Privacy Policy Generator (GDPR)
Assemble a sample GDPR privacy policy from blocks: hosting, contact form, cookies, analytics and newsletter. Nothing is uploaded anywhere.
This tool produces a sample for orientation. It is not legal advice and does not replace having your specific case reviewed by a lawyer.
Controller
Running the website
Contact channels
Cookies and analysis
Embedded services
Further processing
Still missing for a complete text: name of the controller, address of the controller, email address.
Preview
Review the text before you publish it. Which details are mandatory depends on your business, not on this form — and this tool does not know your business.
Guide: Privacy Policy Generator (GDPR)
A privacy policy answers a single question, separately for every operation: what happens to my data, and on what legal basis? That is exactly where most freely available samples fail. They list the services a website uses but name neither the purpose nor the legal basis — and so they do not satisfy Article 13 of the General Data Protection Regulation, even though the text looks complete.
This generator works with blocks. You enter the controller and tick what applies to your website: external hosting, server log files, a contact form, cookies, web analytics, a newsletter, a map service, web fonts, videos, social networks, payment providers, a booking system, chat, job applications, transfers to a third country. Each tick produces a section stating the purpose and the legal basis; removing a tick takes it out again.
The distinction between consent and legitimate interest is hard-wired here rather than a matter of taste. Web analytics, embedded maps, videos and externally loaded fonts are placed on Article 6 (1) (a) GDPR together with section 25 (1) TDDDG — that is, on consent. A sample that claims a legitimate interest at those points puts an incorrect statement on your site, and there it sits in black and white.
Typical use cases
A site with no analytics and no advertising
The commonest case for a small business: hosting, server log files, a contact form, nothing else. Untick everything you do not use — the text gets shorter and more accurate at the same time.
An online shop with a payment provider
Orders run on Article 6 (1) (b) GDPR, payments through providers acting on their own responsibility, and the retention periods under commercial and tax law remain unaffected.
A page with a map and embedded videos
Both services open a connection to a third-party server when they load, transmitting the IP address. The matching sections say precisely that and rest on consent.
A business advertising vacancies
Application documents are processing in their own right under section 26 (1) BDSG, with their own deletion period. The block names both, instead of letting applications disappear under “getting in touch”.
Proof-reading your existing policy
Assemble the text afresh and compare it section by section with what is on your site. What usually stands out are services switched off long ago, and missing legal bases.
How to use it
Enter the controller
Name, complete address and a way to get in touch. If you have appointed a data protection officer, their contact details are added; without an appointment the section stays out, rather than inventing a role that does not exist.
Tick how the website is run
External hosting and server log files apply to almost every website. Where you know the provider and the location of the servers, enter both — that turns a general formula into a statement someone can check.
Choose contact channels and analysis
Contact form, email, telephone; then technically necessary cookies, cookies requiring consent along with the consent tool in use, and web analytics with the name of the tool where applicable.
Name the embedded services
Map service, web fonts, videos and content delivery network. For fonts the choice between local delivery and Google Fonts decides the whole paragraph — in data protection terms the two are not the same case.
Check it, copy it, link it
Read the preview against what your site actually loads. Then copy the text or download it as a file and link to it from every page, usually from the footer.
What happens to your data
Everything you enter stays on your device: the address of your business, the names of your service providers, the contact details of your data protection officer. The text is built in the browser, nothing is transmitted to a server and nothing is stored. For a tool that writes data protection texts, anything else would be hard to explain — the list of services in use is a fairly precise picture of a company's technical setup.
Frequently asked questions
Why does the text not place web analytics on a legitimate interest?
Because storing and reading information on a terminal device requires consent under section 25 (1) TDDDG as soon as it is not technically necessary. For audience measurement that is practically always the case. A sample that claims a legitimate interest here is more convenient and wrong.
Do I have to name every service I use?
The regulation requires that data subjects can follow what happens to their data, and that generally includes who receives it. The name of the host, the analytics tool or the payment provider therefore belongs in the text. Where the generator offers a field for it, filling it in is not decoration.
What is the difference between necessary cookies and the rest?
Technically necessary means what the site needs in order to work — a session, a shopping basket, protecting a form. Everything else, audience measurement and advertising in particular, may only be set after consent. The sections in the generated text are separated accordingly and cite different legal bases.
Do I need a data protection officer?
Not every business does. An appointment is required where, among other things, the core activity involves large-scale processing of special categories of data or large-scale regular monitoring. Only tick the box if you have actually appointed someone — an invented role in the text is worse than none.
Does this tool replace a legal review?
No. It assembles a sample from blocks and shows which statements belong to which processing. Whether that selection fits your business, and whether you have captured every operation, is something it cannot know. Have the text reviewed before you publish it.