Policy Pack

Which policies do I need?

Starting point, not legal advice. Laws differ by country, and in the US and Canada by state and province. This guide helps you work out which documents to prepare and what to ask a lawyer. Have a qualified lawyer review your final documents before you rely on them.

Answer the questions below for your business as it is today and as you expect it to be in the next year. Each "yes" points to a document in this pack and to the sections in it that matter most.

Business: ______________________ Completed by: ______________ Date: ____________

---

Step 1. Quick decision table

| Question | If yes, you need | Pack file |
|---|---|---|
| Does your website or app collect any personal data at all, including email addresses, contact forms, account details, IP addresses in logs or analytics? | A privacy policy | `privacy-policy.md` |
| Do you use cookies, local storage, pixels or similar technology that isn't strictly needed to deliver the service? | A cookie notice and, in many countries, a consent banner | `cookie-notice.md` |
| Do people create accounts, buy from you or use an online service you provide? | Terms of service | `terms-of-service.md` |
| Do you sell anything to consumers? | A refund and cancellation policy | `refund-policy.md` |
| Can users post content, send messages, upload files or use your service to reach other people? | An acceptable use policy | `acceptable-use-policy.md` |
| Do you use outside services that handle personal data for you (hosting, email, analytics, payments, support tools)? | A record of processing and contracts with those providers | `data-processing-checklist.md` |
| Are any of the above already published? | A maintenance routine and version history | `policy-maintenance.md` |

Almost every online business needs at least a privacy policy. A contact form or a mailing list is enough to make it necessary.

Step 2. Where are your customers?

Laws usually follow where your customers or users are, not only where your company is based. Tick every region where you have, or are aiming for, real customers.

| Region | Main rules to know about | Check |
|---|---|---|
| European Union and EEA | GDPR for personal data. The ePrivacy rules, as applied in each country, for cookies and marketing emails. The Consumer Rights Directive for cancellations and refunds. | [ ] |
| United Kingdom | UK GDPR and the Data Protection Act 2018. PECR for cookies and electronic marketing. The Consumer Contracts Regulations 2013 and the Consumer Rights Act 2015. | [ ] |
| California | CCPA as amended by CPRA, if your business meets its thresholds. California's automatic renewal law for subscriptions. CalOPPA requires a privacy policy for commercial websites that collect personal information from California residents. | [ ] |
| Other US states | A growing number of states have their own comprehensive privacy laws with different thresholds and rights. COPPA applies nationwide to services aimed at children under 13. | [ ] |
| Canada | PIPEDA for private-sector organisations in most provinces, with separate provincial laws in some, including Quebec. CASL for commercial electronic messages. | [ ] |
| Australia | The Privacy Act 1988 and the Australian Privacy Principles, for businesses it covers. The Australian Consumer Law, including automatic consumer rights that a refund policy can't remove. | [ ] |
| Elsewhere | Many countries have privacy and consumer laws modelled on the ones above. List them here: [Countries]. | [ ] |

If you tick more than one region, write your documents to meet the strictest standard that applies, then add region-specific sections where the rules differ. The templates in this pack are set up that way.

Step 3. Questions that change what your documents say

Answer yes or no. A "yes" means a specific section needs extra care.

| Question | Yes / No | What it affects |
|---|---|---|
| Do you collect data about children, or is your service likely to attract under-18s? | [ ] | Children section of the privacy policy. Possibly parental consent, age checks and a child-focused design review. Get advice. |
| Do you collect health, biometric, financial, precise location, religious, political or sexual orientation data? | [ ] | Sensitive data rules in GDPR and many US state laws. Usually needs explicit consent or another specific condition. |
| Do you share or sell personal data for advertising, or use third-party ad pixels? | [ ] | Opt-out rights under CCPA/CPRA and other US state laws ("sale" and "sharing"), cookie consent in the EU and UK. |
| Do you send marketing emails or texts? | [ ] | Consent and unsubscribe rules. Privacy policy section on marketing. |
| Do you make automated decisions that significantly affect people, such as approvals or pricing? | [ ] | GDPR rules on automated decision-making and profiling. |
| Do you use AI features that process user content? | [ ] | Privacy policy: what data goes to which provider, whether it is used for training, how long it is kept. |
| Do you store data outside the country where your users are? | [ ] | International transfers section. Transfer safeguards such as standard contractual clauses. |
| Do you offer subscriptions that renew automatically? | [ ] | Renewal terms, reminders and cancellation method in the terms and refund policy. |
| Do you sell digital downloads or online access? | [ ] | The digital content wording in the refund policy and your checkout. |
| Do you let users post public content or message each other? | [ ] | Acceptable use policy, content licence in the terms, a way to report content. Some countries have specific online safety and notice-and-action rules. |
| Do you sell to businesses only? | [ ] | Consumer rules may not apply, but you still need privacy and terms. B2B customers will often ask for a data processing agreement. |
| Do you process personal data on behalf of your business customers? | [ ] | You are likely a processor for that data. Offer a data processing agreement. |

