ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan your site for DPDPA readiness
ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan your site for DPDPA readiness
ConsentXUse ConsentX's free privacy policy generator to create a custom privacy policy and cookie policy for your website. Answer a few questions and get a draft with GDPR, CCPA/CPRA and DPDPA clauses.
The ConsentX free Privacy Policy Generator helps you create a customized privacy policy based on your website, business, data practices, and applicable privacy requirements.
Answer a few simple questions, generate your policy, and get a clear starting point for communicating how your business collects, uses, shares, and protects personal data.
Not sure which laws apply? Read our UK GDPR guide, LGPD guide or PIPEDA guide.
PRIVACY & COOKIE POLICY
Your Company (yourwebsite.com)
1. Who we are
Your Company ("we", "our", "us") operates yourwebsite.com. This Privacy & Cookie Policy explains what personal data we collect, why we use it, and the choices and rights you have.
Effective date: [date].
2. Personal data we collect
Depending on how you use our site, we may collect:
3. How and why we use your data
We use your data to operate and improve the site, respond to your requests, keep the service secure, and meet our legal obligations.
Our lawful bases include your consent (for non-essential cookies and marketing), the performance of a contract, our legitimate interests, and compliance with law. You can withdraw consent at any time.
4. Sharing and third parties
We do not sell your personal data. We share it only with service providers who process it on our behalf under appropriate safeguards, including:
5. Data retention
We keep personal data only as long as needed for the purposes described above, after which it is deleted or anonymised.
6. Cookies and similar technologies
We use a consent banner to capture your choice before any non-essential cookies are set. Strictly necessary cookies are always active; analytics, advertising and functional cookies run only with your consent.
You can review or change your choice at any time through the cookie preferences link in our banner.
A live, itemised list of the exact cookies in use is maintained automatically and shown in the banner's preferences.
7. Your privacy rights
You may have rights to access, correct, delete or port your data, and to object to or restrict certain processing. To exercise them, contact us at privacy@yourwebsite.com.
8. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. No method of transmission or storage is completely secure, but we work to protect your information.
9. Changes to this policy
We may update this policy from time to time. We will post the new version here and update the effective date above.
10. Contact us
For any privacy question or to exercise your rights, contact us at privacy@yourwebsite.com.
This document is a starting draft generated by the ConsentX policy generator. Review it with qualified counsel and tailor it to your actual data practices before publishing.
ConsentX maintains your cookie declaration from real scan data, so it never drifts out of date. See how it works
Answer a few questions about your business and website, and generate a tailored privacy policy.
Create policy content aligned with common privacy requirements, including GDPR, CCPA/CPRA, and DPDPA. Explore GDPR, CCPA/CPRA & DPDPA compliance.
Address important areas such as data collection, cookies, third-party services, data usage, sharing, retention, and user rights. Not sure what your site sets? Run the free cookie scanner first.
Review and edit the generated policy to reflect your actual data practices and business requirements.
Copy your policy, download it as Markdown or HTML, or print it to PDF, then review, customize and publish it on your website.
Answer a few questions about your website, business, and data practices.
ConsentX creates a privacy policy based on the information you provide.
Review and publish, then scan your website's cookies to check your policy matches what actually loads.
A privacy policy should explain what personal data you collect, why you use it, who you share it with, how long you keep it, how you use cookies, and the rights your visitors have. Clear disclosures build transparency and trust.
Start with the personal data your website actually collects. List each category in plain language: account details such as names, emails and passwords, messages sent through contact forms, billing and payment details, newsletter sign-ups, support conversations, uploaded content, and usage, device or approximate location data. For each category, explain why you collect it and the legal basis you rely on, such as consent, performing a contract, a legitimate interest or a legal obligation. Be specific, and avoid vague phrases like "we may collect some information". If children may use your site, say how their data is handled. In the generator, the "Data you collect" options build this part of your privacy policy.
Cookies, pixels and similar tracking technologies need their own explanation, either inside your privacy policy or in a separate cookie policy. Describe the categories you use: strictly necessary cookies that keep the site working, analytics or performance cookies, advertising and marketing cookies, and functional cookies that remember preferences. Tell visitors which categories depend on their consent and how they can change or withdraw that choice later. Under laws such as the GDPR and the EU ePrivacy rules, non-essential cookies generally need consent before they are set, so your policy should match what your cookie consent banner actually does. The generator can produce this as a standalone cookie policy or as part of a combined document.
Most websites pass some personal data to other companies: analytics providers, advertising platforms, payment processors, email marketing tools, live chat, hosting and content delivery networks. A privacy policy should name these third-party services, or at least the categories they fall into, and explain what they do with the data. State clearly whether you sell or share personal information, because laws such as the CCPA/CPRA give people the right to opt out of that. If data leaves the visitor's country, for example from the EU or UK to the United States, describe the safeguards you rely on, such as Standard Contractual Clauses. The generator lets you select common services, including Google Analytics, Meta Pixel and Stripe, and names them in the draft.
Explain how long you keep personal data and what happens when that period ends. A fixed period such as 12, 24 or 36 months is easier for visitors to understand, but "only as long as needed" or "as required by law" can be appropriate when the period genuinely varies. Whatever you choose, it should reflect what your systems really do, including backups. Your policy should also describe, in general terms, how you protect data against unauthorised access, loss or misuse. Avoid promising absolute security: no method of storage or transmission is completely secure. The generator includes a retention setting and a standard security section.
Finally, tell people what rights they have over their data and how to use them. These depend on where your visitors live. The GDPR and UK GDPR cover access, rectification, erasure, restriction, portability and objection. The CCPA/CPRA covers the right to know, delete, correct and opt out of the sale or sharing of personal information. India's DPDP Act (DPDPA) covers access, correction, erasure, grievance redressal and withdrawing consent. Give a contact email for these requests, commonly known as data subject access requests (DSAR), and name the authority people can complain to. Select the regions you serve in the generator and it adds the matching rights and complaints wording, plus a Grievance Officer section for India when you provide a name.
Free to use. The generated policy is a starting point and should be reviewed and customized to accurately reflect your actual data practices. It is not legal advice.
A privacy policy and a cookie policy answer different questions. A privacy policy covers all the personal data your business handles: what you collect, why, who you share it with, how long you keep it and what rights people have. A cookie policy is narrower. It explains the cookies and similar technologies your website sets on a visitor's device, what each category is for, and how visitors can accept, refuse or change their choice.
The two documents work together. Your privacy policy should mention cookies and point to the cookie policy, and your cookie policy should link back for the wider picture. Some sites publish them separately, which keeps each one shorter and makes the cookie policy easy to link from a consent banner. Others combine them on one page.
The generator supports all three options: choose "Privacy + Cookie" for a combined document, or generate a privacy policy or a cookie policy on its own. Whichever you choose, treat the result as a draft to review before you publish it. Before publishing, run the cookie scanner to see which cookies your site sets, and use the cookie banner generator to build a banner that matches.
For more on privacy and cookie compliance, browse our privacy guides and the ConsentX blog.
ConsentX helps you manage the privacy experience beyond documentation with cookie scanning, consent management, prior-script blocking, regional controls, and audit-ready consent records.
Prior-Script BlockingConsent Records & Audit EvidencePricing