External Privacy Notice

• Enable Editing: Click “Enable Editing” in Word.
• Fill in the Blanks: Replace all [Bold Brackets] with your company’s specific details. These are mandatory fields.
• Review Examples: Text in [regular brackets] are suggestions. Feel free to change them to match your actual practices. If a section doesn’t apply (you don’t collect children’s data), you can delete it.
• Legal Review: Always have this document reviewed by legal counsel before publishing.

Before you start, think about these questions:

• Who is the Data Controller? Is it your main legal entity? List the exact registered name and address in Section 0.
• What data do you actually collect? Be honest. If you don’t collect health data, keep the “Sensitive Personal Data” section as-is (stating you don’t collect it).
• Which third parties do you use? Update the Sub-Processors table (Section 3.1) with your actual vendors (AWS, Stripe, etc.).
• What are your retention periods? The table in Section 5 has examples. Adjust them to match your data retention policy.

• Section 0 (Controller Identity): This is a GDPR requirement. Use your official legal entity name and registered address.
• Section 3.1 (Sub-Processors): This table satisfies GDPR Article 13(1)(e). Keep it updated as you add new vendors.
• Section 7 (Your Rights): The rights listed are comprehensive. If you don’t operate in the EU or California, you can remove the irrelevant subsections, but keeping them shows thoroughness.
• Section 10 (Contact): Ensure the DPO email (privacy@yourcompany.com) is a real, monitored inbox.
• Section 12 (Version History): Update this table every time you revise the notice. Auditors love to see a clear change log.

• Did you replace all [Bold Brackets] with your actual company details?
• Did you review and adjust the [example text] to match your practices?
• Does the Data Controller information match your legal entity registration?
• Did you update the Sub-Processors table with your actual vendors?
• Did you set realistic retention periods in Section 5?
• Has legal counsel reviewed and approved this notice?

• Publish: Post the final version on your website (e.g., yourcompany.com/privacy).
• Link: Reference this notice in your DSAR form, cookie banner, and terms of service.
• Archive: Save the signed/approved version in your compliance evidence folder.
• Share: Notify your team (Support, Engineering, Marketing) when it’s live so they can reference it.

• Keep It Accurate: Don’t promise practices you don’t follow. If you say “we encrypt all data,” make sure you actually do. Auditors prefer honesty over perfection.
• Link to Procedures: If you have separate documents for “Cookie Policy” or “Data Retention Schedule,” reference them here. It keeps this notice concise.
• Review Annually: Privacy laws change. Review this notice at least once a year or when you launch new features.