Step 4. Your document list

Copy the outcome here so it becomes a plan.

| Document | Needed? | Owner | Draft by | Lawyer review by | Published |
|---|---|---|---|---|---|
| Privacy policy | [ ] | [Name] | [Date] | [Date] | [ ] |
| Cookie notice and banner | [ ] | [Name] | [Date] | [Date] | [ ] |
| Terms of service | [ ] | [Name] | [Date] | [Date] | [ ] |
| Refund and cancellation policy | [ ] | [Name] | [Date] | [Date] | [ ] |
| Acceptable use policy | [ ] | [Name] | [Date] | [Date] | [ ] |
| Record of processing and processor list | [ ] | [Name] | [Date] | - | Internal |
| Data processing agreement for your customers | [ ] | [Name] | [Date] | [Date] | [ ] |
| Policy maintenance log | [ ] | [Name] | [Date] | - | Internal |

Step 5. Before you write a word

Policies describe what you actually do. If you write them from a template without checking, they will be wrong, and a wrong policy can be worse than a short honest one.

1. Fill in data-processing-checklist.md first. It tells you what data you hold, why, where and for how long.
2. Check your website and app for every tag, pixel, script and embed. Your browser's developer tools show the cookies and network requests on each page.
3. List every outside service that touches personal data.
4. Then draft the documents in this order: privacy policy, cookie notice, terms, refund policy, acceptable use policy.
5. Book the lawyer review once the drafts are complete, not before. You will get better advice on a full draft.

What to ask your lawyer

• Which laws apply to us, given where our customers are and what we sell?
• Do we meet any thresholds that bring us under CCPA/CPRA or other US state privacy laws?
• Which lawful basis fits each purpose in our data table?
• Is our cookie banner compliant in our main markets?
• Are our limitation of liability and governing law clauses enforceable against consumers where we sell?
• Does our refund policy respect the statutory rights that can't be removed?
• Do we need to appoint an EU or UK representative, or a data protection officer?

Privacy policy template

Starting point, not legal advice. Privacy laws differ by country and, in the US and Canada, by state and province. This template is written to work alongside the GDPR, UK GDPR and CCPA as amended by CPRA, but it doesn't make you compliant on its own. Have a qualified lawyer review your final policy before you rely on it.

How to use this template

• Fill in data-processing-checklist.md first. This policy should describe what that record shows, nothing more and nothing less.
• Replace every [bracketed field]. Delete sections that don't apply, and say so where silence would confuse, for example "We do not sell personal information."
• Keep the "Summary" short and true. Many people only read that part.
• The sections marked EU and UK, California and Other US states only apply if those laws apply to you. Remove them if not, but check first (see which-policies-do-i-need.md).
• Write in plain language. If a sentence needs a lawyer to understand it, rewrite it or ask your lawyer to.
• Publish the policy at a stable address such as /privacy, link it from every page footer and from every form that collects personal data.

Everything below the line is the policy itself.

---

Privacy policy

Last updated: [22 October 2026] Effective from: [22 October 2026]

Summary

• [Company name] collects [the personal data you give us when you create an account, buy something or contact us, and basic technical data about how you use our site].
• We use it to [provide our service, process payments, support you and improve the product].
• We [do not sell your personal information / do not share it for cross-context behavioural advertising].
• We share it only with service providers who help us run [Product name], and with authorities where the law requires.
• You can ask to see, correct, export or delete your data by emailing [[email protected]].

