Privacy policy template

Art 13 GDPR-complete skeleton for a PageWeave site. Fill the [PLACEHOLDERS] from real data the user provides — never invent. Keep only the sections that match the site's actual features. Translate into the site's language.

Instructions

1. Replace every [PLACEHOLDER] with real data from the site owner.
2. Delete sections for features the site does not have (e.g. the embeds section if no embeds exist).
3. Publish as a page in the site's language, link it from the footer.
4. Have a lawyer review before launch on commercial sites.

Template

1. Controller (Verantwortlicher)

[Full legal name or company name] [Street, number] [Postal code, city] [Country] Email: [email] Phone: [phone, optional]

2. Data processed on this site

Hosting and server logs. This site is hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany; HRB 6089 Ansbach) in data centers in Nuremberg, Falkenstein, or Helsinki (all EU). When you visit, the server processes your IP address, browser type, and the pages you request. Legal basis: Art 6(1)(f) GDPR (legitimate interest in operating a secure, available website). Server logs are retained for 90 days.

Analytics. This site uses server-side, privacy-friendly analytics. No cookies, no JavaScript trackers, no fingerprinting. A visitor hash is derived from IP address, user agent, and date (SHA256) and cannot identify you. Raw data is retained 90 days; aggregated daily statistics are kept longer. Legal basis: Art 6(1)(f) GDPR.

Forms. [Describe each form: purpose, fields collected, what happens to submissions.] Submissions are stored in a database in the EU and emailed to the site owner. Legal basis: [Art 6(1)(a) GDPR (consent) / Art 6(1)(b) GDPR (pre-contractual measures) / Art 6(1)(f) GDPR]. Submissions are retained until [retention period, e.g. "the purpose is fulfilled, then deleted"].

[Optional] Embedded videos/maps. This site embeds videos from YouTube, operated by Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Videos load only after you click the activation button; the click is your consent. When you activate a video, your IP address, browser data, and interaction with the player are transmitted to Google in the United States. Google LLC is certified under the EU-US Data Privacy Framework. The site operator and Google are joint controllers for this processing (CJEU Fashion ID, C-40/17). Legal basis: Art 6(1)(a) GDPR. You can withdraw consent at any time by not activating further videos.

3. Recipients

• Hetzner Online GmbH (hosting, EU)
• PageWeave (platform, processor — EU)
• [Email provider if used]
• [Embed providers, if any]

4. International transfers

Data is processed in the EU. [If embeds are used:] When you activate an embedded video, data is transferred to Google LLC in the United States under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795).

5. Retention

• Server logs: 90 days
• Analytics raw data: 90 days; aggregated statistics: longer
• Form submissions: until deleted by the site owner
• [Add any other retention periods]

6. Your rights

You have the right to:

• access (Art 15)
• rectification (Art 16)
• erasure (Art 17)
• restriction of processing (Art 18)
• data portability (Art 20)
• object to processing (Art 21)
• withdraw consent at any time (Art 7(3))
• lodge a complaint with a supervisory authority (Art 77)

To exercise any right, contact: [controller contact].

7. Supervisory authority

[Name of the competent supervisory authority for the controller's location, e.g. "Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien" or "Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit" — verify the correct authority for the site owner's location.]

8. Changes

This policy was last updated on [date]. [Optional: changelog]