What is it?

A privacy policy is a document in which you explain to visitors (or customers in case of a webshop): which personal data you collect and what you do with it. Data is considered to be 'personal' if you can trace the data back to a person. This is quickly the case. Think for example of someone's name, but also one's bank account number or IP-address.

In this privacy policy you explain, for example:

• what personal data you process;
• For which purpose(s) you process the data; and
• On what legal basis you process the data. 

Why do I need it?

The General Data Protection Regulation (GDPR) has strict rules that oblige you to inform your users and customers extensively. With this privacy policy, you comply with the information obligations in the GDPR and it's clear for users and customers what you do with their personal data.

Almost every company collects personal data. Nearly everything you do with that data (like storing, sorting and copying) is called processing of data. You process personal data, for example, when you use a contact form on your website. You are responsible for the adequate processing of personal data. As the 'data controller' you are obliged to inform visitors on how you use their data. You explain this in a privacy policy. There are high fines on violations, also for smaller companies.