Privacy notice (DRAFT)

Who we are

[Name and contact details of the data controller.] [Contact details of the data protection lead, or Data Protection Officer if one is appointed.] [ICO registration number, if applicable.]

What this notice must cover

A UK GDPR privacy notice is expected to cover at least the topics below (UK GDPR Articles 13 and 14). Each needs wording for The Site Office:

• The identity and contact details of the controller, and of any representative or Data Protection Officer.
• The categories of personal data collected. [For example: account details, names and roles, project records, photos, notes, approval signatures, technical and log data.]
• The purposes of each use and the lawful basis for each, including legitimate interests where relied on.
• Where data comes from, when it is not collected from the person directly. [For example: added by a colleague or another company on a shared project.]
• Who receives the data. [For example: other members of a shared project, hosting and service providers.]
• Transfers outside the UK and the safeguards used.
• How long each kind of data is kept, or how that period is decided.
• People's rights: access, rectification, erasure, restriction, objection, data portability, and how to exercise them.
• The right to withdraw consent at any time, where consent is the lawful basis.
• The right to complain to the Information Commissioner's Office (ICO).
• Whether providing data is a legal or contractual requirement, and what happens if it is not provided.
• Any automated decision-making, including profiling, and its logic and effects.
• Cookies and similar storage used by the site. [For example: sign-in session storage in the browser.]
• How and when this notice is updated.

[Section wording]

[To be written by the site owner or a professional adviser.]