01What the regulation requires, and what it does not
GDPR does not use the phrase 'privacy policy page'. Article 13 says that when you collect personal data from a person, you must give them certain information at the time you obtain it. Article 12 says that information must be concise, transparent, intelligible and easily accessible, in clear and plain language. Personal data means any information relating to an identifiable person, so a name and an email from a form qualify. Recital 30 adds that people can be associated with online identifiers such as IP addresses and cookie identifiers. That is why the usual answer is a page, linked from the footer and from every form, and why we treat it as part of the site and not as decoration. Whether your exact set-up needs one is a question for a lawyer.
- Who you are and how to reach you, plus a data protection officer's contact where you have one (Article 13(1)(a) and (b))
- Why you use the data and on what legal basis, and your legitimate interests if that is the basis (13(1)(c) and (d))
- Who receives the data, and any transfer outside the EU (13(1)(e) and (f))
- How long you keep it, and the rights to access, correct, erase, restrict, object and move it (13(2)(a) and (b))
- The right to complain to a supervisory authority, and whether giving the data is required (13(2)(d) and (e))
02What on your site brings the rule into play
Walk through the site as a visitor and write down every place something is sent or collected. A contact form. A booking widget. A newsletter box. A chat bubble. A payment page. Analytics. An embedded map or video. Each one either collects personal data from the visitor or hands it to an outside party, and Article 13(1)(e) asks you to name the recipients or categories of recipients. Article 13(1)(f) asks you to say so if you intend to transfer data outside the EU, so read each provider's terms: our own privacy page says some Google Analytics data may be transferred outside the EU under Google's terms. A site with no form, no analytics and no embeds is a different case. Even then the host keeps server logs with IP addresses, so we would add a short note and let a lawyer decide whether it is needed. Cookies and consent banners fall under a separate rule that this article does not cover.
- Forms, booking widgets, newsletter boxes and checkout collect data directly
- Analytics, maps, video and chat widgets can pass data to an outside party
- Each outside party is a recipient you name (Article 13(1)(e))
- A provider that transfers data outside the EU raises the transfer line (13(1)(f))
- Cookie banners are a separate rule, not covered here
03What a usable page contains
A good page is short, specific to your site and organised by what actually happens. Our own privacy page has nine short sections: who we are, what the start form collects, how payments work, which analytics tools run and what cookies they set, where the site is hosted, the legal basis, how long we keep data, the visitor's rights, and what happens when we change the page. It names, among others, Stripe, Resend, three analytics tools, Hetzner in Germany and Cloudflare. It tells people to write to us and says they can complain to ANSPDCP, the Romanian authority. Do not copy ours. It describes our site and nothing else, and yours runs different tools. Write in the first person plural, in sentences a customer can read on a phone.
- Who you are and how to contact you
- Each thing you collect, why, and on what legal basis
- Who receives it: hosting, payment, email and analytics providers
- How long you keep it
- The visitor's rights, how to use them, and the right to complain to ANSPDCP in Romania
04Four ways a privacy page ends up useless
First, a template from a generator that lists tools you do not use and misses the ones you do. Second, a page that was right at launch and never touched after you added a chat widget or a new form. Third, a policy buried in the footer with nothing at the point of collection. Article 13 says the information comes 'at the time when personal data are obtained', so we would put a short line and a link beside each form. Fourth, legal fog. Article 12 asks for clear and plain language, and a page nobody can read does not meet it. A sentence like 'we never share your data' is one to avoid while Stripe, your host and your email tool each receive some of it.
- Generator text that does not match the tools on your site
- No update after you add a widget or a form
- No link or line at the form itself
- Language a customer cannot follow
05Where PROOF48 is the wrong choice
PROOF48 builds websites. It is not a law firm. A business website of up to about five pages costs 500 to 2,500 EUR, you see a live preview in 48 hours and you pay only after that, and the privacy wording is yours to confirm with a lawyer. Nothing on proof48.com promises a ready-made privacy page for client builds, so ask for it in the brief, and ask what will run on your site and what the page will say before launch. We are the wrong choice if you need a lawyer's sign-off before a word ships: our build-first offer does not fit projects that need legal review before any text goes out. If you sell products online, the data flows grow, and a store is a separate build at 2,500 to 4,500 EUR on its own timeline. If you handle sensitive data such as health records, speak to a lawyer first. This article does not cover that case.
- A 48-hour website: up to about five pages, 500 to 2,500 EUR, paid after the preview
- Privacy wording is for you and a lawyer to confirm
- Wrong choice if you need legal sign-off before launch
- A store is a separate build at 2,500 to 4,500 EUR with its own timeline
A list of tools that touch customer details
Rotiseria Baba Novac, a rotisserie in Bucharest, runs its own ordering system with Stripe checkout, pickup slots, an email confirmation on every order sent through Resend, and order tracking for the customer. That list is a useful exercise for any site that takes orders or enquiries: each outside tool that touches a customer's details, here payment and email, is something you would name when you say who receives the data. The case study does not record the restaurant's privacy wording, and we do not publish its order volume. It is an ordering system of the kind that costs as much as a store, not the 48-hour website.
See the build: Rotiseria Baba NovacQuestions, answered
Does GDPR say I need a page called 'privacy policy'?
No. Article 13 lists the information to give people when you collect their data, and Article 12 says it must be easy to access and in clear, plain language. A page linked from every page and from each form is the usual way to do that, in our view.
Can I copy a privacy policy template?
Only as a starting point. Article 13 asks about your own purposes, recipients and storage periods, so the text has to match the tools on your site. Have a lawyer read the final version.
My site only shows an address and a phone number. Do I need one?
If the site collects nothing and runs no analytics or embeds, Article 13 may not apply to the page itself. Hosts still log IP addresses, and Recital 30 lists IP addresses among online identifiers, so we would add a short note and ask a lawyer.
Who do people complain to in Romania?
ANSPDCP, the national data protection authority, at dataprotection.ro. Article 13(2)(d) requires your page to mention the right to lodge a complaint with a supervisory authority.
Does PROOF48 add a privacy page to the sites it builds?
Nothing on proof48.com promises a ready-made privacy page for client builds, so we claim nothing either way. Ask for it in the brief, and ask what will run on your site and what the page will say before launch. The wording is yours to confirm with a lawyer.
Where PROOF48 fits
If your site collects personal data, GDPR Article 13 expects you to tell people who you are, why you collect their data, who receives it, how long you keep it and what rights they have, in clear plain language. A page that matches the tools on your site is the usual way. Write it from a walk through your own site, update it when you add a widget, and have a lawyer read the final text. PROOF48 builds the 48-hour website for 500 to 2,500 EUR, paid after the preview.
Cosmin Tiu · Founder, PROOF48
Cosmin has worked in online marketing and software development since 2018, and has built with AI every day since January 2023. He still writes code from scratch daily, in Python, React, Rust and C#. PROOF48 ships business websites in 48 hours and invoices afterwards, so every opinion on this blog was paid for in real builds, not in theory.