The rest of this policy explains each point in detail.

1. Who we are

[Company name] ("we", "us", "our") runs [the website at example.com and the Product name app] (together, the "Service").

• Legal name: [Company legal name]
• Registered address: [Address, country]
• Company number: [Number, if applicable]
• Contact for privacy questions: [[email protected]]

For the purposes of the GDPR and UK GDPR, [Company name] is the controller of the personal data described in this policy, except where section 12 says otherwise.

[If you have appointed one:] Our data protection officer is [Name or firm], who can be reached at [[email protected]].

[If required, because you are outside the EU or UK but offer goods or services to people there:] Our representative in the EU is [Name, address, email]. Our representative in the UK is [Name, address, email].

2. The personal data we collect

Data you give us

| Category | Examples | When we collect it |
|---|---|---|
| Identity and contact | [Name, email address, phone number] | [When you sign up, buy or contact us] |
| Account | [Username, password (stored hashed), preferences] | [When you create an account] |
| Payment | [Billing name, billing address, last four digits of card, transaction history] | [When you buy. Full card details are handled by our payment provider, not stored by us.] |
| Communications | [Messages, support requests, survey answers] | [When you contact us or respond to a survey] |
| Content you create | [Files, posts, comments, project data] | [When you use the Service] |
| Marketing preferences | [Whether you've opted in to our emails] | [When you subscribe or change settings] |
| [Other] | [Examples] | [When] |

Data we collect automatically

| Category | Examples | How |
|---|---|---|
| Device and technical | [IP address, browser type, operating system, device identifiers] | [Server logs, cookies and similar technology] |
| Usage | [Pages viewed, features used, clicks, time on page, referring site] | [Analytics tools, see section 9] |
| Approximate location | [Country or city derived from IP address] | [Server logs, analytics] |
| [Other] | [Examples] | [How] |

Data we receive from others

| Source | Data | Why |
|---|---|---|
| [Sign-in providers, such as Google or Apple] | [Name, email, profile picture] | [When you choose to sign in with them] |
| [Payment provider] | [Payment status, fraud signals] | [To confirm payments and prevent fraud] |
| [Your employer or team admin] | [Name, work email] | [When they invite you to their workspace] |
| [Other] | [Data] | [Why] |

Sensitive data

[Choose one:]

• We do not intentionally collect sensitive data such as health, biometric, racial or ethnic origin, religious, political or sexual orientation data. Please don't send it to us.
• We collect [describe sensitive data] for [purpose]. We do this only [with your explicit consent / because describe legal condition], and we protect it with [describe extra safeguards].

3. How we use your data and our lawful bases

We use personal data only for the purposes below. If you are in the EU, EEA or UK, the law requires us to have a lawful basis for each purpose. The table shows which one we rely on.

| Purpose | Data used | Lawful basis (EU and UK) |
|---|---|---|
| Create and manage your account | Identity, contact, account | Contract: we need it to provide the Service you asked for |
| Provide the Service and its features | Account, content, usage | Contract |
| Take payments, issue invoices and keep financial records | Identity, payment | Contract; Legal obligation (tax and accounting records) |
| Respond to support requests | Identity, communications | Contract, or Legitimate interests (answering questions from people who aren't customers) |
| Send service messages such as receipts, security alerts and changes to terms | Contact | Contract; Legitimate interests |
| Send marketing emails | Contact, marketing preferences | Consent, or Legitimate interests where the law allows us to email existing customers about similar products, with an easy opt-out |
| Understand how the Service is used and improve it | Usage, technical | Legitimate interests, or Consent where cookies or similar technology require it |
| Keep the Service secure and prevent fraud and abuse | Technical, usage, payment | Legitimate interests; Legal obligation |
| Comply with the law and respond to lawful requests | Any relevant data | Legal obligation |
| Establish, exercise or defend legal claims | Any relevant data | Legitimate interests |
| [Other purpose] | [Data] | [Basis] |

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that assessment, and you can object (see section 8).

Where we rely on consent, you can withdraw it at any time. Withdrawing doesn't affect anything we did before.

