This is a skeleton, not legal advice. The headings below are the ones most privacy regimes expect — India’s DPDP Act, the GDPR and the CCPA among them. Have someone qualified write the wording before you publish, and delete this notice.
Who we are
Legal entity name, registered address, and how to reach the person responsible for data protection.
What we collect and why
- Form submissions. Name, email, website, phone and message, so we can send the audit you asked for.
- Analytics. Which analytics tool you use, what it records, and whether it is anonymised.
- Cookies. Which ones, set by whom, and how long they last.
How long we keep it
State an actual period. “As long as necessary” is not a retention policy.
Who we share it with
List your processors: hosting, email, CRM, analytics. Name them.
Your rights
Access, correction, deletion, portability and objection — and the single email address someone uses to exercise them.
Changes to this policy
How you will notify people, and the date this version took effect.