A privacy policy is one of those pages plenty of small business owners skip, right up until a contact form, an embedded map, or an analytics tag quietly turns it into a legal requirement. The moment your website collects anything about the people visiting it, you have crossed from nice to have into you probably need this.
The good news: you do not need a lawyer's vocabulary to work out where you stand. You need to know what your site actually collects, and then say so plainly. Below is a check you can run on your own site today. I call it the Five Collection Points, because a privacy policy is really just an honest description of the points where your website collects data about a visitor.
What does a privacy policy actually do?
Strip away the legal language and a privacy policy answers a few simple questions for the person reading it: what do you collect, why, who else can see it, and how do they reach you about it. Those are the questions a reader tends to care about most, though a policy that has to satisfy a law like the GDPR usually goes further, covering things such as your legal basis for collecting the data, how long you keep it, the rights people have over their own information, whether it leaves the country, and how to complain. At its core, it is a plain statement of what happens to a visitor's information when they use your site.
Two things make it matter. First, in many places privacy laws require one the moment you collect personal data, and personal data is a broad category that can include something as ordinary as an email address or an IP address. Rules such as the GDPR in Europe are the well-known example, but plenty of regions have their own, so it is worth checking what applies where your customers are. Second, a clear policy tends to reassure the human on the other end. Someone deciding whether to send you an enquiry can feel the difference between a site that explains itself and one that stays silent.
How the Five Collection Points check works
Run down the five points below and ask, for each one, does my site do this? Every yes is a reason you likely need a privacy policy, and a thing that policy has to describe. You do not have to guess your way through legal drafting. You have to know which of these five apply to you, because that list is most of what a good policy covers.
1. Do you have a contact form?
If a visitor can type their name, email, or phone number into your site and press send, you are collecting personal data. This is a common trigger for a small business site. A contact form, a quote request, a call-me-back box: each one gathers information a person handed you on purpose.
- Check the form fields: name, email, phone, message. List what you actually ask for.
- Check where it goes: the submissions usually land in an inbox or a tool, and your policy should acknowledge that you use the details to reply, not for anything the visitor did not expect.
2. Do you measure your visitors with analytics?
If you have ever added a snippet of code to see how many people visit, where they come from, or which pages they read, you are running analytics. Analytics tools typically collect data about each visitor, often on behalf of another company.
- Check for a tracking snippet: anything you or a developer added to count visits or track behaviour counts here.
- Check who runs it: if a third-party tool measures your traffic, your policy should name that you use one and what it is broadly for.
3. Do you embed maps, videos, or fonts from other companies?
This is a point some owners miss, because it does not feel like collecting anything. An embedded map so people can find your shop, a video from a sharing platform, a font loaded from elsewhere, a social feed: each of these can set cookies or pass a visitor's data to the company that provides it, often before the visitor does a single thing.
This is where cookie consent comes in. In many places, non-essential cookies require the visitor's consent before they load, which is why you see consent banners. If your site embeds third-party content, a cookie consent notice and a matching section in your privacy policy are usually part of doing it properly.
- Check your embeds: maps, videos, fonts, chat widgets, and social feeds are the usual suspects.
- Check for a consent banner: if you set non-essential cookies, visitors may need to agree before those load.
4. Do you take bookings, payments, or accounts?
If a customer can book a slot, pay you, or create a login, your site handles more sensitive information, and it usually hands some of that to a payment or booking provider. That relationship belongs in your policy.
- Check what you gather: booking details, billing information, or account credentials all go beyond a simple enquiry.
- Check who processes it: a payment or booking service often handles the data on your behalf, and your policy should say a third party is involved.
5. Do you run a newsletter or a mailing list?
A sign-up box that adds someone to a mailing list is collecting an email address for ongoing contact, which is a distinct purpose from answering a one-off enquiry. Your policy should cover that, and the sign-up itself should make clear what the person is agreeing to.
- Check the purpose: keeping an address to email later is not the same as replying to a message, so describe it separately.
- Check the opt-out: people can expect a clear way to leave the list, and it helps to mention how.
Honesty about data is the part that keeps working
Add up your answers. If even one of the five applies, and for many small business sites the contact form alone does, you have your answer: you likely need a privacy policy, and those five points are most of what it should describe.
The part that trips people up is not writing the first version. It is keeping it true. Add a new booking tool, swap your analytics, drop in a video, and the site now collects something the policy does not mention. A privacy policy is only as honest as its last update, so it is worth revisiting whenever you change what your site does. This is one of the quiet reasons it helps to have a human looking after the technical side of your own website on its own domain, rather than assuming a page you wrote once still matches a site that has changed since. Treated that way, a privacy policy stops being legal boilerplate and becomes what it should be: a short, current, honest account of what happens to a visitor's information, which is exactly the kind of thing that can make a cautious first-time visitor comfortable enough to contact you.