Where we need data to perform a contract with you and you don't provide it, we may not be able to provide the Service.

[If applicable:] Automated decisions. We [do not make decisions about you based solely on automated processing that have legal or similarly significant effects / use automated processing to describe what, for example fraud screening at checkout. You can ask for a person to review the decision by contacting us].

[If applicable:] AI features. When you use [feature name], the content you submit is sent to [provider type, e.g. "a third-party model provider"] to produce a result. [It is / is not] used to train models. It is kept for [period]. [Explain any opt-out.]

4. Who we share your data with

We don't share personal data except as described here.

| Recipient | Purpose | Location |
|---|---|---|
| [Hosting provider] | Hosting the Service and storing data | [Country or region] |
| [Payment provider] | Processing payments | [Country or region] |
| [Email provider] | Sending service and marketing emails | [Country or region] |
| [Analytics provider] | Understanding use of the Service | [Country or region] |
| [Support tool] | Managing support requests | [Country or region] |
| [Other] | [Purpose] | [Location] |

These service providers act on our instructions under written contracts that require them to protect your data and use it only to provide services to us. [An up-to-date list is available at link.]

We may also share personal data:

• With professional advisers such as lawyers, accountants and auditors, under confidentiality duties.
• With authorities when the law requires it, or when we believe in good faith it's necessary to protect someone's safety, investigate fraud or respond to a lawful request.
• In a business transfer, if [Company name] is involved in a merger, acquisition or sale of assets. We'll tell you before your data becomes subject to a different privacy policy.
• With your consent or at your direction, for example when you connect a third-party integration.

We [do not] sell personal information, and we [do not] share it for cross-context behavioural advertising, as those terms are defined in California law. [If you do, say so here and describe your opt-out in section 8.]

5. How long we keep your data

We keep personal data only as long as we need it for the purposes in section 3, then delete or anonymise it.

| Data | Retention period | Why |
|---|---|---|
| Account data | [For as long as your account is open, then deleted within 30 days of closure] | Providing the Service |
| Content you create | [Until you delete it or close your account, then removed from backups within 90 days] | Providing the Service |
| Payment and invoice records | [Number of years required by tax law in country, often 6 to 10 years] | Legal obligation |
| Support conversations | [2 years after the conversation closes] | Support quality, legal claims |
| Marketing preferences | [Until you unsubscribe, plus a suppression record so we don't email you again] | Respecting your choice |
| Server logs | [30 days] | Security |
| Analytics data | [14 months] | Product improvement |
| [Other] | [Period] | [Why] |

6. How we protect your data

We use technical and organisational measures appropriate to the risk, including [encryption in transit and at rest, access controls with two-factor authentication for staff, least-privilege access, regular backups, logging and monitoring, and staff confidentiality obligations].

No system is completely secure. If a breach affects your personal data in a way that is likely to put you at risk, we'll tell you and the relevant regulator where the law requires.

7. International transfers

[Company name] is based in [country]. Our service providers process data in [countries or regions]. This means your data may be transferred to and stored in countries with different data protection laws from your own.

EU, EEA and UK. When we transfer personal data out of the EU, EEA or UK, we make sure it is protected by one of the following:

• An adequacy decision, meaning the destination country has been found to provide adequate protection. For transfers to the United States, this may include recipients certified under the EU-US Data Privacy Framework and its UK Extension.
• Standard contractual clauses approved by the European Commission, together with the UK International Data Transfer Addendum or the UK International Data Transfer Agreement for UK data.
• Another safeguard or condition allowed by the law.

You can ask us for a copy of the safeguards we rely on by emailing [[email protected]].

8. Your rights and how to use them

Everyone

Wherever you are, you can:

• Ask what personal data we hold about you and get a copy.
• Ask us to correct data that is wrong.
• Ask us to delete your data.
• Unsubscribe from marketing emails at any time, using the link in each email or by contacting us.
• Close your account in [Settings > Account].

We'll answer every request, and we won't treat you differently for using your rights.

