Privacy policy: what you must inform people about and where to put it

Contents

• What is the privacy policy?
• What information is obligatory?
• Where do you have to show it?
• What risk do you run if you don't inform people properly?
• How Tranquilia generates it
• Frequently asked questions
• Official sources

What is the privacy policy?

It is how you comply with the RGPD's "duty to inform". The law starts from a simple idea: if you are going to use a person's data, that person has the right to know what you do with it, in clear language and before you keep it.

It is not the same as the legal notice (which identifies the company) or the cookie policy (which is about tracking on the website). They are three different texts, even though they often sit together in the same footer.

What information is obligatory?

Arts. 13 and 14 of the RGPD set out what you have to say. As a minimum:

1. Who you are: identity and contact details of the controller (your company).
2. What you use the data for (the purposes) and on what legal basis.
3. Who you share it with (gestoría, suppliers, the public authorities).
4. How long you keep it.
5. What rights the person has (access, rectification, erasure, objection...) and how to exercise them.
6. That they can complain to the AEPD if they think you are not complying.

Art. 13 applies when you collect the data directly from the person; art. 14, when you obtain it by another route. The information has to be "concise, transparent and intelligible" (art. 12): no wall of small print that nobody understands.

Where do you have to show it?

Wherever you ask for data, and somewhere always accessible:

• In your website footer, as a permanent link.
• Next to every form (contact, quote, newsletter), with a tick box or a clear link.
• When someone gives you their data in person or over the phone, with a version you can hand over or read out.

What risk do you run if you don't inform people properly?

Informing badly — or not informing at all — is one of the easiest things to spot: all it takes is a look at your website. The AEPD (Agencia Española de Protección de Datos, Spain's data protection authority) receives a lot of complaints precisely about forms with no information, or with generic texts that say nothing.

The RGPD sets the maximum penalties at two levels: up to 10 million euros or 2 % of turnover, and up to 20 million or 4 %, depending on the infringement (art. 83 RGPD); the higher figure applies. For an SME the usual outcome is not the maximum fine, but a form with no privacy policy is an open door to a complaint you could have avoided with a properly written text.

How Tranquilia generates it

From the questionnaire, Tranquilia drafts the privacy policy with the purposes and legal bases that belong to your activity, and leaves it ready for you to publish on your website and link from your forms. If you are a gestoría (a firm that handles other businesses' administrative paperwork), you generate one for each client company.

Frequently asked questions

Is it enough to copy the privacy policy from another website?

No. Every business processes different data, for different purposes. A copied policy usually lies about what you really do, and that is worse than not having one: you are informing people badly, which is also punishable.

Are the privacy policy and the legal notice the same thing?

No. The legal notice identifies the company and complies with the LSSI (Spain's information society services act); the privacy policy fulfils the RGPD's duty to inform. They are different texts, even though many websites link them together.

Do I have to inform my employees too?

Yes. Your workers are also people whose data you process (payroll, contracts). They need their own privacy information, separate from the one for your customers.

Official sources

• Reglamento (UE) 2016/679 (RGPD), articles 12, 13 and 14 (and art. 83, penalties) — text at EUR-Lex.
• Agencia Española de Protección de Datos (AEPD).
• BOE — Ley Orgánica 3/2018 (LOPDGDD), article 11 (duty to inform).

---

General information about the rules. It does not replace a lawyer's advice or an analysis of your specific case. If you have any doubts, check with your gestoría or with a legal professional.