If your site has a contact form, a booking form or a "we will call you back" box, you are collecting a stranger's name and phone number every day. It does not matter whether you are a dentist, a lawyer, a hotel owner or a tradesperson. Most business owners think, "the customer types it in of their own free will," and assume the matter ends there.
Yet that is exactly what data protection rules are about: you need to tell the visitor plainly why you collect the information, where you keep it and whether you share it with anyone. In this article I explain in plain language which texts your site should have, how to check your own site and what to ask the person doing the work. For legal details you need to speak to a lawyer; I can only cover the website side.
What is personal data, and where does your site collect it?
Personal data is any information that identifies a person: name, phone, email, address. Information such as health or legal files is more sensitive and calls for extra care.
Your site may collect this data through:
- Contact and booking forms
- A newsletter sign-up box
- Shopping or reservation steps
- A WhatsApp or live chat button
- Visitor measurement tools and ad tracking (through cookies)
If you use any of these, the topic concerns you. Being a small business does not automatically leave you out.
Which texts should your site have?
Most countries have a data protection law, such as the GDPR in Europe. On your site you would normally expect to see these texts:
| Text | What it does |
|---|---|
| Privacy policy | Describes in general what data the site collects and why |
| Data notice | Tells the person filling in a form why and how their data will be used |
| Cookie information | Explains which cookies the site uses and what choices people have |
| Contact details | Shows people how to reach you about their data |
It is very important that the texts match what you really do. If what your site says differs from what happens behind the scenes, having the text will not protect you.
Why should you care?
There are three concrete reasons:
- Trust: for a business in a sensitive field such as health, a clear text showing how information is protected puts visitors at ease.
- Legal risk: missing texts, or texts that do not reflect reality, raise the risk of complaints and penalties. For exact information and possible consequences, consult a lawyer.
- Professional look: a site without a link to a privacy text near its forms looks careless.
What you can check yourself
Look at your own site through a visitor's eyes:
- Are there "Privacy policy" and "Data notice" links at the very bottom of the page, and do they open when you click?
- Near the contact or booking form, is there a link to the data notice or a short information sentence?
- Does the form ask for more than it needs? Asking only for what is necessary (name, phone, subject) is easier and safer.
- Does the text contain your business name, contact details and correct information, or does it look copied from another company?
- Whose email inbox do the form submissions land in? You need to know this.
What the specialist should do
The person who builds your site should:
- Add the data notice link, and a consent box where needed, to your forms.
- Make sure form data travels over a secure connection (the padlock icon in the address bar).
- List with you where the data goes: whose email inbox and which systems.
- Set up the cookie notice and make sure measurement tools do not run before consent is given.
- Place the texts properly (footer, next to forms).
The legal content of the texts should be prepared by a lawyer or someone expert in data protection; a web designer is no substitute.
Questions to ask the person doing the work
- Which forms are on my site and where does the information from them go?
- Do the forms work over a secure connection?
- Can the privacy and data notice texts be reached from the form and from the footer?
- What data do the measurement and advertising tools on the site collect?
- If a visitor asks for their data to be deleted, how will we handle that request?
- Who will update the texts when a new form or tool is added?
How long does it take, and what should you do?
Listing the forms and tools on your site is usually a few hours of work. Preparing the texts depends on legal support and may take longer. First check what you have, note what is missing, and give priority to the form that collects the most data. Once set up, the arrangement needs an update whenever you add something new to the site, and it is best to agree that with the person doing the work from the start.
Frequently asked questions
I only have a contact form. Do I still need a text?
If you collect information such as a name and phone number through the form, yes, you need to inform people. How detailed it must be depends on your business; for exact information consult a lawyer.
Can I copy another site's privacy text?
I would not recommend it. Every business collects different data and uses different tools. A copied text does not reflect your real situation and will not protect you.
Are a privacy policy and a data notice the same thing?
Not exactly. A privacy policy describes the site's general approach; a data notice is the specific information given to a person at the moment their data is collected. Often the two appear together.
Is it different if I collect sensitive information such as health details?
Yes, you need to be more careful. If you do not need health information on a form, do not ask for it; if you do, always work with a lawyer.
A privacy text is not decoration; it is your way of telling visitors how you protect their information. If you would like your site built right from the start, with forms, texts and security settings in place, have a look at my website design service.