EU, EEA and UK

Under the GDPR and UK GDPR you have the right to:

• Access your personal data.
• Rectification of inaccurate data.
• Erasure in certain circumstances.
• Restriction of processing in certain circumstances.
• Data portability: receive data you gave us in a structured, machine-readable format, or have it sent to another controller, where processing is based on consent or contract and carried out by automated means.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects, with some exceptions.
• Withdraw consent at any time, where we rely on it.
• Complain to a supervisory authority. In the UK this is the Information Commissioner's Office. In the EU it is the data protection authority where you live, work or think the problem happened. We'd appreciate the chance to address your concern first.

California

If the CCPA as amended by CPRA applies to us, California residents have the right to:

• Know what personal information we collect, use, disclose, sell and share, and to access it.
• Delete personal information we collected from you, subject to exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information. [We do not sell or share personal information. / Use the "Do Not Sell or Share My Personal Information" link at link.]
• Limit the use and disclosure of sensitive personal information to what is needed to provide the Service. [We only use sensitive personal information for those purposes. / Use the "Limit the Use of My Sensitive Personal Information" link at link.]
• Not be discriminated against for using these rights.

We [honour / will honour] opt-out preference signals such as Global Privacy Control as a valid request to opt out of sale and sharing for that browser [and any account linked to it].

In the past 12 months we collected the categories of personal information listed in section 2, from the sources listed there, for the purposes in section 3, and disclosed them for business purposes to the categories of recipients in section 4. [We have not sold or shared personal information in the past 12 months.]

You can use an authorised agent to make a request on your behalf. We may ask the agent for proof of authorisation and ask you to confirm your identity directly.

Other US states

Several US states give residents rights similar to those above, such as access, correction, deletion, portability and opting out of targeted advertising, sale and certain profiling. If one of these laws applies to you, use the contact details below. If we decline your request, you can appeal by replying to our decision with the subject line "Appeal". [If the law in your state requires it, add how to contact the state attorney general if the appeal is denied.]

Canada and Australia

If you are in Canada, you have rights of access and correction under PIPEDA or the applicable provincial law, and you can complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner. If you are in Australia, you can access and correct your information under the Privacy Act 1988 and complain to the Office of the Australian Information Commissioner if you are not satisfied with our response.

How to make a request

• Email [[email protected]] with the subject "Privacy request", or use [the form at link / Settings > Privacy].
• Tell us what you'd like us to do and which email address or account the request relates to.
• We'll confirm your identity before acting, usually by asking you to reply from the email address on your account. We'll only ask for what we need to confirm it's you.
• We'll respond within the time the law requires, usually [one month (EU and UK) or 45 days (California)], and tell you if we need longer and why.
• Requests are handled at no cost, unless they are clearly unfounded or excessive, where the law allows us to charge a reasonable fee or refuse.

9. Cookies and similar technology

We use cookies and similar technology such as local storage and pixels to [keep you signed in, remember your preferences, understand how the Service is used and measure marketing]. Some are strictly necessary. Others are only set if you agree.

You can change your choices at any time in [Cookie settings, link in the footer]. Full details, including a list of the cookies we use, are in our [Cookie notice, link].

10. Children

The Service is [not directed at children under 13 / 16 / 18] and we don't knowingly collect personal data from them. If you believe a child has given us personal data, contact [[email protected]] and we'll delete it.

[If your service is aimed at or likely to be used by children, replace this section with advice from a lawyer. Rules such as COPPA in the US, the age of digital consent under GDPR Article 8, and the UK Age Appropriate Design Code may apply.]

11. Links to other sites

The Service may link to websites and services we don't control. Their own privacy policies apply, not this one.

12. When we process data for our business customers

[Delete if not applicable.] When a business uses [Product name] to process personal data about its own customers or staff, that business is the controller and we act as its processor. Our [Data processing agreement, link] governs that processing. If your data is in a workspace run by an organisation, please contact that organisation first.

13. Changes to this policy

We'll update this policy when our practices or the law change. The "Last updated" date at the top shows when it last changed. If we make a significant change, we'll tell you [by email or with a notice in the Service] at least [30] days before it takes effect, unless the change is required sooner by law. Previous versions are available [at link / on request].

