenticated session cookies expire after no more than 7 days. Expiration ends their validity; it does not delete the underlying account.
Access and analytics events. Routine connection logs and event-level publication analytics are retained for 30 days. Aggregated publication statistics are retained for 12 months.
Account and newsletter
Account and subscription records are retained while the account remains in place, including after unsubscribe until deletion is requested. Consented engagement records are retained for up to 12 months. A minimal suppression record may remain after deletion to honor the opt-out.
Order and accounting records
Transaction and accounting records required under the scenario’s assumed accounting obligations are retained for 7 years. Other order-related records are retained only for fulfillment, returns, support, or a justified legal or dispute purpose.
Support and privacy requests
Support and privacy-request correspondence and records of the response are retained for 2 years after closure, unless a continuing dispute or legal requirement justifies a longer, documented period.
Recovery copies
Information erased from active systems may remain in restricted disaster-recovery backups for up to 30 days. Such copies are not used for ordinary business activities, and applicable deletion instructions are reapplied if a backup is restored.
Your device
Local browser work and downloaded files are controlled through the device and browser. Server-side retention periods do not delete those local copies.
Exceptions
Any retention beyond the ordinary period is limited to information necessary for a documented legal obligation, security investigation, or establishment, exercise, or defense of a claim. Information is deleted or irreversibly aggregated when that purpose ends.
Across borders
Processing locations and international transfersInformation can cross borders
In this example, the publisher is based in the United States and uses providers in the US and Europe. Information may be accessed from another country. Applicable transfer safeguards must be in place; a server address alone is not the whole picture.
Locations. The illustrative publisher is established in the United States. Its hosting and service providers operate in the United States and Europe. Provider support, subprocessing, or remote access can involve additional countries even where storage remains in one region.
Safeguards. Where applicable data-protection law restricts an international transfer, the publisher relies on an applicable adequacy decision or appropriate safeguards, such as the relevant standard contractual clauses and required supplementary measures. The basis depends on the particular transfer and recipient.
More information. Individuals may request information about the safeguards relevant to their information, including an available copy subject to legitimate confidentiality redactions, through the designated privacy contact.
Your choices
Individual rights, requests, and complaintsAsk for access, correction, or deletion
You can ask to see, correct, delete, or receive a portable copy of your information, and ask us to stop or limit a use. Legal rights and exceptions depend on your circumstances and the applicable law. You can also complain to your privacy regulator.
Requests. Subject to the conditions and exceptions in applicable law, individuals may exercise rights of access, rectification, erasure, portability, restriction of processing, and objection. The availability and scope of a right depend on the processing and jurisdiction concerned.
Consent and marketing. Where processing relies on consent, consent may be withdrawn at any time with effect for subsequent processing. Withdrawal does not affect the lawfulness of processing performed before withdrawal. Direct-marketing objections and unsubscribe choices are honored.
Identity and response. The publisher may request information reasonably necessary to verify identity or authority, taking account of the request and information involved. Requests are handled within applicable statutory time limits. Any refusal, limitation, or permitted extension is explained with the relevant grounds and available remedies.
Records that may remain. Erasure or restriction may be limited where retention or processing is necessary for a legal obligation, transaction administration, fraud prevention, or the establishment, exercise, or defense of a claim. The exception is assessed against the particular records and purpose; it is not a blanket exemption.
Complaints and treatment. Individuals may lodge a complaint with a competent data-protection authority, including an EU supervisory authority or the UK Information Commissioner where applicable. The publisher does not unlawfully discriminate or retaliate against individuals for exercising privacy rights.
Independent providers. Where another provider acts as an independent controller for particular purposes, that provider is responsible for addressing rights requests concerning that independently controlled processing. The publisher assists with routing where appropriate.
Good housekeeping
Safeguards and residual riskHow we protect information
We limit access, protect information in transit, and use administrative and technical safeguards suited to the information. No online service can promise perfect security.
Measures. Administrative and technical measures include role-appropriate access controls, encryption of information in transit, documented handling procedures, and proportionate review of relevant service providers.
Limit. Measures are selected with regard to the nature, context, and risks of processing. No system can guarantee absolute security, and the existence of safeguards does not eliminate all risks of unauthorized access, loss, or misuse.
For the grown-ups
Intended audience and children’s informationMade for adults
These services are intended for adults aged 18 and over. We do not knowingly collect personal information directly from children. If a child supplies information, contact us so we can investigate and arrange appropriate deletion.
Audience. The services are directed to adults aged 18 and over and are not designed to solicit personal information from children.
Response. If the publisher becomes aware that a child has supplied personal information contrary to this intended audience, it investigates and takes steps to erase that information as appropriate under applicable law. A parent or guardian may raise the matter through the privacy contact.
Corrections & updates
Changes to this noticeWhen the notice changes
When our practices change, we update the notice and its date. We explain material changes affecting information already collected and obtain fresh consent when required.
Updates. The publisher reviews and amends the notice when its processing activities, recipients, purposes, or relevant obligations change, and identifies the updated version by date.
Material changes. Where a change materially affects previously collected information, the publisher provides additional notice by an appropriate channel and obtains new consent where required. Publication of an amended notice does not itself constitute consent to a new processing purpose.