Enter your business details, list why you collect personal data and pick the legal basis for each purpose. The generator writes a plain-English statement covering who you are, purposes, legal bases, storage time, who receives the data, people's rights and how to complain to a data protection authority. Copy it onto your site. It is not legal advice.
| Topic | GDPR source |
|---|---|
| Who you are and how to contact you (and your data protection officer, if you have one) | Articles 12 to 14 |
| Why you use the data and the legal basis | Articles 6 and 13 |
| How long you keep it, and who receives it | Article 13 |
| Access, correction, erasure, restriction, portability, objection | Articles 15 to 21 |
| Decisions made purely by automated processing | Article 22 |
| Right to complain to a data protection authority | Article 77 |
Updated
A GDPR statement, sometimes called a privacy notice, tells visitors what you do with their personal data. Small sites often skip it or copy one that names services they do not use. This generator asks only what applies to you, ties every purpose to one of the six legal bases, and keeps the wording short enough that people actually read it.
Business or controller name: Atelier Rosa
Postal address: Calle Mayor 5, Valencia, Spain
Email for privacy questions: [email protected]
Data protection officer contact (leave empty if none)
Why you use personal data
How long you keep the data: Order records for six years for tax reasons; contact messages for 12 months.
Who receives the data: Our hosting provider, our payment processor and our delivery company.
Data is transferred outside the EU/EEA
We make decisions about people by purely automated means
Your data protection authority: Agencia Española de Protección de Datos (AEPD)
Your statement
Atelier Rosa (Calle Mayor 5, Valencia, Spain) is responsible for the personal data described here. Contact us about privacy at [email protected].
Replying to messages sent through our contact form: Legitimate interest (GDPR Article 6(1)(f)).
Processing and delivering your orders: Performance of a contract (GDPR Article 6(1)(b)).
Sending our newsletter: Consent (GDPR Article 6(1)(a)).
Where we rely on consent, you can withdraw it at any time; this does not affect what we did before you withdrew.
Order records for six years for tax reasons; contact messages for 12 months.
Our hosting provider, our payment processor and our delivery company.
We do not transfer your data outside the EU/EEA.
You can ask to access your data, correct it, erase it, restrict its use, receive it in a portable format, and object to its use (GDPR Articles 15 to 21). We answer within one month.
We do not make decisions about you based solely on automated processing.
You have the right to complain to a data protection authority, such as Agencia Española de Protección de Datos (AEPD) (GDPR Article 77).
Built in your browser. Nothing is uploaded. Not legal advice.
Every purpose needs exactly one. These are the names the European Data Protection Board uses in its guide for small businesses, with a typical website example of each.
| Legal basis | Article | Typical website use |
|---|---|---|
| Consent | 6(1)(a) | Newsletter sign-up, marketing emails |
| Performance of a contract | 6(1)(b) | Delivering an order, running a booked service |
| Compliance with a legal obligation | 6(1)(c) | Keeping invoices for tax law |
| Vital interests | 6(1)(d) | Rare for websites: protecting someone's life |
| Public interest | 6(1)(e) | Public bodies carrying out official tasks |
| Legitimate interest | 6(1)(f) | Answering an enquiry, basic fraud prevention |
The Copy HTML button gives you headings and paragraphs with no styling, so it takes on your site's own fonts. Here is the default example.
Plain semantic HTML: one h2 for the page, h3 per topic, short paragraphs. Paste it into any page editor that accepts HTML.
<h2>How we use your personal data</h2>
<p>Atelier Rosa (Calle Mayor 5, Valencia, Spain) is responsible for the personal data described here. Contact us about privacy at [email protected].</p>
<h3>Why we use your data and our legal basis</h3>
<p>Replying to messages sent through our contact form: Legitimate interest (GDPR Article 6(1)(f)).</p>
<p>Processing and delivering your orders: Performance of a contract (GDPR Article 6(1)(b)).</p>
<p>Sending our newsletter: Consent (GDPR Article 6(1)(a)).</p>
<p>Where we rely on consent, you can withdraw it at any time; this does not affect what we did before you withdrew.</p>
<h3>How long we keep it</h3>
<p>Order records for six years for tax reasons; contact messages for 12 months.</p>
<h3>Who receives it</h3>
<p>Our hosting provider, our payment processor and our delivery company.</p>
<p>We do not transfer your data outside the EU/EEA.</p>
<h3>Your rights</h3>
<p>You can ask to access your data, correct it, erase it, restrict its use, receive it in a portable format, and object to its use (GDPR Articles 15 to 21). We answer within one month.</p>
<p>We do not make decisions about you based solely on automated processing.</p>
<p>You have the right to complain to a data protection authority, such as Agencia Española de Protección de Datos (AEPD) (GDPR Article 77).</p>Give it its own page, link it in the footer of every page and link it again beside any form that collects personal data. The GDPR expects people to get this information when their data is collected, so the link next to a form matters.
If you collect data on paper or by phone as well, the same text can be printed or read out.
Each EU country has its own authority, and the European Data Protection Board lists all of them on its members page. Name the one where you are based, or where most of your customers live, so people know where a complaint goes.
Businesses in the UK follow the UK GDPR and the Information Commissioner's Office, which has its own version of the rules and its own list of lawful bases.
They overlap. The GDPR's word is information or a notice; many sites call that page a privacy policy. What matters is that it gives the items listed in Articles 13 and 14 in clear, plain language, wherever it sits on your site.
The European Data Protection Board's guide for small businesses says to answer a data subject request within one month. For complex requests the deadline can be extended by two further months, and you must tell the person about the extension within the first month.
There are six: consent, performance of a contract, a legal obligation, vital interests, a public interest task, and legitimate interest. A shop fulfilling an order usually relies on contract; a newsletter usually relies on consent. If you are unsure, ask your national data protection authority or an adviser.
No single page does that. The statement describes what you do; compliance also depends on actually doing it, keeping data secure and answering requests. Treat this as a starting draft, not legal advice.
No. The statement is assembled in your browser and nothing is uploaded or stored by this page.
Related: Privacy policy generator, Cookie policy generator, Terms of service vs privacy policy, Cookie consent banner examples.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.