14. Contact us

• Email: [[email protected]]
• Post: [Company legal name, address, country]
• [Data protection officer: Name, email]
• [EU representative: Name, address, email]
• [UK representative: Name, address, email]
• [Phone number for California requests, if the law requires one for your business: number]

Cookie notice and banner template

Starting point, not legal advice. Cookie rules differ by country. In the EU and UK, most cookies and similar technology that aren't strictly necessary need consent before they are set, and some countries allow limited exceptions. In the US, rules focus more on disclosure and opt-outs. Have a qualified lawyer review your banner and notice before you rely on them.

This file has four parts:

1. Banner wording you can copy, in three variants.
2. A preferences panel with categories.
3. The cookie notice page itself, with a cookie table template.
4. A checklist for setting it up properly.

"Cookies" here also covers similar technology: local storage, session storage, pixels, tags, SDKs in apps and device fingerprinting. The rules usually treat them the same way.

---

Part 1. Banner wording

Principles

• Accept and reject with equal weight. Same size, same style, same level, both visible on the first layer. Regulators in the EU and UK have said a reject option that is harder to find than accept isn't a valid choice.
• No non-essential cookies before a choice. Analytics, advertising and most embeds load only after consent.
• Closing the banner is not consent. If someone dismisses it, treat that as no choice yet, and keep non-essential cookies off.
• No pre-ticked boxes. Every optional category starts off.
• Plain words. Say what you use cookies for, not just "to improve your experience".
• Easy to change later. A "Cookie settings" link in the footer of every page.

Variant A: standard

Cookies on [Company name]

We use necessary cookies to make this site work. With your permission, we'd also like to use analytics cookies to understand how the site is used, and marketing cookies to measure our ads. You can change your choice at any time in Cookie settings.

[Accept all] [Reject all] [Manage settings]

[Read our cookie notice]

Variant B: short, for small screens

We use necessary cookies to run this site, and optional cookies for analytics and ads if you allow them.

[Accept all] [Reject all] [Settings]

Variant C: analytics only, no advertising

Help us improve [Product name]

We'd like to use analytics cookies to see which pages people use and where they get stuck. We don't use advertising cookies. Necessary cookies that keep the site working are always on.

[Allow analytics] [No thanks]

[Cookie notice]

If you use no optional cookies

You may not need a banner at all. Say so in your cookie notice instead:

We only use cookies that are strictly necessary for this site to work, such as keeping you signed in and remembering your cookie choice. We don't use analytics or advertising cookies.

US-focused variant (opt-out model)

Where your audience is mainly in US states that use an opt-out model, a notice plus clear opt-out links may be used instead of a consent banner. If you serve EU or UK visitors as well, use one of the variants above for them.

We and our partners use cookies for analytics and personalised advertising. You can opt out of the sale or sharing of your personal information, including through cookies, at any time.

[Do Not Sell or Share My Personal Information] [Cookie settings] [OK]

Honour browser opt-out signals such as Global Privacy Control where the law requires.

Wording to avoid

| Avoid | Why | Use instead |
|---|---|---|
| "By continuing to browse, you accept cookies." | Continuing to browse isn't valid consent in the EU or UK. | Ask for an active choice. |
| "We value your privacy" followed only by an Accept button | No real choice. | Put Accept and Reject side by side. |
| "Reject" hidden in a second layer or shown as a faint link | Unequal choice. | Same style and level for both. |
| "Cookies to improve your experience" | Too vague to inform anyone. | Name the purpose: analytics, advertising, preferences. |
| "Accept all to continue" with the site blocked | Consent must be freely given, so blocking access for refusing optional cookies is risky in many places. | Let people use the site after rejecting. |

---

Part 2. Preferences panel

Show these categories, each with a short description. Only "Necessary" is on by default and can't be turned off.

Cookie settings

Choose which cookies we can use. You can change this at any time from the Cookie settings link at the bottom of every page.

Necessary - Always on

These make the site work: signing in, keeping your session secure, remembering items in your basket and remembering your cookie choice. The site can't work properly without them.

Preferences - Off

These remember choices such as language, region or display settings, so you don't have to set them each visit.

Analytics - Off

These help us understand how people use the site, which pages are visited and where errors happen, so we can improve it. [We use Analytics provider. Data is reported in aggregate.]

Marketing - Off

These are set by us and our advertising partners to measure how well our ads work and, where allowed, to show you relevant ads on other sites.

[Save choices] [Accept all] [Reject all]

Keep the category names the same in the banner, the panel, the notice and your consent tool so people can follow them.

---

Part 3. The cookie notice page

Everything below the line is the notice to publish, for example at /cookies.

---

Cookie notice

Last updated: [22 October 2026]

This notice explains how [Company name] uses cookies and similar technology on [example.com and the Product name app]. It should be read together with our [Privacy policy, link].

What cookies are

Cookies are small text files that a website stores on your device. Similar technology includes local storage, pixels (tiny images that report when a page or email is viewed) and software development kits in apps. We call all of these "cookies" in this notice.

Cookies set by us are "first-party" cookies. Cookies set by another company, such as an analytics or advertising provider, are "third-party" cookies.

Some cookies last only until you close your browser ("session cookies"). Others stay for a set period ("persistent cookies").

How we use cookies

| Category | What they do | Can you turn them off? |
|---|---|---|
| Necessary | Make the site work and keep it secure | No, but you can block them in your browser, and parts of the site may then stop working |
| Preferences | Remember your choices | Yes |
| Analytics | Help us understand use of the site | Yes |
| Marketing | Measure ads and, where allowed, personalise them | Yes |

We only set preferences, analytics and marketing cookies if you agree [or, in places where the law uses an opt-out model, until you opt out].

The cookies we use

| Name | Provider | Category | Purpose | Duration | First or third party |
|---|---|---|---|---|---|
| [session_id] | [Company name] | Necessary | Keeps you signed in | [Session] | First |
| [csrf_token] | [Company name] | Necessary | Protects forms against cross-site request forgery | [Session] | First |
| [cookie_consent] | [Company name] | Necessary | Remembers your cookie choices | [12 months] | First |
| [lang] | [Company name] | Preferences | Remembers your language | [12 months] | First |
| [Analytics cookie name] | [Analytics provider] | Analytics | Distinguishes visitors and sessions | [Duration] | [Third] |
| [Ad cookie name] | [Ad provider] | Marketing | Measures ad conversions | [Duration] | [Third] |
| [Name] | [Provider] | [Category] | [Purpose] | [Duration] | [Party] |

We review this list [every quarter and whenever we add a new tool]. Third-party providers may change their cookie names; their own policies have the current details: [links to provider privacy or cookie pages].

Your choices

• Cookie settings: change your choice at any time using [Cookie settings, link in the footer].
• Your browser: most browsers let you block or delete cookies. Blocking necessary cookies may stop parts of the site from working.
• Opt-out signals: we [honour Global Privacy Control signals as an opt-out of sale and sharing where the law requires].
• Advertising opt-outs: [Industry opt-out tools, if relevant to your markets].
• Emails: [Our emails may contain pixels that tell us whether an email was opened. You can block these by turning off automatic image loading in your email app.]

Changes

We'll update this notice when we change the cookies we use. The date at the top shows the latest version. If a change needs your consent, we'll ask again.

Contact

Questions about cookies: [[email protected]].

---

Part 4. Setup checklist

• Scan every page and app screen for cookies, local storage and network calls to third parties. Do it with a fresh browser profile and no consent given.
• Fill in the cookie table from what you found, not from what you think you use.
• Confirm no optional cookies or tags fire before consent. Check with your browser's developer tools on first load.
• Confirm "Reject all" really stops them, including after a page reload.
• Confirm consent is stored and respected across pages and visits.
• Confirm withdrawing consent stops the cookies from then on, and deletes first-party optional cookies where possible.
• Ask again for consent after [6 to 12 months], or when you add a new purpose.
• Keep a record of each consent: when, what version of the banner, which categories.
• Embedded videos, maps and social widgets load only after consent, or use a privacy-enhanced mode or a click-to-load placeholder.
• Footer link to Cookie settings on every page.
• Banner works with a keyboard and a screen reader, and doesn't trap focus.
• Banner text and buttons meet colour contrast requirements.
• Mobile app consent prompts match the website categories.
• Review the setup [every quarter] and when you add any new tool.